Community Data Notice

Last updated: September 17, 2026

This notice sets out which personal data the Valora community ("Social") processes, for which purposes, on which legal basis, with whom the data is shared, for how long it is retained and which rights data subjects have. It constitutes the information notice required by Article 10 of Personal Data Protection Law No. 6698 and by Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation). It supplements the general Privacy Policy, which continues to apply to the remainder of the application.

1. Controller

Data controller: Krayir Labs.
Contact: help@krayir.xyz
Hosting: the database, the media storage and the moderation service operate on servers located in Germany; community data is therefore stored in the European Union.

2. Categories of data processed

Profile: handle, display name, bio, avatar image, profile state, creation time.
Content submitted by the user: posts, comments, images, polls and their options, portfolio and trade snapshots that the user elects to share, hashtags and asset references.
Interactions: likes, bookmarks, reposts, poll votes, follows, blocks, translation requests and the activity required to compose the feed and notifications.
Moderation data: automated risk scores and labels for text and images, text recognised within images, numerical image representations (embeddings), duplicate and spam signals, decisions, measures, strikes, reports submitted or received, appeals and their outcome.
Acceptance record: the accepted version of the terms, the language, a hash of the exact text displayed, the platform, the application version and the time of acceptance.
Technical data: a salted, irreversible key derived from the IP address for rate-limiting purposes (the address itself is not stored for the community), the device model, the operating system version, the application version, the locale and, where notifications are enabled, a push token.
Account identifiers: the Valora user identifier and, where applicable, the subscription status, which determines the community features available.

Special categories of personal data (such as health, beliefs, political opinions or biometric data) are neither requested nor required. Users are asked not to publish such data concerning themselves or others in the community.

3. Purposes of processing and legal bases

Operation of the community: display of the profile and of content, composition of feeds, and delivery of likes, votes, follows and notifications. Legal basis: performance of the contract (Article 6(1)(b) GDPR; Article 5(2)(c) of Law No. 6698).
Safety of the community: automated and human moderation, measures against infringements, prevention of spam and fraud, rate limiting, and protection against abuse and manipulation. Legal basis: legitimate interests (Article 6(1)(f) GDPR; Article 5(2)(f) of Law No. 6698) and, in respect of illegal content, compliance with a legal obligation (Article 6(1)(c) GDPR; Article 5(2)(a) of Law No. 6698).
Handling of reports and appeals and notification of the parties concerned. Legal basis: compliance with a legal obligation and legitimate interests.
Evidence of acceptance of the community terms and defence of legal claims. Legal basis: compliance with a legal obligation and the establishment, exercise or defence of legal claims (Article 6(1)(c) and (f) GDPR; Article 5(2)(e) of Law No. 6698).
Compliance with orders of courts and competent authorities, including under Law No. 5651. Legal basis: compliance with a legal obligation.
Automatic translation of community content at the request of the user. Legal basis: performance of the contract.

4. Automated decisions and human review

Community content is examined by automated tools before and after publication, as described in the moderation and transparency notice. An automated system may withhold or remove content and place an account under review. Every such decision is reviewed by a person, the user is notified when a measure is applied, and the measure may be contested in the application within six months; appeals are decided by a human moderator. The rights to human intervention, to express a point of view and to contest the decision are therefore available at all times.

5. Recipients of the data

Other users: the profile and the content published by a user are public within the application, together with automatic translations thereof. Portfolio figures are shared only where the user elects to share them, and amounts may be hidden.
Processors: the hosting provider (Germany), Cloudflare (media delivery and the scanning of images against hash lists of known child sexual abuse material) and Google Firebase (push notifications). Translation and image analysis are performed on the provider's own servers; content is not transmitted to any third-party artificial-intelligence service for moderation or translation.
Authorities: where disclosure is required by law, and where content indicates a threat to life or safety or child sexual abuse.
Personal data is not sold, and community data is not used for advertising purposes.

6. International transfers

Community data is stored in Germany (European Union). Administration and moderation are carried out from Türkiye, where the provider is established; for the purposes of Law No. 6698 the data is therefore processed both in Türkiye and in the European Union. Where a processor processes data outside those locations, the transfer is based on that processor's standard contractual clauses and, where required by law, on the explicit consent of the data subject.

7. Retention periods

Profile and content: until deleted by the user or until the account is deleted.
Following deletion of the account: posts, comments and the profile are removed; replies of other users to a comment remain and are displayed as a deleted comment without the name of the author.
Moderation records and reports: retained for as long as required for appeals, for the assessment of repeated infringements and for legal claims.
Acceptance record: retained as evidence for up to ten years following deletion of the account, after which it is deleted automatically.
Rate-limiting keys and technical logs: short-lived, and they do not contain the IP address in readable form.

8. Rights of the data subject

Under Article 11 of Law No. 6698 and under the GDPR, data subjects have the right to:

ascertain whether their personal data is processed and request information in that regard;
request a copy of their data and, where applicable, its transmission to another controller;
request the rectification of incomplete or inaccurate data;
request the erasure of their data or of their account;
request the restriction of processing or object to processing based on legitimate interests;
request the reasons for an automated decision and a review by a person;
withdraw a consent previously given, without affecting the lawfulness of prior processing;
claim compensation for damage suffered as a result of unlawful processing.

These rights may be exercised by writing to help@krayir.xyz. Requests are answered within thirty days at the latest. An account may also be deleted by the user in the application at any time.

9. Complaints

A data subject who considers that their data has been processed unlawfully may lodge a complaint with the Personal Data Protection Authority of Türkiye or, in the European Union, with the supervisory authority of the Member State of their residence or place of work.

10. Children

The community is not intended for children. A community profile may be created only by a person who has the legal capacity to enter into the agreement in their country of residence.

11. Changes

This notice is updated when the community changes. The date shown above indicates the current version.

Summary: community profiles and posts are public within the application, community data is stored on servers in Germany, moderation and translation are performed on the provider's own servers, and an account may be deleted at any time.