Privacy & Cookie Policy

In short

• Today bounc.co is a landing page with a waitlist. The app launches in İstanbul in 2027.
• For the waitlist we collect only your email address and a few related technical details. We do not sell your data.
• We send you only the emails you agreed to. Every email lets you unsubscribe in one click.
• Each of our analytics tools, Mixpanel and Microsoft Clarity, runs only if you allow that tool. We do not send your email address to Mixpanel.
• Google Tag Manager, and the ad measurement tags that run through it, load only if you allow Marketing.
• The only measurement that runs without consent is anonymous, cookieless site statistics: we keep only daily totals and store no identifier.

Please read this policy together with our Privacy Notice (KVKK), which gives the detailed information required under Turkish data protection law.

Who we are

bounc.co is operated by BOUNC (company legal name, company address, İstanbul, MERSIS: MERSIS number). BOUNC. is building an app for İstanbul’s music scene: safe ticket resale with a price cap and escrow, events, artists and community.

BOUNC is the data controller for your personal data. Questions: destek@bounc.co.

What we collect

When you join the waitlist:

• your email address,
• the fact that you gave consent to “I’d like to receive launch and event news by email”, and when,
• which form you used (top or bottom of the page) and the page language (TR/EN),
• the address of the page that brought you to the site (referrer) and any UTM campaign parameters,
• the invite code of the person who invited you (if any) and your own invite code,
• the status of your entry (pending / confirmed / launch email only / unsubscribed) and its dates,
• randomly generated keys for the confirmation and unsubscribe links,
• a salted SHA-256 hash of your IP address. We do not store your raw IP address.

If you allow Microsoft Clarity (Analytics): pages you visit, clicks, scrolling and mouse movement, session recordings, device and browser details, screen size and approximate location derived from your IP address. Form fields such as the email field are masked; what you type is not recorded.

If you allow Mixpanel (Analytics): events such as page views, joining the waitlist (and failed attempts), confirming your email, copying and sharing your invite link, switching language, and interactions with page sections (buyer/seller toggle, tier, persona, price slider); page address and title, referrer and UTM parameters, browser, operating system and device type, screen size; approximate location (city/country) derived from your IP address, and a random device ID. We do not send your email address or any other contact details to Mixpanel. Session recording and automatic event collection are switched off.

If you allow Marketing (Google Tag Manager): GTM loads ad and campaign measurement tags. GTM itself sets no cookies; when it loads, Google technically processes connection data such as your IP address and browser details. The data collected by tags running through GTM depends on the tag. list the tags configured in GTM (e.g. Google Analytics 4, ad pixels) and their cookies before publishing

When you visit the site: our hosting provider technically processes connection data such as your IP address and browser details in order to deliver the page to you. whether hosting access logs are enabled and how long they are kept

On every visit, without consent (anonymous site statistics): On every page view and on the result of the waitlist form, your browser sends one request to our own backend (a Supabase serverless function, EU region, Frankfurt). The request carries only the event name (e.g. “Page Viewed”, “Waitlist Joined”), the page, the site language, the referring site’s domain, the UTM source/medium/campaign and the device class (mobile/desktop). From this we keep only daily totals. No IP address, no cookie or local storage ID, no browser details string (user agent), no email and no identifier of any kind is stored, so the counts cannot be linked to a person. This is anonymous aggregate data, not personal data, so we do not ask for consent. lawyer to confirm the anonymous-statistics position under KVKK As with the waitlist form, Supabase may briefly keep standard request logs, which include the IP address, for these requests. confirm Supabase log retention

