VELLEN PRIVACY POLICY AND PERSONAL DATA NOTICE

Effective Date: July 29, 2026

Last Updated: July 30, 2026

Version: 1.1

1. PURPOSE, SCOPE, AND NATURE OF THIS DOCUMENT

This Privacy Policy and Personal Data Notice (“Policy”) explains how personal data is collected, used, stored, transferred, protected, and deleted in connection with the Vellen mobile application, related web pages, free tarot features, personalized astrology features, the Vellen Wallet, live advisor sessions, and support services.

THIS POLICY IS NOT AN EXPRESS-CONSENT FORM. Where express consent is legally required for a particular processing activity, that consent will be requested separately, freely, and through a distinct action. Reading or acknowledging this Policy does not automatically constitute consent to every optional processing activity.

Because Vellen is operated by a business established in Türkiye, this Policy has been prepared with regard to the core transparency, security, and user-rights principles of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and other privacy and data-protection laws applicable to the user’s location and Vellen’s activities.

Vellen may become available to users worldwide. If offering the service in a new country or region creates an additional notice, registration, representative, consent, data-localization, or other obligation, this Policy and the relevant operational processes will be updated before service is offered or when legally required.

2. DATA CONTROLLER AND PRIVACY CONTACT

The data controller that determines the purposes and methods of personal-data processing is:

Dilan Yalçın, operator of Vellen

Tax Identification Number: 9300899024

Establishment Date: December 25, 2025

Country of Establishment: Türkiye

Email: vellen2026@outlook.com

The Vellen operator also serves as the general privacy contact. Regardless of their country, users may submit privacy, access, correction, deletion, and complaint requests through the contact address stated in this Policy.

3. GLOBAL SCOPE OF THE SERVICE

Vellen may be made available to users worldwide to the extent permitted by applicable law and application-store rules. Availability of the App or particular features may vary according to the user’s store region, local law, technical capabilities, and Platform decisions.

The fact that the App is downloadable in a country does not mean that subscriptions, Vellen Credits, live advisor services, or every other feature are enabled in that country. Certain features may be offered only to specific users or account types.

When the service expands to a new country or region, Vellen evaluates data transfers, user rights, notices, registrations, representative requirements, and other local obligations. Necessary changes are reflected in this Policy and in Vellen’s operational processes.

4. PERSONAL DATA WE COLLECT

Depending on the features you use, we may process the following categories of data.

4.1. Account and Authentication Data

• Name or display name;
• Email address;
• Firebase user identifier (UID);
• Authentication provider and security/session records;
• Account-creation date, account status, preferred language, and age-eligibility declaration.

4.2. Profile Data

• Optional profile photo;
• Favorite advisors;
• Profile and notification preferences;
• Ratings and reviews submitted by the user.

4.3. Astrology and Birth Data

• Date of birth;
• Birth time or an indication that the birth time is unknown;
• City and country of birth;
• Time-zone and location information required for astrology calculations;
• Generated birth chart, planetary placements, transits, lunar/eclipse/retrograde reports, and personalized timing results.

Birth data is not requested as standard account-registration information. It is requested only when a user chooses a personalized astrology feature. Vellen does not request continuous or real-time precise device location. A city entered as a place of birth is not device-location tracking.

4.4. Advisor Request and Chat Data

• Selected advisor;
• Request status and timestamps;
• Session duration and server-based start/end records;
• Chat messages;
• Photos or files sent by the user;
• Cancellation, wallet deduction, and wallet-restoration records;
• Ratings, reviews, complaints, and dispute records.

4.5. Purchase, Subscription, and Wallet Data

• Apple App Store or Google Play product ID; Apple transaction ID or Google Play order/transaction ID and purchase token;
• Purchase date, store country or region, currency, and amount reported by Apple App Store or Google Play;
• Subscription status, renewal, cancellation, refund/revocation, and entitlement information;
• Vellen Credit balance, credit movements, and session spending;
• Purchase-verification, transaction-status, and entitlement data supplied by Apple App Store or Google Play.

Apple App Store and Google Play process payment methods on their own platforms. Vellen does not receive or store the user’s full card number, card security code, Apple Account password, or Google Account password.

