COSMYNIX Privacy and KVKK Notice

Operator: Mete Mengütay / WELL MADE GROUP Trade name: WELL MADE GROUP Business owner: Mete Mengütay Address: Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul A Blok No: 2E İç Kapı No: 331, Ataşehir / İstanbul, Türkiye Tax office: Kozyatağı Vergi Dairesi Tax identification number: 6150382471 Activity: 731101 – Advertising agency activities

The data controller of your personal data in the scope of COSMYNIX services is Mete Mengütay / WELL MADE GROUP. Privacy/KVKK contact: privacy@cosmynix.com. Support: support@cosmynix.com. Web: https://cosmynix.com.

Account and contact information: email address, name/alias, account identifier, and preferences.

Astrological service inputs: date of birth, time of birth, place of birth; chart/profile titles you choose to save, and interpretation requests.

Chat content: user messages/prompts and COSMYNIX replies; while the chat is saved it can be associated with the account.

Memory and personalization: memory records and preferences saved for persistent personalization in the service.

Generated reports and files: generated report text/metadata and, when the user creates a PDF, the related report PDF/GCS object-storage files.

Location information: device location or a city/location you select, only when you permit it.

Technical, operational, and security logs: IP address, session information, device/operating system, application version, server request, error/crash record, and security-event records; only to the extent necessary to operate the service, maintain service health, provide security, prevent abuse, and remediate technical issues. In COSMYNIX v1, no product-analytics SDK or product-analytics service provider is used; a separate analytics processing activity that tracks user behavior for product optimization and produces aggregated usage analytics is not carried out.

Subscription and transaction information: plan, purchase status, transaction/subscription identifier, and verification information returned by the payment provider. We do not store full card details; the payment providers’ own terms apply.

Support and communication data: support requests, feedback, and content you send to us.

Marketing preferences: consent/refusal preferences and communication- channel settings.

Hosting, cloud, database, identity-authentication, and security service providers; only to the extent necessary to operate and secure the service.

App stores such as App Store / Google Play and subscription/payment infrastructure providers.

Support, email, and communication service providers; only to the necessary extent. In COSMYNIX v1, no product-analytics service provider or product-analytics SDK is used.

Competent public institutions and organizations; where a legal obligation or a duly made request exists.

In the event of a company/business transfer, merger, or restructuring, the relevant parties, with legally required safeguards.

Some of the technology providers or data centers we use may be located outside Türkiye. If personal data are transferred abroad, an appropriate transfer mechanism and safeguards are applied within the framework of Article 9 of Law No. 6698 and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad. Where appropriate, standard contracts published by the Board are used and required notifications are made.

Data are retained for the period necessary for the purpose of collection and for related legal obligations. If the user performs Delete Account, the general “2 years after account closure” rule is not applied to account/profile or user content: active account/profile, astrological inputs, chat content, memory, generated reports, and report PDF/GCS files are deleted or irreversibly anonymized from active systems within 30 days at the latest and from backup cycles within 90 days at the latest. After Delete Account there is no active account/profile copy retained for 2 years. Operational/security logs are as a rule 12 months; support records 3 years from closure of the request; provider/RevenueCat event history a maximum of 24 months from the last subscription event or the Delete Account date; account-deletion audit/tombstone records at least 3 years. Payment, tax, and accounting records are kept for the period mandated by the relevant legislation. Detailed periods are in the Retention and Destruction Policy.

Within the conditions of Article 11 of Law No. 6698, you have the rights to learn whether your personal data are processed; to request information if they are processed; to learn whether they are used in accordance with the purpose; to know the third parties to whom they are transferred domestically/abroad; to request correction of incomplete/inaccurate data; to request deletion/destruction where the conditions exist; to request that correction or deletion operations be notified to third parties to whom data were transferred; to object to a result against you arising exclusively from automated systems; and to request compensation for damage arising from unlawful processing.

You may submit your requests under KVKK, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by written application, KEP/secure electronic signature/mobile signature, a system dedicated to the purpose of the application, or via the email address you previously notified to us and that is registered in our system, to privacy@cosmynix.com. privacy@cosmynix.com may also be used for general privacy questions. Applications are concluded within 30 days at the latest, depending on the nature of the request.

You may delete your account from the in-app Delete Account flow. Account access is terminated immediately. Active account/profile fields, astrological inputs, chat content, memory, generated reports, and report PDF/GCS files are deleted or anonymized within 30 days at the latest; backup copies are removed within the 90-day cycle at the latest. After Delete Account the general 2-year account-retention rule is not applied, and there is no active account/profile copy retained for 2 years. Only provider/RevenueCat event history (maximum 24 months), mandatory payment/tax/accounting records, necessary security/dispute records, and audit/tombstone records proving the deletion operation (at least 3 years) may be kept, limited to their own separate purposes and periods.

COSMYNIX is not directed to persons under 18 years of age. If you believe data of a person under 18 have been processed without appropriate authority, contact us.

We apply administrative and technical measures proportionate to risk; limit access authorizations; carry out data transfer over secure channels; and manage our service providers within data-security obligations. It should be remembered that no electronic system can provide absolute security.

We may update this text in line with product or legislative changes. For material changes, we provide information by in-app notice or another appropriate method to the extent applicable.

Privacy/KVKK: privacy@cosmynix.com Support: support@cosmynix.com Web: https://cosmynix.com