Why we use it

• To verify your email address: After you sign up, we send a confirmation email. You are not added to the list until you click the link (double opt-in). Unconfirmed links expire after 7 days.
• To send you news: Depending on your choice, we send launch and event news or only the launch email.
• To apply your preferences and be able to prove your consent: We keep consent and unsubscribe records for the period required by law.
• To prevent abuse: We use the IP hash to limit large numbers of sign-ups from the same address in a short time.
• To understand invites and channels: Invite codes, referrer and UTM details show us who invited whom and which promotional channels work.
• To count visits: Anonymous site statistics show us, as daily totals, how many times each page is viewed and which channels visits come from.
• To improve the site: If you allow Clarity, we analyse how the site is used with heatmaps and session recordings. If you allow Mixpanel, we measure how much steps such as joining the waitlist and sharing invites are used.
• To measure ads and campaigns: Only if you allow Marketing, we measure the results of our ads and campaigns with tags running through Google Tag Manager. name the marketing tags configured in GTM

The legal basis for each purpose is set out in a table in the Privacy Notice (KVKK).

Emails and unsubscribing

• Emails are sent from hello@bounc.co.
• Every email contains an unsubscribe link. If your email app supports it, one-click unsubscribe (RFC 8058) is available too.
• On the subscription page you can choose “launch email only” or “unsubscribe completely”, and you can rejoin the list if you change your mind.
• We apply your unsubscribe request within three business days at the latest.

Who we share data with

We do not sell your data. Data is shared for ad measurement only if you allow Marketing, through tags running in Google Tag Manager. We work with the following providers to run the service:

Supabase, Google, AWS and Mixpanel process data on our behalf and on our instructions; Mixpanel does so under its data processing agreement (DPA). confirm Google’s role for GTM (data processor / independent controller) Under the Clarity terms of use, Microsoft acts as an independent controller and may also use data collected through Clarity for its own purposes. For details, see the Microsoft Privacy Statement. Providers of tags running through GTM may also use data for their own purposes; we will list these providers and their roles here once the tags are configured.

As required by law, consent and withdrawal records for commercial electronic messages are registered with the İleti Yönetim Sistemi (İYS) confirm İYS registration and that consents are uploaded to İYS. Data may be shared with competent public authorities when they make a lawful request.

Transfers abroad

All of the providers above process data outside Türkiye. Mixpanel stores data in the EU, but it is a US company; its support staff and sub-processors may access the data from outside Türkiye and the EU. We make these transfers in line with Article 9 of the KVKK, on the basis of the standard contracts published by the Personal Data Protection Board. Standard contracts are notified to the Authority within five business days of signing. confirm that standard contracts have been signed with each provider and notified to the Authority confirm that the KVKK standard contract with Mixpanel has been signed and notified to the Authority

How long we keep data

• Confirmed entries: until you unsubscribe completely, or at the latest retention after launch, e.g. 2 years after launch.
• Unconfirmed entries: deleted within deletion period for unconfirmed sign-ups, e.g. 30 days.
• Consent and unsubscribe records: 3 years from the date consent ends, as required by law.
• IP hashes: retention period for IP hashes.
• Supabase request logs (including IP address): confirm Supabase log retention.
• Anonymous site statistics: daily totals only; they contain no personal data.
• Clarity data: as stated by Microsoft; session recordings 30 days, click and heatmap data 9 months.
• Mixpanel data: at Mixpanel, confirm Mixpanel data retention setting for the project; the Mixpanel entry on your device until you withdraw consent for Mixpanel or clear your browser storage.
• Data from tags running through GTM: add retention periods once GTM tags are configured.

At the end of these periods we erase, destroy or anonymise the data.

How we protect data

• All traffic between the site and our servers is encrypted (HTTPS/TLS).
• Only server-side functions can access the waitlist, under the principle of least privilege. The browser cannot read the list; the form can only submit a sign-up.
• The keys in confirmation and unsubscribe links are unguessable random UUIDs.
• Instead of storing your IP address, we keep a salted hash of it.
• We keep Clarity’s masking of sensitive fields switched on; what you type into form fields is not recorded.
• We do not send email addresses or contact details to Mixpanel. Session recording and automatic event collection are switched off in Mixpanel, and the data is stored in the EU under EU data residency.
• Google Tag Manager never loads before you make a choice; it loads only if you allow Marketing.
• For anonymous site statistics we store no IP address, browser details or identifier of any kind; we keep only daily totals.
• Fonts are served from our own server; loading the page sends no request to Google Fonts.

