Nuzul: information notice on the protection of personal data
Contents
- Why this text exists
- 1. Identity of the data controller
- 2. Categories of personal data processed
- 3. Purposes of processing
- 4. Method of collection and legal basis
- 5. Recipients of transfers, and their purpose
- 6. Transfer abroad, article 9
- 7. Retention periods
- 8. Rights of the data subject, article 11, and how to apply
- 9. VERBİS
- 10. Changes
This is a courtesy translation. The Turkish text at nuzul.com.tr/aydinlatma is the binding version, and it is the one that satisfies the notice obligation under Turkish law. If anything here differs from it, the Turkish text governs.
Last updated: 26 August 2026
Why this text exists
In Nuzul you can listen to three episodes without giving any information at all. The rest requires an account. The moment you create one we begin to process your personal data, and the law requires us to inform you before processing begins. This text is that information.
Being informed and giving consent are not the same thing. Information is telling; explicit consent is permission. Reading this text does not mean you have consented to anything. Where consent is needed it is asked for separately and explicitly.
1. Identity of the data controller
Under article 10 of the Law, the data controller is:
| Name | Eyüp Ensar Şanlı |
| Address | Merkez Mah. Akar Cad. I Towers Bomonti No: 3 İç Kapı No: 96, Şişli / İstanbul, Türkiye |
| Tax office / number | Maslak Tax Office, 10748566782. A sole proprietorship has no MERSİS number |
| destek@nuzul.com.tr | |
| Telephone | +90 551 689 86 83 |
| Registered electronic mail (KEP) | None. A sole proprietorship has no registered electronic mail address |
| App | Nuzul (iOS / Android) |
2. Categories of personal data processed
| Category | Contents |
|---|---|
| Identity | Name, optional, may be left blank |
| Contact | E-mail address. With Sign in with Apple this may be a private relay address |
| Customer transaction | Purchase state, identifier of the product bought, store transaction identifier |
| Transaction security | Account identifier, session information, IP address, sign-in logs |
| Usage | Episode listened to, position reached, language and sort preference |
| Device | Device model, operating system version, app version, crash logs |
Data that is not processed, stated explicitly: phone number, national identity number, date of birth, address, location, contacts, photos, payment card details.
No special category personal data is processed. The subject of the app is religious content; however, we do not ask for, record or infer your religious belief, your school of thought or your philosophical views. Having listened to a surah does not create a record of your beliefs with us.
Our position, decided 2026-08-06: a listening record is not special category data within the meaning of article 6. The reasons: (1) the user is never asked about belief, school or philosophical view; (2) the record is not a declaration of belief but a record of content consumption, in the way that watching a history documentary does not make the viewer a partisan of the period; (3) no inference about belief is drawn from the record and it is not shared with third parties; (4) it has no advertising or segmentation use at all.
The lines that depend on this position are marked the same way: App Store "Sensitive Info" = no, Google Play "Political or religious beliefs" = no.
3. Purposes of processing
- Creating and managing the membership account
- Recognising the purchase and providing access to the content
- Recording listening progress and carrying it between devices
- Keeping purchase records as legislation requires
- Ensuring information security, diagnosing faults and crashes
- Preventing abuse
- Answering requests and complaints
- Subject to explicit consent: improving the content using usage statistics
- Subject to explicit consent: sending commercial electronic messages
4. Method of collection and legal basis
Method: data is collected electronically through the mobile app, partly by your own direct entry (name), partly through the identity provider (Sign in with Apple / Sign in with Google), and partly automatically while you use the app.
Legal basis, article 5:
| Purpose | Legal basis |
|---|---|
| 1, 2, 3 | Directly related to the establishment or performance of the contract, art. 5/2-c |
| 4 | Fulfilment of the controller's legal obligation, art. 5/2-ç |
| 5, 6, 7 | Legitimate interest, provided it does not harm the fundamental rights and freedoms of the data subject, art. 5/2-f |
| 8, 9 | Explicit consent, art. 5/1 |
You may withdraw explicit consent at any time. Not consenting to 8 and 9 does not prevent you using the app; your purchase and your access to content are unaffected.
5. Recipients of transfers, and their purpose
| Recipient group | Who | Purpose |
|---|---|---|
| Service provider, infrastructure | Supabase | Database, authentication, audio file hosting |
| Service provider, purchases | RevenueCat | Verification of the store purchase receipt |
| App stores | Apple, Google | Distribution, payment collection, sign-in provision |
| Competent public authorities | Courts, prosecutors, administrative authorities | Requests arising from legislation |
Your personal data is not sold, rented or transferred to third parties for advertising or marketing purposes.
6. Transfer abroad, article 9
All of the service providers above are established outside Türkiye. Your personal data is therefore transferred abroad, and this is subject to article 9 of the Law.
