REDFLAG AI
GLOBAL PRIVACY POLICY, COOKIE POLICY AND KVKK COMPREHENSIVE INFORMATION NOTICE
Effective Date: October 11, 2026
Last Updated: October 11, 2026

CRITICAL LEGAL NOTICE AND DISCLAIMER: THE REDFLAG AI MOBILE APPLICATION UTILIZES ADVANCED PROBABILISTIC ARTIFICIAL INTELLIGENCE MODELS TO PROCESS USER-PROVIDED DATA AND GENERATE RELATIONAL INSIGHTS. THIS IS AN ANALYSIS GENERATED BY ADVANCED AI; IT DOES NOT POSSESS SCIENTIFIC VALIDITY. THE APPLICATION DOES NOT PERFORM BIOMETRIC IDENTITY VERIFICATION, FACIAL RECOGNITION, OR PSYCHOLOGICAL DIAGNOSIS. BY USING THE APPLICATION, YOU EXPRESSLY ACCEPT ALL TERMS CONTAINED IN THIS COMPREHENSIVE PRIVACY POLICY.

This Comprehensive Global Privacy Policy and Personal Data Protection Notice (“Privacy Policy”) governs how OKSO TECH YAPAY ZEKA YAZILIM MÜHENDİSLİK VE DIŞ TİCARET LİMİTED ŞİRKETİ (“OKSO TECH”, “Company”, “we”, “us”, or “our”) collects, processes, stores, shares, and safeguards personal data when you (“User”, “you”) access, download, or use the RedFlag AI mobile application, website, and related services (collectively, the “Application”).

This document is meticulously drafted to comply fully with the Turkish Personal Data Protection Law No. 6698 (“KVKK”), the European Union General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act / California Privacy Rights Act (“CCPA/CPRA”), and other applicable international data privacy frameworks. If you do not agree with any provision of this Privacy Policy, you must immediately cease all use of the Application.

1. DATA CONTROLLER IDENTITY AND CONTACT DETAILS
For the purposes of applicable data protection laws, including KVKK and GDPR, the Data Controller determining the purposes and means of processing your personal data is:
Company Name: OKSO TECH YAPAY ZEKA YAZILIM MÜHENDİSLİK VE DIŞ TİCARET LİMİTED ŞİRKETİ
Registered Address: Esentepe Mah. Büyükdere Cad. Ferko Signature No: 175 İç Kapı No: 6 Şişli/İstanbul, Türkiye
Contact Email: corporate@oksotech.com
Contact Telephone: +90 850 308 2015
Website: https://oksotech.com

2. NATURE OF THE ARTIFICIAL INTELLIGENCE ANALYSIS AND ABSOLUTE DISCLAIMER
The Application processes user-supplied inputs (including text, relationship details, astrological parameters, and photographs) through advanced algorithmic models to generate personalized insights. You explicitly acknowledge and agree that:
THIS IS AN ANALYSIS GENERATED BY ADVANCED AI; IT DOES NOT POSSESS SCIENTIFIC VALIDITY.
Outputs are probabilistic, subjective, and generated for personal engagement. OKSO TECH assumes zero liability for any personal, emotional, psychological, relational, or real-world outcomes (including arguments, breakups, divorces, reputational damage, or emotional distress) resulting from your interpretation or reliance upon the AI-generated outputs. The Application is not a lie detector, forensic tool, or psychological diagnostic service.

3. CATEGORIES OF PERSONAL DATA COLLECTED
We collect only the minimum data necessary to deliver the Application’s core functionality, execute in-app purchases, and maintain system security. Depending on your interactions, we may collect:

