Privacy Policy and Personal Data Notice

Effective Date: August 15, 2026

Last Updated: September 8, 2026

Version: iOS 1.1

1. Purpose, scope, and nature of this document

This Privacy Policy and Personal Data Notice (“Policy”) explains how personal data is collected, used, stored, transferred, protected, and deleted in connection with the iOS version of the Vellen mobile application distributed through the Apple App Store, related Vellen web pages, live advisor text sessions, Vellen Credits, eligible direct 5, 10, or 15-minute advisor-session purchases through Apple In-App Purchase, account and profile features, advisor-account functions, and support services.

This Policy applies to Vellen users and advisors who access the iOS application. Different platform versions of Vellen may offer different features and may be covered by a separate privacy notice.

THIS POLICY IS NOT AN EXPRESS-CONSENT FORM. Where express consent is legally required for a particular processing activity, that consent will be requested separately, freely, and through a distinct action. Reading or acknowledging this Policy does not automatically constitute consent to every optional processing activity.

Because Vellen is operated by a business established in Türkiye, this Policy has been prepared with regard to the core transparency, security, and user-rights principles of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and other privacy and data-protection laws applicable to the user’s location and Vellen’s activities.

2. Data controller and privacy contact

The data controller that determines the purposes and methods of personal-data processing is:

Dilan Yalçın, operator of Vellen

Tax Identification Number: 9300899024

Establishment Date: December 25, 2025

Country of Establishment: Türkiye

Email: vellen2026@outlook.com

The Vellen operator also serves as the general privacy contact. Users may submit privacy, access, correction, deletion, and complaint requests through the contact address stated in this Policy.

3. Service scope

The iOS version of Vellen provides account and profile features, advisor discovery, advisor availability, live text-session requests, timed text sessions, session history, favorites, ratings and reviews, Vellen Credits purchased through the Apple App Store, eligible direct 5, 10, or 15-minute advisor-session purchases through Apple In-App Purchase, notifications, account-management tools, and support functions.

Feature availability may vary according to account type, store region, local law, technical capabilities, and Vellen’s operational decisions.

4. Personal data we collect

Depending on the features you use and whether you use Vellen as a user or advisor, we may process the following categories of data.

4.1. Account and Authentication Data

• Name or display name;
• Email address;
• Firebase user identifier (UID);
• Authentication provider and security/session records;
• Account-creation date, account status, preferred language, and age-eligibility declaration.

4.2. Profile and Preference Data

• Optional profile photo;
• Favorite advisors;
• Profile and notification preferences;
• Recently viewed or activity information where used to provide the relevant feature;
• Ratings and reviews submitted by the user.

4.3. Live Advisor Session Data

• Selected advisor;
• Selected session duration and request status;
• Request, acceptance, session-start, and completion timestamps;
• Pre-session information voluntarily entered by the user;
• Chat messages exchanged during the session;
• Photos or files voluntarily attached to the session;
• Typing, timer, session-status, cancellation, and completion information;
• Vellen Credit reservation, deduction, restoration, and session-charge records;
• For eligible direct Apple advisor-session purchases, the selected advisor, selected 5, 10, or 15-minute duration, Apple product identifier, verified transaction reference, locked session value, purchase-verification status, and any pre-session Wallet restoration associated with that purchase;
• Ratings, reviews, complaints, support records, and dispute evidence relating to a session.

4.4. Apple App Store Purchase and Vellen Credit Data

• Apple product ID, including the product used for an eligible direct 5, 10, or 15-minute advisor-session purchase;
• Apple transaction and original transaction identifiers where provided;
• Purchase date, storefront or country, currency, and amount reported by Apple;
• Purchase verification, refund, revocation, chargeback, or cancellation status;
• For direct advisor-session purchases, the selected advisor, selected duration, locked session value, and the Vellen purchase-intent or session reference used to bind the verified Apple transaction to the correct session;
• Vellen Credit balance and wallet-ledger records;
• Credit package purchased, direct-session Wallet restoration where applicable, and session-related credit movements;
• App-account token or other limited identifiers used to securely match an Apple purchase to the correct Vellen account.

