What this notice covers
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
Today bounc.co is only a landing page with a waitlist. The BOUNC. app launches in İstanbul in 2027. This notice covers only what the website does today. When the app launches, we will publish a separate, updated notice.
The Turkish version of this notice is the governing version; this English text is a faithful translation for convenience.
Data controller
| Brand | BOUNC |
| Legal name | company legal name |
| Address | company address, İstanbul, Türkiye |
| MERSIS number | MERSIS number |
| Registered email (KEP) | KEP address |
| destek@bounc.co |
In this notice, “BOUNC”, “we”, “us” and “our” mean the data controller above.
What personal data we process
When you join the waitlist:
- Contact: your email address.
- Marketing consent record: the fact that you ticked “I’d like to receive launch and event news by email” and when you did so.
- Sign-up and preference details: the status of your entry (pending / confirmed / launch email only / unsubscribed) and the dates of each status; which form you used (top of page or bottom of page); the page language (TR/EN).
- Source and invite details: the address of the page that referred you (referrer), any UTM parameters in the campaign link, the invite code of the person who invited you (if any), and your own invite code.
- Security: a SHA-256 hash of your IP address combined with a secret value (salt); randomly generated keys (tokens) for the confirmation and unsubscribe links. We do not store your raw IP address; we use it only momentarily to create the hash.
If you allow Microsoft Clarity in the Analytics category:
- Pages you visit, clicks, taps, scrolling and mouse movement, time on page, session recordings (a replayable view of your interactions with the page), device, browser and operating system details, screen size, the referring page, and approximate location derived from your IP address.
- Sensitive input fields, including form fields such as the email field, are masked by Clarity; what you type is not recorded.
If you allow Mixpanel in the Analytics category:
- Events for actions you take on the site: page views, joining the waitlist, a failed attempt to join, confirming your email, copying and sharing your invite link, switching language, and interactions with page sections (buyer/seller toggle, tier, persona, price slider).
- Page address and title, the referring page (referrer) and UTM parameters, browser, operating system and device type, screen size.
- Approximate location (city/country) that Mixpanel derives from your IP address.
- A randomly generated device ID.
- We do not send your email address or any other contact details to Mixpanel. Session recording and automatic event collection (autocapture) are switched off.
If you allow the Marketing category (Google Tag Manager):
- Google Tag Manager (GTM) is a tag manager that loads ad and campaign measurement tags. It loads only if you allow Marketing. GTM itself sets no cookies. When GTM loads, Google technically processes connection data such as your IP address, browser details and the page address in order to deliver the script to you.
- We pass your cookie preferences to Google through Consent Mode v2 signals: if you allow at least one analytics tool, we signal that analytics storage is permitted; if you allow Marketing, we signal that ad storage and the use of ad data are permitted.
- The data collected by tags running through GTM depends on the tag. list the tags configured in GTM (e.g. Google Analytics 4, ad pixels) and their cookies before publishing
On every visit, without consent (anonymous site statistics):
- On every page view and on the result of the waitlist form, your browser sends one request to our own backend (a Supabase serverless function, EU region, Frankfurt).
- The request carries only: the event name (e.g. “Page Viewed”, “Waitlist Joined”), the page, the site language, the referring site’s domain (domain only), the UTM source/medium/campaign, and the device class (mobile/desktop) derived from your browser details.
- From this we keep only daily totals (the date and these fields, with a count). No IP address, no cookie or local storage ID, no browser details string (user agent), no email and no identifier of any kind is stored. So the counts cannot be linked to a person.
- These counts are anonymous aggregate data, not personal data, so we do not ask for consent for them. lawyer to confirm the anonymous-statistics position under KVKK
- Our processor Supabase may briefly keep standard request logs, which include the IP address, for these requests, as it does for the waitlist form. confirm Supabase log retention
Information kept in your browser: your language choice, your cookie preferences and any invite code are kept in your browser’s local storage. The invite code is sent to us only when you submit the form; the rest never leaves your device. If you allow Mixpanel, it also keeps a random device ID in local storage and sends it to Mixpanel with each event. See the Privacy & Cookie Policy for details.
Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Sending launch and event news by email (all news, or only the launch email, as you choose) | Email, entry status, language | Explicit consent (KVKK Art. 5(1)) and consent to commercial electronic messages under Law No. 6563 on the Regulation of Electronic Commerce, Art. 6 |
| Sending a confirmation email after sign-up to verify that the address is yours and to confirm that we received your consent | Email, confirmation token, sign-up time, language | Legal obligation (KVKK Art. 5(2)(ç); Regulation on Commercial Communication and Commercial Electronic Messages, Art. 7(3)) and legitimate interest (Art. 5(2)(f): making sure only the owner of an address is added) |
| Carrying out unsubscribe and preference-change requests | Email, unsubscribe token, entry status and dates | Legal obligation (KVKK Art. 5(2)(ç); Law No. 6563 Art. 8 and Regulation Arts. 9–10) |
| Keeping records of consent and withdrawal (unsubscribe) as proof | Email, consent record and time, form, status history | Legal obligation (KVKK Art. 5(2)(ç); Regulation Art. 13) and the establishment, exercise or protection of a right (Art. 5(2)(e)) |
| Preventing bulk or automated sign-ups and abuse (limiting sign-ups from the same address) | Salted IP hash, sign-up time | Legitimate interest (KVKK Art. 5(2)(f)) |
| Matching invites to the right person and understanding which promotional channels work | Invite codes, referrer, UTM parameters, form, language | Legitimate interest (KVKK Art. 5(2)(f)) |
| Analysing and improving how the site is used (heatmaps, session recordings) | Analytics data (listed above under “Microsoft Clarity”) | Explicit consent (KVKK Art. 5(1)); only if you allow Microsoft Clarity in the Analytics category of cookie preferences |
| Measuring how much the site’s steps and sections are used (e.g. joining the waitlist, sharing invites, switching language) | Analytics data (listed above under “Mixpanel”) | Explicit consent (KVKK Art. 5(1)); only if you allow Mixpanel in the Analytics category of cookie preferences |
| Loading marketing tags and passing your consent choice on to those tags (Google Tag Manager) | Connection data (IP address, browser details, page address), Consent Mode signals | Explicit consent (KVKK Art. 5(1)); only if you allow the “Marketing” category in cookie preferences |
| Measuring the results of our ads and campaigns (through marketing tags running in GTM) name the marketing tags configured in GTM | Data collected by the marketing tags | Explicit consent (KVKK Art. 5(1)); only if you allow the “Marketing” category in cookie preferences |
Where we rely on legitimate interest, we use only the minimum data needed for that purpose, and we do not use it to build marketing profiles.
Giving marketing consent is voluntary. However, because the waitlist’s only function is to send launch and event news by email, you cannot join it without giving consent. You can withdraw consent at any time; withdrawal does not affect processing carried out before it.
If you allow the “Marketing” cookie category, ad and campaign measurement tags may run through Google Tag Manager. If you don’t, these tags do not run. name the marketing tags configured in GTM
How we collect data
Your personal data is collected electronically in two ways:
- through the information you enter in the waitlist form and the subscription preferences page on bounc.co,
- automatically through your browser (referrer, UTM parameters, IP address, browser storage, anonymous statistics requests and, if you allow them, Clarity cookies, Mixpanel’s local storage entry and tags running through Google Tag Manager).
Who we share data with
We do not sell your data. We share it only with the recipients below and only for the stated purpose:
| Recipient | Role | Purpose | Location |
|---|---|---|---|
| Supabase Inc. | Data processor | Waitlist database, serverless functions and anonymous site statistics | AWS eu-central-1 (Frankfurt, Germany) |
| Google (Google Workspace) | Data processor | Sending emails from hello@bounc.co | Google data centres outside Türkiye |
| Amazon Web Services (AWS Amplify) | Data processor | Website hosting and content delivery (CDN); technically processes connection data such as IP address and browser details to deliver the page to you | AWS Amplify region and global CDN locations |
| Microsoft Corporation (Microsoft Clarity) | Independent controller (under the Clarity terms of use) | Only if you allow Clarity: heatmaps and session recordings. Microsoft may also process this data under its own Privacy Statement | United States and other countries outside Türkiye |
| Mixpanel, Inc. | Data processor (under Mixpanel’s data processing agreement) | Only if you allow Mixpanel: measuring how the site’s steps and sections are used | EU (EU data residency, api-eu.mixpanel.com); Mixpanel’s support staff and sub-processors may access data from outside the EU |
| Google LLC / Google Ireland Ltd. (Google Tag Manager) | confirm Google’s role for GTM (data processor / independent controller) | Only if you allow marketing: loading marketing tags | Google data centres outside Türkiye |
| Providers of tags running through GTM | list the tags configured in GTM (e.g. Google Analytics 4, ad pixels) and their cookies before publishing | Only if you allow marketing: ad and campaign measurement | Depends on the provider |
| İleti Yönetim Sistemi A.Ş. (İYS, Türkiye’s commercial message management system) | Required by law | Registering consent and withdrawal records for commercial electronic messages with İYS confirm İYS registration and that consents are uploaded to İYS | Türkiye |
| Competent public authorities (e.g. the Ministry of Trade, the Personal Data Protection Authority, courts) | Legal request | Only where legally required (e.g. providing consent records to the Ministry under Regulation Art. 13) | Türkiye |
Transfers abroad
Supabase, Google, Amazon Web Services, Microsoft and Mixpanel process data outside Türkiye. Mixpanel stores data in the EU under EU data residency; this is itself a transfer outside Türkiye. Also, because Mixpanel is a US company, its support staff and sub-processors may access the data from outside Türkiye and the EU. These transfers are subject to Article 9 of the KVKK, as amended by Law No. 7499, and to the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad.
