KVKK Notice — Personal Data Protection

Effective date: August 25, 2026

This notice describes how Aquila Labs LLC ("Wair", "we", "us"), operating from Sheridan, WY 82801, USA, processes personal data of users located in Türkiye, in accordance with Law No. 6698 on the Protection of Personal Data ("KVKK").

Note: Wair is operated from the United States. KVKK applies where we process personal data of data subjects located in Türkiye. This notice supplements our global Privacy Policy.

1. Data controller

• Controller: Aquila Labs LLC
• Address: Sheridan, WY 82801, USA
• Contact: support@wair.llc

Aquila Labs LLC is established outside Türkiye. For correspondence in Turkish, please email support@wair.llc and we will respond in Turkish where reasonably practicable.

2. Personal data we process

We may process the following categories of personal data:

• Identity & contact data: name, email address (when you contact us or create an App account).
• Wardrobe & visual data (App): photographs of clothing items you upload, and automatically generated metadata derived from them (categories, colors, styles).
• Technical data: IP address, device model, operating system, app version, language preference (NEXT_LOCALE cookie), crash logs.
• Communication data: the content of messages you send via the contact form or support email.
• Advertising and attribution data (App): on Android, your Google Advertising ID and the Play Install Referrer; on iOS, anonymous campaign-level SKAdNetwork reports only (we do not collect the IDFA).
• Product links (App): links to clothing items that you paste into or share with the App so that the item can be added to your wardrobe.

3. Purposes and legal grounds (KVKK Article 5)

Where we rely on explicit consent (e.g., processing of biometric-like visual data in your wardrobe photographs), you may withdraw consent at any time by deleting your account or emailing support@wair.llc.

4. Transfers abroad (KVKK Article 9)

Aquila Labs LLC is established in the United States, and our service providers are established outside Türkiye — primarily in the United States — and operate on global infrastructure. Your personal data — including any wardrobe photographs you upload — is therefore transferred outside Türkiye and processed in the United States and on our providers' global infrastructure.

Your photographs are stored on Cloudflare's infrastructure regardless of where you are located. We do not offer, and cannot guarantee, storage in Türkiye or in any other specific country or region.

The third parties abroad to whom your personal data may be transferred are:

All of these recipients are established outside Türkiye, so your personal data is transferred abroad — primarily to the United States — and processed on global infrastructure. If you want to know the country in which a particular recipient is established, email support@wair.llc and we will tell you.

Legal basis for the transfer

The United States is not on the list of countries with adequate protection published by the Turkish Personal Data Protection Board ("Kurul"). We do not rely on an adequacy decision, and we do not rely on a certification scheme.

We rely on your explicit consent under KVKK Article 9/1. By creating an account and using Wair, you expressly consent to your personal data — including your photographs — being transferred abroad and processed as described in this section.

You may withdraw this consent at any time by deleting your account (see How to delete your account) or by emailing support@wair.llc. Withdrawing your consent means we can no longer provide the App to you, because the service cannot be operated without these transfers.

Separately from the legal basis above, we protect transferred data with encryption in transit (TLS), encrypted-at-rest storage, and least-privilege access controls.

5. Retention

• Contact form and support correspondence: kept as a record of our correspondence for as long as we operate the service. It is not deleted automatically; we delete it on your request.
• App account data: kept while the account is active; deleted within 30 days of your deletion request.
• Technical and crash logs: kept for as long as they are needed for security, fraud prevention, and troubleshooting.
• Advertising and attribution data: kept by AppsFlyer under our agreement with them; where a record can be linked to your account, it is deleted with your account.

6. Your rights under KVKK Article 11

You have the right to:

• Learn whether your personal data is being processed
• Request information about the processing, if any
• Learn the purpose and whether it is used in accordance with the purpose
• Know the third parties (domestic or abroad) to whom data has been transferred
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of your data
• Request notification of correction/deletion to third parties to whom data was transferred
• Object to results derived solely from automated analysis
• Claim compensation for damages caused by unlawful processing

To exercise any of these rights, send a written request to support@wair.llc with sufficient identifying information so we can locate your records. We will respond within 30 days as required by Article 13 of KVKK.

If you are not satisfied with our response, you may file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) in Türkiye.

7. Security measures

• TLS encryption for all data in transit
• Encrypted-at-rest storage on Supabase
• Role-based access control with least-privilege defaults
• Logging and monitoring of access to personal data
• Regular review of vendor security practices

8. Children

The App is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have, please contact support@wair.llc.

9. Changes to this notice

We may revise this notice as our processing activities or KVKK guidance evolve. The "Effective date" at the top reflects the most recent revision.

10. Contact

Aquila Labs LLC Sheridan, WY 82801, USA Email: support@wair.llc