Apple processes the user’s payment credentials. Vellen does not receive or store the user’s full payment-card number, card security code, or Apple Account password.

4.5. Technical, Security, and Notification Data

• IP address and approximate country or region where generated as part of normal network or security operation;
• Device model, operating system, and App version;
• Firebase installation or device identifiers;
• FCM notification token and notification preferences;
• Server logs, error records, performance information, and security events;
• Sign-in, abuse, fraud, and account-security signals.

4.6. Support and Communication Data

• Support emails and messages;
• Images, PDFs, screenshots, session identifiers, and other information voluntarily submitted in connection with support, a complaint, or a payment document;
• Review, status, and outcome of the support request.

4.7. Advisor Account, Agreement, Payment, and Tax Data

This section applies only to advisor accounts where the relevant functions are available.

• Advisor profile and availability information;
• Selected discussion topics shown on the advisor profile;
• Advisor agreement version, acceptance status, acceptance timestamp, and related acknowledgements;
• Legal name, tax number or taxpayer information, address, IBAN, account-holder information, and tax-document type where required for advisor payments and records;
• Advisor earnings, payout periods, deductions, invoices or e-SMM/payment documents, payment status, and related support records;
• Ratings and reviews associated with the advisor profile.

5. How we collect data

We collect information directly when a user or advisor creates or manages an account, updates a profile, changes advisor availability or discussion topics, requests or participates in a live text session, sends a message or attachment, purchases Vellen Credits, submits a review, contacts support, or provides advisor payment or compliance information.

Certain technical and usage information is generated automatically while the App operates through Firebase Authentication, Cloud Firestore, Firebase/Cloud Storage, Cloud Functions, Firebase Cloud Messaging, and other necessary Firebase components.

Apple may provide Vellen with limited transaction, verification, storefront, refund, and purchase-status information necessary to verify App Store purchases, apply Vellen Credits correctly, and, for eligible direct advisor-session purchases, authorize and bind the verified transaction to the selected advisor, selected duration, and locked session value.

6. Why we process data

Personal data may be processed for the following purposes:

• Creating, authenticating, securing, and managing accounts;
• Displaying and managing user and advisor profiles;
• Showing advisor availability and selected discussion topics;
• Creating advisor requests, transmitting messages and attachments, timing sessions, and maintaining session history;
• Verifying Vellen Credit purchases and maintaining accurate wallet records;
• Verifying eligible direct Apple advisor-session purchases and binding the verified transaction to the selected advisor, selected duration, locked session value, and correct Vellen account;
• Restoring the locked session value to the Vellen Wallet when an eligible pre-session cancellation or other valid adjustment occurs;
• Reconciling Apple refund, revocation, reversal, or entitlement-status changes with the related Wallet or session records where necessary to prevent duplicate delivery or duplicate compensation;
• Delivering account, advisor, session, and service notifications;
• Providing customer and advisor support and conducting complaint, dispute, payment, and wallet reviews;
• Administering advisor agreements, payouts, tax/payment records, and related documentation;
• Preventing fraud, abuse, unauthorized access, and security incidents;
• Maintaining App performance, security, and technical operation;
• Meeting tax, accounting, consumer, court, and competent-authority obligations;
• Establishing, exercising, or defending legal rights.

For purposes of the KVKK in Türkiye, processing may rely on applicable legal grounds including necessity for establishing or performing a contract, compliance with a legal obligation, establishment, exercise, or protection of a right, the data controller’s legitimate interests that do not prejudice fundamental rights, and express consent where required.

Where the law of another country applies, corresponding legal grounds may include performance of a contract, consent, legitimate business purpose or legitimate interests, legal obligation, and protection of rights.

7. Data visible to advisors and users

When a user creates a live session request, the selected advisor may receive or view information reasonably necessary to provide the session, including:

• Display name and profile photo;
• Pre-session information voluntarily provided by the user;
• Chat messages and attachments;
• Session status and remaining time.

Advisors are required to use user information only for the service and to comply with applicable confidentiality, safety, contractual, and data-protection obligations.

Users may view advisor information made available through Vellen, such as the advisor’s display name, profile image, profile description, availability, discussion topics, price information, ratings, reviews, and other profile information intended for display.

