Privacy Policy

The data controller is the operator of the KOLHUBZ platform. (The operator's legal entity name, address and contact email will be published in this section before commercial launch; until then, requests can be submitted via the in-platform support channels.)

Account data: email address and authentication identifiers (via Privy). Profile data: display name, bio, niches, languages, price range, avatar. Social account data: the X/Telegram/YouTube handles you connect and follower/subscriber/view metrics retrieved from their APIs (for YouTube, the Google OAuth access token is stored encrypted). Exchange data (only if you connect it): your exchange affiliate API keys (read-only; stored encrypted) and the referral/volume counts read from that API. Device data (mobile): push notification token (Expo). Wallet data: wallet addresses you verify with a signature (private keys are never collected). Transaction data: deals, offers, deliveries, reviews, package purchases and their on-chain transaction identifiers. KYB data (only for company applications): legal name, registration number, country and uploaded documents. Communication data: in-platform messages and notification preferences. Technical data: IP address, browser information and security/error logs.

Data is processed to create and manage your account, provide matching and discovery features, verify metrics, record escrow flows, resolve disputes, ensure security (abuse and fraud prevention, rate limiting), fulfil legal obligations and improve the service. Marketing emails are strictly opt-in and you can unsubscribe from each category separately.

Under KVKK Art. 5 and GDPR Art. 6: performance of a contract (account, deals, escrow records); legitimate interest (security, fraud prevention, service improvement); legal obligation (record keeping, responding to official requests); and consent (connecting social accounts, optional notifications). Where processing is based on consent, you may withdraw it at any time.

The following processors are used to provide the service: Privy (authentication), Supabase (database and file storage), Fly.io (application hosting — Singapore), Resend (email), Expo (mobile push notification delivery), Upstash (rate limiting), Sentry (error monitoring), the X API, the Telegram Bot API and a Telegram MTProto session (channel metric and view verification), Google OAuth and the YouTube Data API (YouTube channel connection and metrics), exchange affiliate APIs (Bybit, OKX — only with the read-only keys you connect; keys are stored encrypted), blockchain RPC/indexing providers (Base/BSC RPC endpoints, Helius (Solana), TronGrid (Tron)), Coinbase Onramp / Coinbase Developer Platform (only if you start a card purchase of USDC: your wallet address, the target network and your IP address are sent to Coinbase; card, payment and identity verification data are collected directly by Coinbase and never reach the Platform), Reclaim Protocol (optional reach proof: your X profile metrics — follower count and account age — are signed via zkTLS by Reclaim attestors; the Platform only sends a random session context, the proof is not stored on Reclaim's servers, and the Platform stores ranges and a pseudonymous identifier hash rather than the exact values) and WalletConnect / Reown (external wallet connection: your wallet address, network and signing requests are relayed end-to-end encrypted through the WalletConnect relay; your private key stays in your wallet). These providers' servers may be located abroad; transfers are made with the safeguards required under KVKK Art. 9 and GDPR Chapter V. Your personal data is NOT sold to third parties.

Escrow transactions are written to public blockchain networks. Wallet addresses and transaction records are PERMANENT by the nature of blockchains and cannot be deleted or altered by anyone, including the Platform. The right to erasure can only be applied to data in the Platform's database.

Account data is kept for as long as your account remains open; deal and payment records are kept after account closure for the statutory limitation periods due to legal retention obligations and potential disputes; security logs are kept for a limited period. When the periods expire, data is deleted or anonymized.

You can delete your account at any time: in the app via Profile → Settings → Delete account, on the web via Settings → Security. If you can't sign in, you can request deletion with the form on the public account deletion page; requests are completed within 30 days at the latest once account ownership is verified. Deleted: email, your sign-in account (Privy), two-factor secrets, linked social accounts and their tokens, exchange API keys, wallet addresses, profile details and images, the text and attachments of messages you sent, your offer notes and application texts. Your open listings are closed. Kept: deals, payment and escrow records (amounts and transaction IDs), disputes and reviews — these are also the other party's records; a pseudonym replaces your name. These records are kept for statutory retention periods. Data written to a blockchain cannot be deleted.

Account deletion page →

Under KVKK Art. 11 and the GDPR you have the rights of access, rectification, erasure (subject to the blockchain exception), restriction of processing, objection, portability and withdrawal of consent. You can delete your account yourself in Settings; if you can't sign in, use the form on the public account deletion page. Other requests can be submitted via the in-platform support channel; they are answered within the statutory period after identity verification. You may also lodge a complaint with the Turkish Personal Data Protection Board (KVKK) or your local supervisory authority (GDPR).

The Platform uses only strictly necessary/functional cookies: your language preference (NEXT_LOCALE), Privy session information and, when a page is opened from the mobile app, an in-app session flag (kz_app) kept for the browser session. NO advertising or third-party tracking cookies are used; for this reason no separate cookie consent is requested.

Data is encrypted in transit with TLS; access is restricted on a role basis; hidden-profile masking is applied server-side; KYB documents are kept in a separate store with restricted access. No system is 100% secure; in the event of a breach, the notifications required by law will be made.

To enforce community rules and resolve disputes, authorised moderators and arbiters may review reported content, dispute evidence and related messages. This access is limited to staff roles that need it, requires a written reason every time, and is recorded in a tamper-resistant log of who looked at which record and when. You are notified when your messages or personal data are reviewed. Dispute evidence and KYB documents are submitted for review in the first place, so their review is not notified separately. Staff actions (restrictions, hiding content, arbiter decisions) require two-factor verification and a reason. The short reason for any restriction on your account, and its end date if any, is shown to you.

For security, fraud prevention and dispute resolution we keep an event log of actions on your account (such as sign-ins, profile and wallet changes, offer and deal steps, reports). This log does NOT contain message content, email addresses or plain IP addresses: IP address and device information are stored only as an irreversible digest (keyed hash). Session records (device/IP digest, last seen) are kept for at most 12 months; IP/device digests in event records are also removed after 12 months. Event records are kept for at most 10 years for legal retention duties and possible disputes, and cannot be altered afterwards. When you delete your account, your session records are deleted; your identity in event records is replaced by an irreversible alias and IP/device digests are removed.

The Platform is not directed at persons under 18 and we do not knowingly collect data from children. If a user under 18 is identified, the account will be closed and their data deleted.

This Policy may be updated; material changes will be announced on the Platform. The current version is always published on this page.