The amendments made to article 9 by Law no. 7499 took effect on 1 June 2024. Under the new regime a transfer rests, in order, on one of the following:
- An adequacy decision, that is a Board decision covering the country, sector or organisation the transfer is made to,
- Appropriate safeguards, where there is no adequacy decision: - the standard contract published by the Board, whose signature is sufficient and for which no separate authorisation is required, - binding corporate rules approved by the Board, - an undertaking approved by the Board, - an agreement between public authorities that does not have the character of an international treaty, plus Board authorisation,
- Incidental cases, art. 9/6, for transfers that are not regular, not continuous and rarely occur, where one of the listed grounds including explicit consent exists. The Authority states that these exceptions must be interpreted narrowly.
6.1 Which route Nuzul relies on: the standard contract
Nuzul's transfer abroad is continuous, not incidental: every sign-in and every purchase verification goes abroad. For that reason the incidental-cases exception in article 9/6 is not relied on, and explicit consent is not used on its own as a basis in this arrangement: making a continuous transfer depend on consent turns consent into a condition of the service, and such consent is not regarded as freely given.
Basis: the standard contract published by the Board, art. 9/2-b. For transfers to countries with no adequacy decision, signing the standard contract is sufficient and no separate Board authorisation is required.
| Recipient | Location | Nature of transfer | Contract type |
|---|---|---|---|
| Supabase | South Korea (Seoul) | Continuous | Controller to processor |
| RevenueCat | United States | Continuous | Controller to processor |
| Apple, Google | United States / Ireland | Continuous | Subject to their own terms; see the note below |
The party signing the standard contract in the capacity of data controller will be Eyüp Ensar Şanlı.
A note on Apple and Google: these two are the distribution and payment channel for the app; payment data is created at their end without ever passing through us. The relationship with them is subject to their own developer agreements and data processing addenda, which in that respect makes them different from the other two suppliers.
Once signed, the standard contract must be notified to the Authority within five business days of signature, under the fifth paragraph of article 9. Notification is made physically, by registered electronic mail, or through the Standard Contract Notification Module opened by Board decision no. 2024/1793 of 17 October 2024 (https://standartsozlesme.kvkk.gov.tr). So that the period can be verified, the signature dates of both parties must be written in the contract. The Authority is also informed if a party changes, if the content changes, or if the contract comes to an end.
Source: Personal Data Protection Authority, "Transfer Abroad", https://www.kvkk.gov.tr/Icerik/2053/Yurtdisina-Aktarim
7. Retention periods
| Data | Period |
|---|---|
| Account and contact data | For the duration of membership; on a deletion request immediately, and from backups within 30 days at the latest |
| Usage and progress data | Deleted with the account |
| Purchase and financial records | 10 years under art. 82 of the Turkish Commercial Code, de-identified |
| Crash and error logs | 90 days |
| Access logs | 90 days |
When a period expires the data is deleted, destroyed or anonymised.
Why those three periods (decided 2026-08-06): account deletion is immediate; when the request is received the account leaves the live systems at that moment, there is no waiting window, and the operation cannot be undone. The 30 days is the upper bound for residual copies that may remain in regular system backups; in practice the backup cycle is shorter. The 10 years for financial records comes from the merchant's obligation to retain books and documents (art. 82 of the Turkish Commercial Code), a period set by commercial legislation rather than by data protection law. The 90 days for logs is again an upper bound; in practice the infrastructure provider keeps them for less.
8. Rights of the data subject, article 11, and how to apply
Under article 11 of the Law your rights are:
a) To learn whether your personal data is being processed, b) To request information about it if it has been processed, c) To learn the purpose of processing and whether it is used in line with that purpose, ç) To know the third parties in Türkiye or abroad to whom it is transferred, d) To request correction where it has been processed incompletely or incorrectly, e) To request erasure or destruction within the conditions of article 7 of the Law, f) To request that the operations under (d) and (e) be notified to the third parties the data was transferred to, g) To object to a result against you arising from analysis solely by automated systems, ğ) To claim compensation for damage suffered because of unlawful processing.
How to apply:
- From inside the app: Menu → Account Details
- E-mail: destek@nuzul.com.tr
- Web: https://nuzul.com.tr/en/account-deletion
- In writing: Merkez Mah. Akar Cad. I Towers Bomonti No: 3 İç Kapı No: 96, Şişli / İstanbul, Türkiye
Your application is concluded within thirty days at the latest, under the Communiqué on the Procedures and Principles of Application to the Data Controller. If your application is refused, if you find the answer insufficient, or if no answer is given in time, you may complain to the Personal Data Protection Board. You must apply to the data controller before applying to the Board.
9. VERBİS
The obligation to register with the Data Controllers Registry depends on thresholds of employee numbers and annual financial balance sheet. Following Board decision no. 2023/1154 of 6 July 2023, controllers with fewer than 50 employees annually and an annual financial balance sheet total below 100 million Turkish lira, whose main field of activity is not the processing of special category personal data, are exempt from registration.
Nuzul currently falls within that exemption. This rests on the assumption stated in §2 that the main field of activity is not the processing of special category data. If that position were to be answered the other way, the exemption threshold would drop to 10 employees / 10 million Turkish lira and registration could be required.
10. Changes
This notice is updated when the data processing activities change, and its current version is published at https://nuzul.com.tr/aydinlatma, with this English translation at https://nuzul.com.tr/en/kvkk-notice.