Vellen may access chats and attachments through authorized access where reasonably necessary for support, complaint handling, security, fraud prevention, payment disputes, or contractual enforcement.

8. Parties with whom personal data may be shared

Vellen does not sell personal data.

8.1. Google Firebase and Google Cloud

A significant portion of Vellen account, profile, session, message, support, wallet, advisor, and technical information is stored or processed through Firebase/Google Cloud infrastructure.

Under the current project configuration, the primary Cloud Firestore database operates in the European multi-region named “eur3,” and server-side Cloud Functions may operate in configured European regions such as “europe-west3.” A particular database or function region does not mean that every support, security, delivery, or technical metadata operation is processed exclusively in that location.

Where Google acts as a processor or service provider for Firebase customer data, Vellen remains responsible for its own data-controller obligations toward users.

8.2. Apple App Store

Apple conducts App Store purchase, local pricing, tax, billing, payment-method, refund, storefront, and store-account operations under Apple’s own terms and privacy practices.

Vellen receives only the limited Apple transaction and verification information reasonably necessary to verify purchases, apply Vellen Credits, authorize eligible direct advisor-session purchases, bind a verified direct purchase to the selected advisor and duration, prevent duplicate delivery, and process valid refund or revocation adjustments. If an eligible direct advisor-session purchase is cancelled before the paid session begins, Vellen may record a restoration of the full locked session value to the user’s Vellen Wallet. This Wallet restoration is not an Apple refund to the original payment method; refunds to the original payment method are handled through Apple’s applicable refund process.

8.3. Advisors

Selected advisors receive only information reasonably necessary to provide the requested live text session. Advisors may not use Vellen user data for unrelated personal purposes or unauthorized off-platform services.

8.4. Other Service Providers

Where Vellen uses providers for infrastructure, email, support, security, accounting, legal services, or error diagnostics, only data reasonably necessary for those services may be shared. Service providers are expected to apply privacy and security protections appropriate to the data and service involved.

8.5. Legal and Security Disclosures

Necessary and proportionate disclosure may be made in response to a valid court order, competent-authority request, legal obligation, fraud investigation, serious security risk, or need to establish, exercise, or protect legal rights.

8.6. Business Transfers

In a merger, sale, restructuring, or business transfer, data may be transferred to the new operator subject to applicable privacy obligations and law. Users will be informed where required.

9. International data transfers

Vellen is established in Türkiye and may serve users in other countries where the service is lawfully offered. Because Vellen uses Firebase/Google Cloud infrastructure, international transfers may occur between the user’s country, Türkiye, and infrastructure or service locations used by Google and other necessary providers.

Transfers are handled using contractual, technical, and organizational measures required by applicable law. Where an additional notice, consent, contractual safeguard, or other transfer mechanism is legally required, the relevant process will be provided as required.

10. Photo library and notifications

Photo-library access is requested only when a user chooses to select a profile photo or attach an image to a live advisor session. Refusing photo-library access does not prevent general account use; only the relevant image-selection feature may be unavailable.

Where reasonably possible, photo selection is limited to the image selected by the user.

When notifications are enabled, an FCM token and notification preferences are processed so Vellen can send account, advisor, session, support, or service notifications. Notifications may be disabled in device settings.

11. Sensitive information voluntarily shared in sessions

Vellen does not require a user to provide a full payment-card number, banking credentials, IBAN, password, identity document, or health record in order to participate in a live advisor session.

Users should not voluntarily send unnecessary sensitive information in chat. Information voluntarily shared in a session may be viewed by the selected advisor and, where reasonably necessary for support, security, complaint handling, or a dispute, by authorized Vellen personnel.

Advisor payment, tax, identity, and banking information collected through advisor-account functions is handled separately for advisor onboarding, compliance, recordkeeping, and payout purposes and should not be submitted through ordinary live-session chat.