No system is completely risk-free. If a data breach occurs, we will notify the Board and the people affected as required by the KVKK.

Cookies and browser storage

What we use today

Unless you give consent, the site sets no cookies. For necessary functions we use your browser’s local storage (localStorage and sessionStorage) instead of cookies. This information stays on your device and is not sent to us, except the invite code and how you arrived (bounc-entry), which are sent only when you submit the form. Anonymous site statistics use no cookies or browser storage at all.

The “Analytics” category has two separate switches: Mixpanel (product analytics) and Microsoft Clarity (heatmaps and session recordings). Each tool loads only if its own switch is on.

If you allow Microsoft Clarity, Clarity loads and sets the cookies below. Even then, we send Clarity a signal that advertising storage is not permitted; we use Clarity for analytics only.

If you allow Mixpanel, Mixpanel loads. Mixpanel uses first-party local storage (localStorage), not cookies. This entry follows the same consent rules as cookies: it is not created without your consent.

If you allow the “Marketing” category, Google Tag Manager loads and ad and campaign measurement tags may run through it. name the marketing tags configured in GTM Before you make a choice, or if you reject Marketing, GTM and these tags do not load at all. GTM itself sets no cookies.

We pass your choices on through Google Consent Mode v2 signals: analytics_storage is granted if you allow at least one analytics tool; ad_storage, ad_user_data and ad_personalization follow your Marketing choice.

Browser storage and cookies

Google Tag Manager (GTM-PJTJM3VF) itself sets no cookies; the table lists only the cookies of tags running through GTM.

Microsoft may change cookie names and durations. For the current list, see Microsoft’s Clarity cookies page. verify Clarity cookie durations on the live site with browser developer tools

Managing your preferences

On your first visit you will see a window asking for your cookie preferences:

• Necessary: Always on; the site does not work properly without these.
• Analytics: Off by default, with two separate switches:
  • Mixpanel (product analytics): If you turn it on, Mixpanel loads.
  • Microsoft Clarity (heatmaps and session recordings): If you turn it on, Clarity loads.
• Marketing: Off by default. If you turn it on, Google Tag Manager loads and ad and campaign measurement tags may run through it. name the marketing tags configured in GTM

As emphasised in the Turkish Data Protection Authority’s Guide on Cookie Practices, rejecting cookies is as easy as accepting them: “Reject all” is offered in the same window and at the same step as “Accept all”. “Accept all” turns on both the Mixpanel and the Clarity switch. Analytics and marketing tools load only after you give consent.

You can change your preferences at any time through the “Cookie preferences” link in the site footer. Withdrawing consent for one tool stops only that tool. If you withdraw consent for Clarity, Clarity stops running from the next page load and we delete the first-party Clarity cookies (_clck, _clsk). If you withdraw consent for Mixpanel, Mixpanel stops immediately and we delete the Mixpanel entry from local storage. If you withdraw Marketing consent, Google Tag Manager no longer loads from the next page load. With every change we update the Consent Mode signals to match. We cannot delete third-party cookies on the domains of Microsoft or GTM tag providers; you can delete them in your browser settings.

If we add a new analytics or marketing tool, or a new tag in GTM, in the future, it too will load only with your consent, and we will update this page to list it.

Your rights

Your rights under Article 11 of the KVKK and how to exercise them are explained in the Privacy Notice (KVKK). In short, you can access your data, ask for it to be corrected or erased, and complain to the Personal Data Protection Board. We reply to applications within 30 days at the latest.

Age limit

The site and the waitlist are for people aged 18 and over; they are not directed at children.

Changes

We update this policy when the site or the way we process data changes. For significant changes we may let people on the waitlist know by email. The date at the top shows the latest update.

Contact

For any privacy question or request: destek@bounc.co

Postal address: company legal name, company address, İstanbul, Türkiye