Data Protection Notice

This notice is issued to fulfil the data controller's duty to inform under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("the Law"). For a plain-language description of what the app does with data, see the Privacy Policy.

This English text is provided for convenience. My Bestie is operated from Türkiye and the applicable law is Law No. 6698; the Turkish version governs in case of any discrepancy.

1. Identity of the data controller

İksero Bilişim Hizmetleri Ticaret Ltd. Şti.
Address: Cumhuriyet Bulvarı No:36 Kapani İş Merkezi Kat:7 D:711 Konak/İzmir
Tax details: Kemeraltı V.D. 4701347254
VERBİS (controllers' registry): Not required to register (below the statutory threshold)
Applications: destek@iksero.com

2. Personal data processed

My Bestie can be used without an account. Phone number, national identification number and location data are never processed. Name and e-mail address are processed only if you choose to sign in with Google or Apple. The data processed is limited to:

• Transaction security data: the random device identifier generated by the app, device model, app and operating system version, language and time zone preference, last connection time, and the IP address in server access logs.
• Usage data: AI parsing counters (number of requests, character count, token counts, response time, outcome, cost).
• Task data: the fields of the tasks you create — title, note, status, date and time, time zone, reminder interval, repeat count, notification/alarm preference, priority flag and, if present, the verification rule (step target, the display name of the person to call). Because you write this content, you decide what goes into it; you may choose not to put personal data into a task.

The raw sentence you speak stays on your device by default; the audio does not leave your device. If you turn on server-side voice recognition, the audio is transferred — see the “Voice recording” heading below. During AI parsing the transcribed text is processed but not stored. The task fields listed above are held on the server. Your calendar entry, step count, and the phone number or e-mail address you pick remain on your device and are not transferred to the data controller.

Voice recording

By default speech is turned into text by your device's own recognition; the audio is not transferred to the data controller.

If you turn on server-side voice recognition in the app's settings (off by default), your audio is transferred to our server and from there to the recognition provider Google (USA), solely so that it can be turned into text. The audio is not stored: it is converted and discarded; the resulting text is not stored either — only the character count and the language code are kept as counters. This processing relies on your explicit consent: you turn it on, you can turn it off at any time, and when it is off the app keeps working with on-device recognition.

A voice recording can identify the person speaking. That is why this feature is off by default and why the app shows which engine performed the recognition.

Task proof photos

If you attach a proof photo to a task, that image and the task's title are transferred to our server and from there to the AI provider Google (USA), solely to assess whether the photo relates to the task. The image is not stored: it is assessed and discarded. An accepted image stays on your device only. This processing relies on your explicit consent: uploading a photo is optional and you can always mark tasks done by hand.

Health data (special category)

Step count is special category personal data within the meaning of Article 6 of the Law. It is processed only with your explicit consent and only inside your device: it is read to answer the question "was the goal met", is not transferred to the data controller and is not stored on any server. You may withdraw consent at any time through Health Connect; the feature then stops and the rest of the app continues to work.

Your call log is not processed. The app never requests the call log permission; it measures only the duration of a call it placed itself. No record of who you spoke to, or when, is created.

3. Purposes of processing

• Providing the service itself: turning what you say into a structured task.
• Measuring the free usage allowance and preventing abuse (automated request generation, quota circumvention).
• Debugging, and maintaining service continuity and information security.
• Delivering mandatory update and maintenance notices to the app.

4. Legal grounds

• Article 5/2-c — directly related to the conclusion or performance of a contract: providing the parsing service.
• Article 5/2-ç — compliance with a legal obligation of the data controller: keeping security logs.
• Article 5/2-f — legitimate interests: quota tracking, abuse and attack prevention.

5. Method of collection

Data is collected entirely by automated means, electronically, through the mobile application. No data is collected on paper.

6. Transfer abroad

When you use the AI parsing feature, the transcribed task text is transferred to the infrastructure of Google (United States) for the purpose of parsing. Only that text is transferred; under the provider's commercial API terms it is not used to train models, and it is not stored by us.

If you do not use the feature, none of your data is transferred abroad; the app parses on the device and says so on screen.

The ground for this transfer under Article 9 of the Law (explicit consent, or a standard contract notified to the Authority) will be settled before public release; depending on which is chosen, the app will present the necessary consent step and this notice will be updated. This sentence is here to state the current position as it actually is.

7. Retention periods

• Anonymous device record: 60 days from last use.
• App access token: 90 days if unused.
• Usage counters: lose their link to the device when the device record is deleted; what remains does not qualify as personal data.

Deletions are carried out by automated weekly jobs.

8. Your rights (Article 11)

Under Article 11 of the Law you have the right to:

• Learn whether your personal data is processed and, if so, request information about it.
• Learn the purpose of processing and whether the data is used accordingly.
• Know the third parties to whom the data is transferred, in Türkiye or abroad.
• Request correction if the data is incomplete or inaccurate.
• Request erasure or destruction within the conditions of the Law.
• Request that correction and erasure be notified to third parties to whom the data was transferred.
• Object to a result reached against you through analysis by exclusively automated systems.
• Claim compensation for damage arising from unlawful processing.

Send applications to destek@iksero.com. Requests are answered within thirty days at the latest.

⚠ Because the app holds nothing that identifies you as a person, we may need help locating your record. How to do that is explained on the Account & Data Deletion page.