Privacy policy

1. About this policy

This policy is our privacy notice under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), Article 10. It explains what personal data we process about everyone who visits or joins badiscore.com, why and on what legal basis, who we share it with, and what your rights are.

2. Data controller

Your personal data is processed by the person who runs BadiScore ("BadiScore", "we", "us"), as data controller, whose details are below.

3. The personal data we process

• Identity and contact: your email address and, if you set one, your display name. If you log in with Google, Google sends us your name, email address and a link to your profile picture; these are kept in your sign-in record, and on the site we use your email address and the display name you chose.
• Account and preferences: your membership type (free or Pro), the teams you follow, the lists you save and your language; for older accounts with a password, a hash of the password, never the password itself.
• Subscription: your subscription status and billing periods. Once payments start, payment records (amount, date, transaction reference) will also be processed. Your card details never reach our servers; card payments are handled by the payment service provider.
• Security data: IP address, browser and device information, sign-in times and session data.
• Usage statistics: only if you agree, through Google Analytics: the pages you visit, device type, approximate location (country or city) and how long you stay. If you do not agree, Google only receives cookieless signals that carry no identifiers.
• Correspondence: emails and requests you send us.
• Admin log: if one of our administrators takes an action on your account (for example changing the membership type, blocking or deleting the account), the action and the account's email address are written to the admin log.

We do not process special categories of data (such as health, religion or biometric data). The site is not meant for anyone under 18 and we do not knowingly process their data. Some things, such as your theme and the list kept on your device, are stored only on your device and never sent to us (see the Cookie policy).

4. Why we use it

• to create your account, let you log in and provide the Service;
• to show you the teams you follow and the lists you save;
• to run the Pro subscription and, once payments start, to handle payment, invoicing and accounting;
• to email you sign-in codes and essential messages about your account;
• to keep the site secure and prevent misuse (such as automated data collection) and unauthorised access;
• to answer your questions and requests;
• if you agree, to measure how the site is used and improve it;
• to meet our legal obligations and protect our rights in any dispute.

We do not send marketing emails. If we ever want to, we will ask for your consent first. We do not sell your personal data or use it for advertising. We do not make automated decisions about you: our models assess matches, not people.

5. Legal bases (KVKK Article 5)

• Entering into and performing a contract (Art. 5(2)(c)): your account, sign-in, followed teams, saved lists, the Pro subscription and related emails.
• Legal obligation (Art. 5(2)(ç)): once payments start, record-keeping duties under tax and commercial law; lawful requests from the authorities.
• Establishing, exercising or defending a right (Art. 5(2)(e)): records needed in disputes, and the admin log.
• Legitimate interests (Art. 5(2)(f)): site security, preventing misuse, security records and accountability for admin actions, always without harming your fundamental rights and freedoms.
• Explicit consent (Art. 5(1)): Google Analytics statistics cookies. You can withdraw your consent at any time on the Cookie policy page.

6. How we collect it

We collect your data, by automated or partly automated means, from what you enter when you sign up and use the site, from Google if you choose to log in with Google, through cookies and similar technologies, from server and security logs, and from emails you send us.

7. Who we share it with

We use the following service providers to run the Service. They process data on our behalf:

• Supabase: database, membership and sign-in. Data is hosted in the European Union (Ireland).
• Cloudflare: hosting, content delivery and security. Because it runs on a global network, IP addresses and request data may be processed outside Türkiye.
• Google: Google Analytics (statistics) if you agree; Sign in with Google if you choose it.
• Email delivery service: sending sign-in codes and account emails.
• Payment service provider: to be chosen before payments start; this policy will be updated then.

We disclose data to public authorities only when the law requires it, and only as much as is needed. Our administrator and team members working with limited permissions can see members' email addresses and membership types so that they can run the Service.

8. Transfers outside Türkiye

The servers of the providers above are outside Türkiye (in the European Union, the United States and Cloudflare's global network), so your personal data is transferred abroad. These transfers are made in line with KVKK Article 9, in particular on the basis of appropriate safeguards such as the standard contracts published by the Turkish Personal Data Protection Board.

9. How long we keep it

• Account data: until you delete your account. "Delete account" removes it immediately, together with your profile, followed teams, saved lists and subscription records.
• Records we must keep by law: once payments start, records such as invoices and accounting records, for the period the law requires.
• Security records: for our providers' (Supabase, Cloudflare) standard periods.
• Admin log: the record of an admin action on your account and the account's email address are kept for accountability, also after the account is deleted.
• Statistics: for the retention period set in Google Analytics; cookies until they expire or you delete them.
• Correspondence: until your request is resolved and for as long as it may be needed in a dispute.

When the period ends or the reason for processing no longer applies, your data is deleted, destroyed or anonymised.

10. Security

Your data is encrypted in transit (TLS). In the database, row-level access rules limit who can reach each record, and team members can only see data within the permissions they have been given. We use one-time codes instead of passwords for signing in. Card details never reach our servers. If a data breach occurs, we will notify the Personal Data Protection Board and the people affected, as KVKK Article 12 requires.

11. Your rights (KVKK Article 11)

Under KVKK Article 11, you have the right to apply to the data controller to:

• find out whether your personal data is processed;
• request information about it if it is;
• find out why it is processed and whether it is used for that purpose;
• know the third parties, in Türkiye or abroad, to whom it is transferred;
• have it corrected if it is incomplete or inaccurate;
• have it erased or destroyed under the conditions in KVKK Article 7;
• have any correction, erasure or destruction notified to the third parties it was transferred to;
• object to an outcome against you that arises from analysis of your data exclusively by automated systems;
• claim compensation if you suffer damage because your data was processed unlawfully.

Where processing relies on your consent, you can withdraw it at any time. You can change your display name and delete your account yourself on the My account page.

12. How to make a request

You can send your request, in Turkish, in one of these ways:

• by email to destek@badiscore.com from the email address registered with us;
• by email signed with a secure electronic or mobile signature.

Your request should include your full name; your Turkish ID number if you are a Turkish citizen (or your nationality and passport or ID number if you are not); your residential or business address for correspondence; your email address and telephone number if you have them; and what you are asking for.

We will respond within 30 days at the latest. Requests are free of charge in principle; if dealing with one involves an additional cost, a fee may be charged in line with the Board's tariff. If your request is refused, you find the answer unsatisfactory, or you receive no answer in time, you may complain to the Personal Data Protection Board within 30 days of learning of our answer, and in any case within 60 days of your request.

13. Changes

We may update this policy. The current version is always on this page, and the date at the top shows when it was last updated. We will announce important changes on the site.

14. Contact

For any privacy questions, email us at destek@badiscore.com. Our other terms are in the Terms of use.