4.6. Use of Free Features

• Daily card draw and the card displayed;
• Number of Yes/No feature uses and result history;
• Daily limit, eligibility, and reset records.

4.7. Technical, Security, and Notification Data

• IP address and approximate country or region;
• Device model, operating system, and App version;
• Firebase installation or device identifiers;
• FCM notification token and notification preferences;
• Server logs, error records, performance information, and security events;
• Sign-in, abuse, fraud, and account-security signals.

4.8. Support and Communication Data

• Support emails and messages;
• Screenshots, session identifiers, and evidence submitted by the user in connection with a complaint;
• Review and outcome of the request.

5. HOW WE COLLECT DATA

We collect information directly from users through account, profile, astrology, chat, file-upload, and support interfaces.

Certain technical and usage information is generated automatically while the App operates through Firebase Authentication, Cloud Firestore, Firebase/Cloud Storage, Cloud Functions, Firebase Cloud Messaging, and other necessary Firebase components.

Apple App Store or Google Play may provide Vellen with limited transaction, verification, and entitlement data concerning purchases and subscriptions. Full payment-card information is processed by the relevant application store and its payment-service providers.

6. WHY WE PROCESS DATA

Personal data may be processed for the following purposes:

• Creating an account, authenticating the user, and managing the account;
• Applying free Daily Card and Yes/No limits;
• Generating personalized astrology calculations and reports at the user’s request;
• Creating advisor requests, transmitting messages, timing sessions, and calculating duration;
• Verifying Vellen Credits, purchases, subscriptions, and wallet movements;
• Restoring Credits to the wallet when a pre-session cancellation qualifies;
• Managing notifications and user preferences;
• Providing customer support and conducting complaint, dispute, and wallet reviews;
• Preventing fraud, abuse, unauthorized access, and security incidents;
• Maintaining App performance, security, and technical operation;
• Meeting tax, accounting, consumer, court, and competent-authority obligations;
• Establishing, exercising, or defending legal rights.

For purposes of the KVKK in Türkiye, processing may rely on applicable legal grounds including necessity for establishing or performing a contract, compliance with a legal obligation, establishment, exercise, or protection of a right, the data controller’s legitimate interests that do not prejudice fundamental rights, and express consent where required.

Where the law of another country applies, corresponding legal grounds may include performance of a contract, consent, legitimate business purpose or legitimate interests, legal obligation, and protection of rights.

7. AUTOMATED ASTROLOGY CALCULATIONS

Vellen may use birth information supplied by the user to generate automated or computer-assisted astrology calculations, transits, lunar and eclipse reports, retrograde interpretations, and timing content.

These processes do not make automated decisions that create significant legal, credit, employment, insurance, health, education, or similar effects for the user. Results are provided solely for entertainment and personal reflection and do not guarantee scientific accuracy or a future outcome.

8. DATA VISIBLE TO ADVISORS

When a user creates a session request, the selected advisor may view the following information where necessary to provide the service:

• Display name;
• Profile photo;
• Chat messages;
• Photos or files sent by the user within the chat;
• Session status and remaining time.

Vellen does not automatically show advisors the user’s date of birth, birth time, place of birth, natal chart, or gender.

The user may voluntarily share that information during the chat. Advisors are required to use user data only for the session, keep it confidential, and not remove or use it outside the Platform.

Vellen may access chats and attachments only through authorized access for complaint, security, fraud, support, or contractual-violation review.

9. PARTIES WITH WHOM PERSONAL DATA MAY BE SHARED

Vellen does not sell personal data.

9.1. Google Firebase and Google Cloud

A significant portion of Vellen user accounts, advisor messages, session data, wallet records, and App functionality is stored and processed through Firebase/Google Cloud infrastructure.

Under the current project configuration, the primary Cloud Firestore database operates in the European multi-region named “eur3.” EUR3 includes read/write regions in Belgium and the Netherlands and a witness region in Finland. Server-side Cloud Functions may operate in “europe-west3” (Frankfurt) or another European region configured for the project.

A particular database location does not mean that all Firebase service, support, security, delivery, or technical metadata is processed exclusively in that same location. Google and its subprocessors may process limited technical data in other countries according to the nature of the service.

