Privacy

Last updated: October 20, 2026

1. About this policy

Ula is a location-verified social app where only people checked in at the same venue can see and meet each other. This Privacy Policy explains what personal data we process when you use the Ula mobile app and ulasocial.com, why we process it, who we share it with, how long we keep it, and your rights. It is our notice under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).

2. Data controller and contact

The controller of your personal data is Workouse Ltd. Şti. (“Ula”, “we”), registered with the Maltepe tax office. Address: Hasanefendi-Ramazan Paşa Mah., 25. Sok., Efeler, Aydın, Türkiye.

For any privacy question or request: privacy@workouse.com

3. Data we collect

Account and sign-in data. Your phone number (to receive an SMS sign-in code) or email address, the ID of your sign-in account, and your account's role and status (for example active or restricted).

Profile data. Your name, profile photo, bio, optional Instagram and LinkedIn links, badges and community score (karma).

Location. Only at the moment you check in by scanning a venue QR code, your device's location is sent to our server. The server calculates your distance from the venue; we do not store your exact coordinates, only the distance in meters with the check-in record. The app does not track your location in the background.

Camera. The camera is used only to scan QR codes and, if you choose, to take a profile photo. No images are saved while scanning.

Check-ins and venue activity. Which venue you checked in at and when, how long the check-in lasted, your visit counts and badge progress.

Social activity. Approach requests you send and receive, matches, meet-up status, the ratings and optional comments you give and receive after a match, and your notifications.

Safety and moderation. Reports, venue bans, warnings and the reasons for them.

Device and technical data. Your device's push notification token (stored encrypted) and platform (iOS/Android) so we can send notifications; device model, operating system and app version in crash reports; and your IP address, to route requests and prevent abuse (not stored in our database).

Usage analytics. Unless you turn it off, which screens are opened and counts of key actions such as check-ins, approaches and matches. These events never include phone, email, location, social links or QR data.

Venue managers. For users who apply for or manage a venue, also the venue's name, address and location, venue details (such as Wi-Fi information) and a record of management actions.

We do not collect advertising identifiers (Android Advertising ID, iOS IDFA), we do not track you across other apps and websites, and we do not sell your data.

4. Why we use your data and our legal bases

• Providing the service (account, sign-in, check-in verification, venue room, approaches and matches, notifications): performance of our contract with you (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)).
• Safety and moderation (preventing fake check-ins and abuse, enforcing bans, keeping an immutable audit log): legitimate interests and the establishment, exercise or defence of legal claims (KVKK Art. 5(2)(e) and (f), GDPR Art. 6(1)(f)).
• Crash reporting (finding and fixing app errors): legitimate interests (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)).
• Usage analytics (aggregate measurement to improve the product): legitimate interests; you can turn it off at any time in Settings → Privacy & Permissions.
• Legal obligations (requests from competent authorities, disputes): where required by law (KVKK Art. 5(2)(a) and (ç), GDPR Art. 6(1)(c)).

Your device also asks for permission before the app can use location, camera or notifications. You can withdraw these permissions at any time in your device settings; the related feature (for example check-in) will then not work.

5. What other users see

When you check in at a venue, users checked in at the same venue see your name, photo, bio and badges. Your phone number and email address are never shown to other users. Your Instagram and LinkedIn links are hidden by default and are only shown to the other person in a match, after both of you accept an approach request. Our server enforces these rules. Venue managers can see the names and badges of users at their venue, not their contact details.

6. Service providers and international transfers

We share your data only with service providers that help us run Ula and act on our instructions:

• Auth0 (Okta): sign-in and identity verification; phone, email, name and photo. SMS sign-in codes are sent through Auth0's SMS provider (Twilio).
• Cloudflare: our servers, database and profile photo storage; all app data.
• Google Firebase Analytics: usage analytics (unless you turned it off); app instance ID, device information, approximate country/region and the events described above.
• Sentry: crash reports; device and app information. Phone, email, token, QR, location and social link data are scrubbed before sending.
• Expo, Apple (APNs) and Google (FCM): delivering notifications to your device; push token and notification content.

These providers' servers may be outside Turkey (mainly in the United States and the European Union). We transfer data abroad relying on the safeguards in KVKK Article 9 and Chapter V of the GDPR (such as standard contractual clauses). Apart from this, we only share your data with competent authorities when the law requires it.

7. How long we keep data

• Account, profile, check-in and social data: until you delete your account. A check-in is active for at most 60 minutes; your past check-ins are kept with your account for your statistics and badges.
• Exact location: not stored.
• Crash reports (Sentry): up to 90 days.
• Usage analytics (Firebase): user-level data for up to 14 months.
• Moderation and safety records: kept after your account is deleted, without your name or contact details, for community safety and possible disputes. If a banned or restricted account is deleted, a one-way hash of its login, email and phone is kept so the restriction can't be avoided with a new account.

8. Deleting your account

You can delete your account at any time in the app under Settings → Delete account. Deletion is immediate. If you can't use the app, email privacy@workouse.com from the email address on your account or including your phone number; once we confirm the account is yours, we delete it within 30 days. What is deleted and what is kept without your name is explained on the Delete account page.

9. Your rights

Under KVKK Article 11 you have the right to learn whether your personal data is processed and request information about it, to learn the purpose of processing and whether it is used for that purpose, to know the third parties in Turkey or abroad it is transferred to, to request correction of incomplete or inaccurate data, to request its deletion or destruction and that these actions are notified to those third parties, to object to a decision against you that results solely from automated analysis, and to claim compensation for damage caused by unlawful processing. If the GDPR applies to you, you also have the rights to data portability, to restrict processing and to object to processing based on legitimate interests.

Send your request to privacy@workouse.com. We reply free of charge within 30 days. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (KVKK) or the data protection authority in your country.

10. Age limit

Ula is only for people aged 18 and over. If we learn that someone under 18 has created an account, we delete the account and its data.

11. Security

All connections are encrypted (HTTPS). QR secrets are stored only as hashes and push tokens are stored encrypted. Phone numbers, email addresses, tokens, QR payloads, exact location and social links are scrubbed from logs, crash reports and analytics. Access to data is limited by role-based authorization.

12. Public venue live count

A venue can choose to publish a public page and a menu embed that show how many people are currently checked in there. This is off by default and only works when the venue's managers turn it on. Only a single number is shown, and only once at least 3 people are checked in. No names, photos, profiles, or locations are shared. These pages use no cookies and do not track visitors.

13. Changes to this policy

When we update this policy we change the date above. We also announce significant changes in the app.