12. Data-retention periods

Data is retained for as long as reasonably necessary for the purpose for which it was collected and while a legal or operational obligation applies. Vellen’s current operational retention standard is:

• Account and profile information: for as long as the account remains active; following verified account deletion, deletion or anonymization from active systems generally within 30 days, except where retention is legally required;
• Live-session messages and attachments: generally no longer than 24 months from completion of the relevant session; longer where a complaint, security incident, chargeback, fraud review, or legal request remains open;
• Support records and complaints: generally no longer than 24 months after the request is closed;
• Technical, sign-in, security, and fraud records: generally no longer than 12 months; longer during an active security, abuse, or fraud investigation;
• Purchase, direct-session purchase verification, Wallet restoration, wallet, advisor payout, tax, invoice, accounting, agreement, and legally required business records: for the applicable statutory or legally necessary retention period;
• Protected backups: generally no longer than 90 days within the technical backup cycle after deletion from active systems, except where a legal hold or other lawful retention requirement applies.

Where a shorter period is sufficient, data may be deleted or anonymized earlier. Necessary records may be kept longer under restricted access where required by law, fraud prevention, payment disputes, security incidents, tax or accounting obligations, or defense of legal rights.

13. Data security

Vellen applies reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or misuse. Where appropriate, these measures include:

• Encrypted network communications;
• Firebase Authentication and authorization controls;
• Firestore and Storage security rules;
• Server-side validation and timestamps;
• Role-based and restricted administrator access;
• Auditing of transaction, wallet, advisor-payment, and session records;
• Security logs, incident review, and access restrictions.

No internet-connected system can guarantee absolute security. If a personal-data breach occurs, Vellen will assess and address it in accordance with applicable legal requirements.

14. User rights

Depending on the user’s country and applicable law, the user may have all or some of the following rights:

• To learn whether personal data is being processed;
• To access personal data and request a copy;
• To correct incomplete or inaccurate data;
• To request deletion or anonymization;
• To object to or request restriction of certain processing where applicable;
• To withdraw consent where processing is based on consent;
• To data portability where applicable;
• To complain to a competent privacy or data-protection authority where applicable.

To exercise a right, contact vellen2026@outlook.com or use available in-app account/privacy tools. Reasonable verification may be requested to protect identity and account security.

Requests will be handled within the period required by applicable law. Fulfillment may be limited where necessary to protect the rights of others, prevent fraud, maintain security, comply with legal retention duties, or address an ongoing dispute.

15. Account deletion

A user may start account deletion through the in-app account-deletion feature. A request may also be submitted through the external deletion page at https://vellenpsychic.com/delete-account/. Reauthentication or another verification step may be required for security.

Following verified deletion, the active account, profile, and user-linked service data are deleted or anonymized to the extent they are not legally required to be retained. Purchase, direct-session purchase verification, Wallet restoration, wallet, advisor-payment, tax, accounting, agreement, fraud, security, complaint, and dispute records may be retained where legally or operationally necessary.

Unused Vellen Credits are not cash and are not paid to a card or bank account merely because an account is deleted.

16. Children’s privacy

Vellen is not directed to persons under 18 and does not intend to knowingly collect personal data from persons under 18.

If you believe that Vellen has processed personal data relating to a person under 18, contact vellen2026@outlook.com. Following appropriate identity and security verification, the matter will be handled in accordance with applicable law.

17. SDKs and technical components

The iOS App may use Firebase SDKs and Apple StoreKit components for authentication, database and storage services, notifications, security, purchase verification, and technical operation.

If Vellen adds a new SDK, advertising system, tracking technology, payment method, or materially different data flow, this Policy and the relevant App Store privacy disclosures will be updated as required.

18. Changes to this policy

This Policy may be updated when the iOS service, purchase methods, country availability, Firebase configuration, data flows, or applicable law changes. The current update date is displayed at the beginning of the document.

Material changes will be announced through an in-app notice, email, or another appropriate method where required by applicable law.

19. Contact and complaints

For privacy, access, correction, deletion, account, advisor-data, payment-data, or security requests:

Vellen

Data Controller and Privacy Contact: Dilan Yalçın

Tax Identification Number: 9300899024

Country of Establishment: Türkiye

Email: vellen2026@outlook.com

If a user believes that a request has not been resolved, the user may contact the competent data-protection or privacy authority available under applicable law.