For Firebase customer data, Google generally acts as a processor/service provider following Vellen’s instructions. Vellen remains the data controller in relation to its users.

9.2. Apple App Store and Google Play

Apple App Store and Google Play conduct in-app purchases, subscriptions, local pricing, tax, billing, payment-method, refund, and store-account operations on their own platforms under their respective terms and privacy policies.

Vellen may receive only the limited transaction information necessary to verify a purchase, monitor transaction status, apply a refund or cancellation, and provide user entitlements. For Google Play transactions, that information may include product ID, order/transaction ID, purchase token, purchase status, and subscription status.

9.3. Advisors

Selected advisors receive only the information identified in Section 8 that is necessary to provide the service. Advisors may not use user data for personal purposes or off-platform services.

9.4. Other Service Providers

Where Vellen uses email, support, security, accounting, legal, error-diagnostics, or infrastructure providers, only the data necessary for those services may be shared. Providers are subject to privacy and security obligations.

9.5. Legal and Security Disclosures

Necessary and proportionate disclosure may be made in response to a valid court order, competent-authority request, legal obligation, fraud investigation, serious security risk, or need to protect legal rights.

9.6. Business Transfers

In a merger, sale, restructuring, or business transfer, data may be transferred to the new operator subject to privacy obligations and applicable law. Users will be informed where required.

10. INTERNATIONAL DATA TRANSFERS

Vellen is established in Türkiye and may serve users worldwide. Because a significant portion of data is stored in Firebase’s EUR3 European multi-region, international transfers may occur from the user’s country to Google infrastructure in Europe.

Limited data may also be processed outside Europe where necessary for the technical operation, security, and support of Google/Firebase services.

Transfers are conducted using contractual, technical, and organizational measures required by applicable law. These may include service-provider agreements, data-processing terms, access controls, encrypted transmission, and, where necessary, standard contractual clauses or comparable protection commitments.

If the user’s location requires an additional notice, express consent, contractual safeguard, data-localization measure, or another mechanism for cross-border transfers, the relevant user interface and process will be provided separately in accordance with applicable law.

11. PHOTO, CAMERA, AND NOTIFICATION PERMISSIONS

Access to the gallery or camera for uploading a profile photo or chat attachment is requested only when the user selects the relevant feature. Refusing permission does not prevent account use; only the relevant photo feature may be unavailable.

Where reasonably possible, photo selection is limited to the image selected by the user.

When notifications are enabled, an FCM token and notification preferences are processed. The user may disable notifications in device settings.

12. SENSITIVE INFORMATION VOLUNTARILY SHARED BY USERS

Vellen does not request bank information, an IBAN, a full card number, a password, an identity document, or a health record for an advisor session.

Users should not voluntarily share such information in chat. Information shared by a user may be viewed by the selected advisor and, in a dispute or security matter, reviewed by authorized Vellen personnel.

Vellen maintains its legal security obligations for data within its systems but cannot control private communication, payments, or data transfers conducted by users outside Vellen.

13. DATA-RETENTION PERIODS

Data is retained for as long as necessary for the purpose for which it was collected and while a legal obligation applies. Vellen’s current operational retention standard is:

• Account, profile, and birth information: for as long as the account remains active; following verified account deletion, deletion or anonymization from active systems generally within 30 days;
• Chat messages and attachments: generally no longer than 24 months from completion of the relevant session; longer where a complaint, security incident, chargeback, or legal request remains open;
• Support records and complaints: generally no longer than 24 months after the request is closed;
• Technical, sign-in, security, and fraud records: generally no longer than 12 months; longer during an active incident investigation;
• Purchase, subscription, wallet, tax, and accounting records: for the applicable statutory retention period;
• Protected backups: generally no longer than 90 days within the technical backup cycle after deletion from active systems; longer where a legal hold applies.

Where a shorter period is sufficient for a data category, the data may be deleted or anonymized earlier. Necessary records may be kept longer under restricted access where required by law, fraud prevention, payment disputes, security incidents, or defense of legal rights.