Unless the Personal Data Protection Board has issued an adequacy decision for the countries concerned, the transfers are made under standard contracts published by the Board, one of the appropriate safeguards listed in KVKK Art. 9(4). Standard contracts are notified to the Personal Data Protection Authority within five business days of signing (KVKK Art. 9(5)). confirm that standard contracts have been signed with each provider and notified to the Authority confirm that the KVKK standard contract with Mixpanel has been signed and notified to the Authority
How long we keep data
| Data | Retention |
|---|---|
| Confirmed or “launch email only” entries | Until you unsubscribe completely, or at the latest retention after launch, e.g. 2 years after launch |
| Unconfirmed entries | The confirmation link expires after 7 days; the entry is deleted within deletion period for unconfirmed sign-ups, e.g. 30 days |
| Consent and withdrawal records | 3 years from the date the consent ceases to be valid (e.g. the date you unsubscribe) (Regulation Art. 13(2)) |
| Salted IP hashes | retention period for IP hashes |
| Supabase standard request logs (including IP address) | confirm Supabase log retention |
| Microsoft Clarity data | As stated by Microsoft: session recordings 30 days, click and heatmap data 9 months |
| Mixpanel data | At Mixpanel: confirm Mixpanel data retention setting for the project. The Mixpanel entry on your device: until you withdraw consent for Mixpanel or clear your browser storage |
| Data from tags running through GTM | add retention periods once GTM tags are configured |
When the period ends or the reason for processing no longer applies, your data is erased, destroyed or anonymised in line with the KVKK and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
Your rights under KVKK Article 11
By applying to us as the data controller, you have the right to:
- learn whether your personal data is processed,
- request information about the processing if it is,
- learn the purpose of processing and whether data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom data is transferred,
- request correction of incomplete or inaccurate data,
- request erasure or destruction of data under the conditions in KVKK Art. 7,
- request that third parties to whom data was transferred be notified of any correction, erasure or destruction,
- object to a result against you arising from analysis of your data exclusively by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
You don’t need to submit an application to withdraw marketing consent: use the unsubscribe link in any email. You can withdraw consent for Mixpanel, Microsoft Clarity and marketing separately through the “Cookie preferences” link in the site footer.
How to apply
Under the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can send your application in Turkish by one of the following methods:
- In writing: a signed letter delivered by hand or by post to company address,
- By KEP (registered electronic mail): to KEP address,
- By email: from the email address registered on our waitlist to destek@bounc.co,
- with an application signed by secure electronic signature or mobile signature.
Your application should include your name and surname, your signature (for written applications), your Turkish ID number if you are a Turkish citizen or, if not, your nationality and passport or ID number, an address for notifications, an email address or phone number for notifications if you have one, and the subject of your request. We may ask for additional information to verify your identity.
We will handle your application as quickly as its nature allows and within 30 days at the latest, free of charge. If handling it involves an additional cost, a fee set by the Personal Data Protection Board’s tariff may be charged.
If your application is rejected, you find our answer insufficient, or we do not reply in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning of our answer and in any case within 60 days of the date of your application (KVKK Art. 14).
Age limit
bounc.co and the waitlist are intended for people aged 18 and over. If you are under 18, please do not join the waitlist. If we learn that a child has joined, we will delete the entry.
Changes
We update this notice when the data we process or the way we process it changes. The current version is always published on this page; the date at the top shows when it was last updated.