This notice was prepared to inform you about the processing of your personal data under Devirly's services, pursuant to Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK"). Version 2.6 · September 20, 2026.
For communications and requests concerning personal-data processing within Devirly services, contact support@devirly.com or use the devirly.com support page. All requests under KVKK can be submitted through these channels; if a postal address is required for a written application, it will be provided to the applicant on request.
Identity and contact information (name, email, phone), account information, phone/email verification information, listing information, messaging records, support requests, report/complaint records, usage and transaction security records, purchase/credit information, and device/usage analytics data may be processed. In-app behavior data is also processed: which listings you view, save, message about or publish, and your search terms.
Data is processed for account management, identity/contact verification, publishing listings, messaging, support, security, fraud prevention, moderation of rule-violating listings, fulfilling legal obligations, managing purchase/credit entitlements, and improving service quality. To detect rule violations (e.g. third-party account/identity sales, password/OTP sharing), listing and message content is reviewed through automated (pattern-based and AI-assisted) and, where needed, human moderation; some infringing content may be blocked at send time. Moderation records are retained for a limited period for security and appeal processes. Your in-app behavior data (view, save, message, publish and search signals) is processed to build a profile of your interests; to order the home feed by that profile; and to notify you about new listings that may interest you and about a price drop on a listing you viewed, saved or messaged the seller about. These notifications are sent only where your in-app notification settings allow them and can be turned off there.
The listings you publish appear not only in the Devirly app but also on devirly.com, visible to visitors who are not signed in, and they may be indexed by search engines. Publicly visible: the listing title and description, category and subtopic, the asking price and the original price where applicable, the event date, venue, city and country, the photos you attached, your masked name as the seller (the first letters of your given name and the initial of your surname, for example "Bur*** Ç."), and where available your rating, review count, completed transaction count and phone-verification badge. Not present on the public surface: your full name, phone number, email address, profile photo, or the view and save counts of your listing. No one can contact you through that surface; contacting a seller is only possible from inside the Devirly app, while signed in. When your listing is sold or reaches its expiry date it stays visible for 60 days, marked as no longer available, so links shared earlier do not break. After that it is removed from the public surface. If you remove the listing yourself, if your account is suspended, or if you delete your account, the listing leaves the public surface immediately. Search engines and other third parties may retain copies of content they previously accessed; removing those copies is outside Devirly's technical control. You decide what your listing contains; we strongly advise against putting personal data or a readable barcode or QR code from your ticket into the description or the photos.
Data may be shared, limited to the purpose, with hosting, notification, analytics, error-tracking, and email/SMS providers, and with the store platforms that process in-app purchases (Apple App Store, Google Play); and with competent public authorities where legally required. Personal data is not sold to third parties for marketing.
Data is collected through the mobile app, website, API services, support channels, and user actions, by automatic or partly automatic means. Legal bases under KVKK Article 5 include the establishment and performance of a contract, the data controller's legitimate interest, compliance with a legal obligation, the establishment, exercise, or protection of a right, and explicit consent where required.
Data is retained for as long as the processing purpose requires and for applicable statutory retention periods; at the end of that period it is deleted, destroyed, or anonymized. Raw behavior signals are kept for at most 180 days; after that only a per-person, time-decaying summary interest score remains. When your account is deleted, your behavior data and interest profile are deleted with it. Account deletion and data export requests can be made in-app or through devirly.com.
You may request to learn whether your data is processed; obtain information if it has been; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred domestically or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under KVKK Article 7; request notification of these actions to transferred third parties; object to a result arising against you solely from analysis by automated systems; and claim compensation for damages caused by unlawful processing.
To exercise your rights, contact support@devirly.com or use the form on the devirly.com support page. Applications may require identity verification; additional information may be requested for security. Applications are resolved within the periods set by KVKK and applicable legislation.