Orwee · Legal

KVKK information notice

Information on the processing of the personal data of Orwee users, under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

Effective: 10 November 2026 · Version 2.0

1. Data controller

Data controller
The person or company that publishes Orwee in the app store (the name is shown on the store page)

2. Processing: Photo analysis

Data
The food, menu or label photo you take or pick, the analysis type and your note, if you wrote one. In bulk entry, the PDF or the photo of a recipe page you pick.
Purpose
To recognise the food, estimate grams, and read menu and recipe text. Nutrition values are calculated on your phone.
Legal basis
Your explicit consent to photo analysis (KVKK art. 5(1); art. 6(2) if the photo reveals information about your health; GDPR art. 6(1)(a) and 9(2)(a)).
Retention
Our server does not write the photo or the document to disk and clears it from memory when the analysis ends. The photo does not go to another provider.

3. Processing: Helping improve the app (two separate permissions)

Data
My corrections: the model’s proposal and your final version, unmatched ingredient names, units. My photos: the analysed image and the result you confirmed.
Purpose
To improve recognition, matching and gram estimates with automated jobs, and to measure new model versions before release.
Legal basis
Separate explicit consent for each permission (KVKK art. 5(1), art. 6(2) where needed; GDPR art. 6(1)(a), 9(2)(a) where needed).
Retention
At most 12 months; when you turn a permission off, submissions not yet processed are deleted at once. Aggregated results (synonyms, average grams) cannot be linked to a person and are kept.

4. Processing: Barcodes and data packs

Data
The barcode number you scan; the version and region code of the data pack requested.
Purpose
To find the product in the Open Food Facts database; to download current, signed food data.
Legal basis
Providing the service you ask for (KVKK art. 5(2)(c); GDPR art. 6(1)(b)).
Retention
The barcode number is not written to the logs. A pack request contains no personal data.

5. Processing: Security and rate limits

Data
The IP address of your internet connection and the app key; in technical logs the request type, duration and error code.
Purpose
To prevent abuse and overload and to find errors.
Legal basis
Legitimate interest in the security of the service (KVKK art. 5(2)(f); GDPR art. 6(1)(f)).
Retention
The IP address is held in memory briefly, only for the rate limit, and is not written to the logs. Logs contain no images, notes, recipe text or barcodes.

6. How data is collected

Personal data is collected electronically and automatically through the mobile app, during actions you start in the app (photo analysis, barcode, contribution). A problem report is an email you send us with your own email app.

7. Transfers

Photos and contribution data are not transferred to third parties.

The barcode number is looked up in Open Food Facts to get the product information; the request is not linked to you.

To the hosting provider of our server, only as a data processor and to run the service.

Where the law requires it, to competent public authorities, limited to the data we hold (KVKK art. 8).

Photo analysis runs on our own server; the photo is not transferred to another AI company. If our server is outside Türkiye, sending to it is a cross-border transfer (KVKK art. 9) and relies on the safeguards that article requires.

8. Data we do not process

No account, name, phone number, location, contacts or advertising ID is collected. The log, recipes, weight, goals, the optional health question and business e-approval records stay on your phone and never reach us.

9. Your rights (KVKK art. 11)

  • To learn whether your data is processed and, if so, to request information about it
  • To learn the purpose of processing and whether the data is used for that purpose
  • To know the recipients in Türkiye and abroad to whom the data is transferred
  • To have incomplete or incorrect data corrected, to have data deleted or destroyed, and to have this notified to the recipients
  • To object to a result against you that arises only from analysis by automated systems
  • To claim compensation for damage caused by unlawful processing
  • To withdraw your consent at any time; withdrawal does not affect the lawfulness of earlier processing

10. How to apply

To use your rights, send your application in Turkish and in writing, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, to the address above, to the KEP address, with a secure electronic or mobile signature, or by email to our address from an email address you gave us before and that is recorded in our system.

The application must contain your name, signature (for written applications), Turkish ID number (for foreigners: nationality and passport or ID number), residential or business address, an email address or telephone number for notifications if any, and the subject of the request.

Your application is concluded free of charge within 30 days at the latest, depending on its nature; if the action involves an additional cost, the fee in the tariff set by the Board may be charged. If you find the answer insufficient or receive no answer in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application (KVKK art. 13-14).

We cannot access the data that stays on your phone; you manage it yourself with Settings > Export my data and Settings > Delete all data.

11. Language of this text

This text was written in Turkish and is published in the app’s 21 languages. The translations contain the same terms.

If the translations differ in meaning, the Turkish text is the reference. If the difference is to your disadvantage, the meaning more favourable to you applies.

This clause does not limit the consumer rights and personal data rights that the law of your country of residence gives you and that cannot be waived by contract.