• User-Provided Inputs: The names you enter for yourself and your partner, gender, zodiac signs, relationship status, answers to the questionnaire, and behavioral descriptions voluntarily submitted by you.
• Photographic Data: Images uploaded by you for the purpose of receiving AI-driven relational commentary. A face-detection check runs on your device to confirm that each photo contains a clear face; the resulting signals (such as smile, head tilt and whether the eyes are open) are sent with your request. We also store a visual fingerprint (perceptual hash) of each photo, used only to detect duplicate photos and keep results consistent.
• Analysis Results: The scores and AI-generated texts produced for your analysis, and a record of the consent you gave (version and time).
• Device and Technical Data: A random identifier generated by the app (not an advertising identifier), IP address (used for security and abuse prevention), app language, time zone, the country of your app store account as reported by Apple or Google, and anonymous app interaction events (such as screens viewed and purchase events). We do not collect IDFA or AAID advertising identifiers.
• Notification Data: If you enable weekly zodiac notifications, a push notification token (Firebase Cloud Messaging) and your selected zodiac pair. You can turn notifications off at any time in Settings.
• Feedback and Reports: The rating and comment you optionally give in the satisfaction survey, and any report you submit about AI-generated content.
• App Store / Play Store Transaction Data: Purchase receipts, purchase tokens, transaction IDs and consumable purchase status, provided strictly by Apple App Store or Google Play Store. We DO NOT collect, process, or store your raw credit card numbers, banking passwords, or direct financial credentials.

4. LEGAL BASES FOR PROCESSING PERSONAL DATA
We process your personal data exclusively under valid legal grounds recognized by KVKK (Article 5 and 6) and GDPR (Article 6), including:

• Performance of a Contract: Processing data necessary to deliver the Application, execute your purchases, and generate requested AI analyses.
• Explicit Consent: Where required by law (e.g., specific optional data processing), we obtain your clear, affirmative consent.
• Legitimate Interests: Processing telemetry and crash data to ensure app stability, prevent fraud, secure infrastructure, and improve our proprietary AI models, provided such interests are not overridden by your fundamental rights.
• Legal Obligations: Retaining financial and transaction records to comply with tax laws, corporate regulations, and lawful binding requests from judicial or regulatory authorities.

5. THIRD-PARTY PHOTOGRAPHS AND STRICT USER LIABILITY (UNCONSENTED UPLOADS SHIELD)
The Application permits users to upload photographs for relational analysis. If you upload a photograph containing the face, likeness, or personal data of another individual (a “Third Party”), you act as the independent data controller for that upload, while OKSO TECH acts solely as a technical data processor.
YOUR ABSOLUTE LEGAL OBLIGATION: By uploading any Third-Party photograph, you represent, warrant, and covenant that you have obtained prior, explicit, informed, and verifiable legal consent from that individual to have their image processed by AI, in full compliance with KVKK, GDPR, and privacy laws.
TOTAL LIABILITY SHIFT: OKSO TECH strictly prohibits the malicious, unauthorized, or non-consensual uploading of another person’s photograph (“habersiz yüz analizi”). If any Third Party initiates a claim, complaint, legal proceeding, or lawsuit against OKSO TECH alleging privacy violations, defamation, or unauthorized processing of their image, YOU agree to fully indemnify, defend, and hold OKSO TECH harmless from all resulting damages, fines, settlements, and legal expenses. OKSO TECH disclaims 100% liability for your unlawful uploading of Third-Party content.

6. STRICT BIOMETRIC DATA DISCLAIMER (BIPA AND GDPR SAFE HARBOR)
To protect our users and comply with strict biometric laws (such as the Illinois Biometric Information Privacy Act – BIPA, GDPR, and KVKK):

• The Application does not collect, extract, generate, synthesize, or store Biometric Identifiers or Biometric Templates (such as facial geometry scans, faceprints, or iris scans) intended to uniquely identify a specific human being.
• The Application is not a facial recognition system, biometric surveillance tool, police database, or identity authentication platform.
• Uploaded photographs are transmitted via secure APIs to our cloud AI infrastructure solely for immediate, transient text generation regarding subjective traits. Once the text analysis is returned to the User, the photograph is not indexed into an identifying facial database, nor is it retained for facial mapping.
• A visual fingerprint (perceptual hash) of each photo is stored only to detect duplicate photos and keep results consistent; it is not a facial template and cannot be used to identify a person.