14. DATA SECURITY

Vellen applies reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, loss, or misuse. Where appropriate, these measures include:

• Encrypted network communications;
• Firebase Authentication and authorization controls;
• Firestore and Storage security rules;
• Server-side validation and timestamps;
• Role-based and restricted administrator access;
• Auditing of transaction, wallet, and session records;
• Security logs, incident review, and access restrictions.

No internet system can guarantee absolute security. In the event of a personal-data breach, Vellen will conduct the risk assessment required by applicable law and notify competent authorities and/or affected users within the required time and scope.

15. USER RIGHTS

Depending on the user’s country and applicable law, the user may have all or some of the following rights:

• To learn whether personal data is being processed;
• To access personal data and request a copy;
• To correct incomplete or inaccurate data;
• To request deletion or anonymization;
• To object to or request restriction of certain processing;
• To withdraw consent where processing is based on consent;
• To data portability where applicable;
• To opt out of sale, targeted advertising, or certain sharing; Vellen does not sell personal data;
• To appeal the denial of a request in jurisdictions that provide such a right;
• To complain to a competent privacy or data-protection authority.

To exercise a right, contact vellen2026@outlook.com or use the available in-app account/privacy tools. Reasonable verification may be requested to protect identity and account security.

Requests will be answered within the period required by applicable law. Fulfillment may be limited where necessary to protect the rights of others, prevent fraud, maintain security, comply with legal retention duties, or address an ongoing dispute.

16. ADDITIONAL RIGHTS BASED ON LOCATION

Applicable law in the user’s country may provide rights in addition to those listed in this Policy, including access, information, correction, deletion, restriction or suspension of processing, withdrawal of consent, data portability, opting out of certain advertising or sharing activities, objecting to automated decisions, appealing a denied request, and complaining to a competent privacy or data-protection authority.

This Policy does not remove mandatory rights arising under applicable local law. The scope, exceptions, verification method, and response time may vary according to the user’s location. Requests may be submitted to vellen2026@outlook.com or through available in-app privacy tools.

17. ACCOUNT DELETION

A user may start deletion through the in-app account-deletion feature. A request may also be submitted through the external deletion page at https://vellenpsychic.com/delete-account/. Reauthentication or another verification step may be required for security.

Account deletion does not cancel an Apple App Store or Google Play subscription. The subscription must be separately canceled through the Apple Account or Google Play subscription settings of the store where it was purchased.

Following verified deletion, the active account, profile, birth information, and user-linked service data are deleted or anonymized to the extent they are not legally required to be retained. Purchase, wallet, tax, fraud, security, and dispute records may be retained for the mandatory period.

Users should use Vellen Credits before deleting an account. Credits cannot be converted into cash and are not paid to a card or bank account because of account deletion.

18. CHILDREN’S PRIVACY

Vellen is not directed to persons under 18 and does not intend to knowingly collect their data.

If you believe that Vellen has processed data relating to a person under 18, contact vellen2026@outlook.com. Following identity and security verification, the data will be deleted except for records that must legally be retained.

19. COOKIES, SDKs, AND ANALYTICS

The mobile App may use Firebase SDKs, Apple StoreKit components, and, in the Android version, Google Play Billing components for authentication, database services, notifications, security, purchase verification, and technical operation.

If optional advertising, behavioral tracking, or analytics technologies are added in the future, this Policy and the relevant store privacy disclosures will be updated, and consent or opt-out mechanisms will be provided where required.

The related website may use strictly necessary technical cookies. If optional cookies are used, a preference tool will be provided to the extent required by applicable law.

20. CHANGES TO THIS POLICY

This Policy may be updated when the service, country availability, Firebase configuration, data flows, or applicable law changes. The current update date is displayed at the beginning of the document.

Material changes will be announced before taking effect through an in-app notice, email, or another appropriate method where required by applicable law.

If a new SDK, advertising system, payment method, publication country, or different data center is added, the Policy will be updated to reflect the actual data flow.

21. CONTACT AND COMPLAINTS

For privacy, access, correction, deletion, account, advisor-data, or security requests:

Vellen

Data Controller and Privacy Contact: Dilan Yalçın

Tax Identification Number: 9300899024

Country of Establishment: Türkiye

Email: vellen2026@outlook.com

If a user believes that a request has not been resolved, the user may contact the competent data-protection or privacy authority in the user’s country of residence.