7. DATA SHARING, PROCESSORS, AND INTERNATIONAL TRANSFERS
We do not sell your personal data. To deliver the service, your data is processed by the following trusted providers, each bound by confidentiality and data processing agreements:

• Cloud Infrastructure Provider: Google Firebase / Google Cloud Platform (GCP) for database storage, photo storage, hosting, push notifications and backend architecture. Photo and database storage is located in Frankfurt, Germany (European Union).
• Artificial Intelligence API Provider: Anthropic PBC (Claude AI model, United States), used exclusively to parse your photos and answers and generate text analyses. This enterprise partner is contractually prohibited from using your uploaded photographs to train public or commercial AI models.
• Payment Gateways: Apple App Store and Google Play Store for transaction handling and purchase verification. We do not receive or store your payment card details.

By using the Application, you acknowledge and consent to the transfer of your data to servers located outside of your country of residence (including the United States and the European Union), protected by contractual safeguards and encryption in transit. We do not use advertising identifiers and do not share your data for advertising purposes.

8. DATA RETENTION AND SECURE DESTRUCTION
Photographs you upload are stored in Google Cloud Storage in Frankfurt (EU) for up to 90 days from the date of analysis and are then automatically and permanently deleted. A copy of your photos is also kept only on your device (in the app’s private cache, excluded from backups) so that results can be displayed; it is removed when you delete your data or uninstall the app.
Analysis records (names you entered, zodiac signs, questionnaire answers, scores, AI-generated texts) and a visual fingerprint (perceptual hash) of each photo are retained until you delete them using “Settings → Delete My Data” in the app, or until you request deletion by writing to corporate@oksotech.com. Deleted files may remain in Google Cloud backup systems for a limited period before final destruction.

9. USER RIGHTS UNDER KVKK (ARTICLE 11) AND GDPR (CHAPTER III)
Depending on your geographical jurisdiction, you possess robust statutory rights regarding your personal data, including the right to:

• Confirm whether your personal data is being processed and request information regarding such processing.
• Access your personal data and obtain a copy of the processed records.
• Request the rectification or correction of inaccurate, incomplete, or outdated data.
• Request the deletion, destruction, or anonymization of your personal data (“Right to be Forgotten”).
• Request the restriction of data processing under specific statutory circumstances.
• Object to processing operations based on legitimate interests or automated decision-making.
• Request the transfer of your data to another controller in a structured, commonly used, machine-readable format (Data Portability).
• Lodge a formal complaint with a competent supervisory authority (such as the Personal Data Protection Authority in Türkiye – KVKK, or EU data protection authorities).
• You can delete your photos, analyses and notification records at any time in the app under Settings → Delete My Data. You can withdraw your explicit consent at any time by doing so or by writing to corporate@oksotech.com; withdrawal does not affect processing carried out before it.

To exercise any of these rights, you may submit a formal request to our dedicated privacy channel at corporate@oksotech.com. We will respond free of charge within 30 days maximum, subject to identity verification.

10. AUTOMATED DECISION-MAKING AND PROFILING
The Application utilizes automated algorithms and artificial intelligence models to generate insights based on user inputs. However, these automated outputs do not produce legal effects concerning you, nor do they significantly affect you in a legal or similarly critical manner. They are generated strictly for entertainment, personal reflection, and informational purposes as explicitly stated in these terms.

11. COOKIES AND TRACKING TECHNOLOGIES POLICY
Our website (https://oksotech.com) and associated web interfaces may utilize standard cookies, web beacons, and local storage technologies to enhance user experience, analyze traffic, and remember user preferences. You have the right to configure your web browser to refuse cookies or alert you when cookies are being sent; however, disabling cookies may impair certain features of our web services.

12. CHILDREN’S AND MINORS’ PRIVACY
The Application is intended strictly for individuals aged 18 and older (or the legal age of majority in their applicable jurisdiction). We do not knowingly collect, solicit, or process personal data from minors under 18. If we discover or receive verified notice that a minor has submitted personal data to the Application, we will immediately terminate the account and purge all associated records from our servers.

13. ENTERPRISE-GRADE DATA SECURITY MEASURES
We implement robust technical, organizational, and physical security safeguards designed to protect personal data against accidental loss, unauthorized access, destruction, misuse, or alteration. These measures include industry-standard HTTPS/TLS encryption for data in transit, encrypted database storage for data at rest, strict access controls, and regular security reviews. Notwithstanding these precautions, no electronic transmission over the internet or storage system can be guaranteed to be 100% secure.

14. DATA BREACH NOTIFICATION PROCEDURES
In the unlikely event of a security breach compromising your personal data in a manner that poses a high risk to your rights and freedoms, OKSO TECH will notify the relevant supervisory authorities (such as KVKK or EU regulators) without undue delay in accordance with statutory deadlines, and will notify affected users where legally required, detailing mitigation steps taken.

15. THIRD-PARTY LINKS AND EXTERNAL SERVICES
The Application may contain links to third-party websites, social media platforms, or external services not operated by OKSO TECH. We assume no responsibility or liability for the privacy practices, content, or security of such third-party services. We encourage you to review the privacy policies of any external platform you visit.

16. MODIFICATIONS AND UPDATES TO THIS PRIVACY POLICY
We reserve the right to modify, amend, or update this Privacy Policy at our sole discretion at any time to reflect legal changes, technological advancements, or operational updates. The “Last Updated” date at the top of this policy indicates the effective date of the latest revision. Your continued use of the Application following the posting of changes constitutes your binding acceptance of such modifications.

17. CALIFORNIA AND US STATE PRIVACY RIGHTS (CCPA/CPRA)
If you are a resident of California or states with equivalent privacy laws, you possess specific rights regarding the disclosure of your personal information to third parties for direct marketing purposes. We do not sell or rent your personal data to data brokers. You have the right to request disclosure of the categories and specific pieces of personal information collected, as well as the right to request deletion.

18. GRIEVANCE MECHANISM AND DISPUTE RESOLUTION
If you have any grievances, complaints, or inquiries regarding our data handling practices, you agree to first contact our privacy team at corporate@oksotech.com to seek an informal resolution. We are committed to resolving your concerns promptly and transparently.

19. GOVERNING LAW AND JURISDICTION
This Privacy Policy shall be governed by, construed, and enforced in accordance with the laws of the Republic of Türkiye, without regard to conflict of law principles. Any legal action, dispute, or claim arising out of or relating to this Privacy Policy shall be submitted to the exclusive jurisdiction of the courts and execution offices located in Istanbul (Çağlayan), Türkiye, unless mandatory consumer protection laws dictate otherwise.

20. SEVERABILITY OF PRIVACY CLAUSES
If any provision, paragraph, or clause of this Privacy Policy is found by a court of competent jurisdiction to be invalid, illegal, or unenforceable, that specific provision shall be deemed severed or narrowed to the minimum extent necessary, and the remaining provisions shall continue in full force and effect.

21. NO WAIVER OF RIGHTS
Any failure or delay by OKSO TECH in enforcing any right or provision under this Privacy Policy shall not constitute a waiver of such right or provision, nor shall it prevent any future enforcement.

22. ENTIRE AGREEMENT REGARDING PRIVACY
This Privacy Policy, together with our Terms of Service (EULA), constitutes the entire legal agreement between you and OKSO TECH regarding the privacy, collection, and processing of your personal data within RedFlag AI.

23. LANGUAGE OF INTERPRETATION
This Privacy Policy may be translated into various languages for user convenience. In the event of any ambiguity, discrepancy, or conflict between the English text and any translated version, the English version shall govern and control to the maximum extent permitted by applicable law.

24. FORCE MAJEURE (DATA EXEMPTIONS)
OKSO TECH shall not be held liable for any failure to perform its privacy obligations or secure data if such failure stems from events beyond its reasonable control, including natural disasters, acts of war, cyberattacks, global infrastructure failures, telecommunication grid outages, or governmental restrictions.

25. OFFICIAL PRIVACY CONTACT CHANNEL
For any formal inquiries, legal service of process, data access requests, or privacy compliance questions, please contact our Data Protection Officer directly at:
Company: OKSO TECH YAPAY ZEKA YAZILIM MÜHENDİSLİK VE DIŞ TİCARET LİMİTED ŞİRKETİ
Email: corporate@oksotech.com
Address: Esentepe Mah. Büyükdere Cad. Ferko Signature No: 175 İç Kapı No: 6 Şişli/İstanbul, Türkiye
Telephone: +90 850 308 2015