KVKK Information Notice

1. Data Controller

Your personal data is processed by PİH Tasarım Mühendislik ve Üretim Danışmanlığı Ticaret Limited Şirketi ("Next Candle") as data controller under Turkish Personal Data Protection Law No. 6698 ("KVKK") within the scope described below.

• Legal name: PİH Tasarım Mühendislik ve Üretim Danışmanlığı Ticaret Limited Şirketi
• Registered address: Tomtom Mah. İstiklal Cad. Beyoğlu İş Merkezi Apt. No:187 İç Kapı No:147, Beyoğlu/İstanbul, Türkiye
• MERSIS No.: 0541050453200010
• Trade registry: Istanbul Trade Registry Office, No. 661095-0
• Tax office / Tax ID: Beyoğlu / 5410504532
• Email: nextcandle@upigai.com

2. Personal Data Processed

• Identity: Username, optional display name
• Contact: Email address; support correspondence
• Customer Transaction: Virtual-account trades, stop/target values and changes, risk and mode settings, alert events, Trading Journal answers, the feeling you choose when closing a trade by hand (only with your consent), report card, XP/level and NCP movements, Next AI questions and answers, trade-opening context (that minute's market conditions, the coin's prior movement, timing and plan-adherence measurements)
• Transaction Security: Password hash, two-factor authentication setting, session records, IP address, browser/device information, server logs; sign-up IP and device identifier hash to prevent invitation abuse
• Legal Transaction: 18+ declaration, acceptance records of the Terms of Use and Risk Disclosure (date, version, IP, device information); records of optional Trading Journal permissions (Next AI, Trader DNA)
• Marketing/Analytics (web only, with explicit consent): Page visits, click/scroll behaviour and masked session recordings

No special categories of personal data are processed. No payment or card details are collected.

3. Purposes and Legal Grounds

• Membership, sessions and provision of Platform services; virtual trading, discipline analysis, report card, XP/level and NCP calculations; generating Next AI answers — KVKK art. 5/2-c (establishment and performance of a contract)
• Account and information security, prevention of abuse and invitation fraud, service improvement — KVKK art. 5/2-f (legitimate interest)
• Keeping consent records and responding to requests from competent authorities — KVKK art. 5/2-ç (legal obligation) and art. 5/2-e (establishing, exercising or protecting a right)
• Usage measurement with analytics cookies on the website — KVKK art. 5/1 (explicit consent)
• Use of Trading Journal answers (and the feeling chosen when closing a trade by hand) by Next AI and adding them to the Trader DNA record — KVKK art. 5/1 (explicit consent; two separate permissions, can be withdrawn at any time in Settings > Privacy)
• Transfer to service providers located abroad — KVKK art. 9 (see section 5)

4. Method of Collection

Your personal data is collected electronically, by automatic or partly automatic means, through forms on the website and mobile apps, your use of the Platform, cookies and similar technologies, and email correspondence.

5. Transfers

Your personal data is transferred to the following recipients, limited to the purposes above:

• DigitalOcean, LLC — Singapore: Hosting, database and backups (all account and trading data)
• Resend — USA (EU sending region): Email delivery (email address and email content)
• Google LLC — USA and PostHog Inc. — EU (Frankfurt): Analytics data on the website only, with your explicit consent
• Competent public authorities: Where required by law

Live price data in the charts is fetched by your device directly from Binance's public servers; Binance may see your IP address during this. Transfers abroad are carried out in accordance with the procedures and safeguards set out in KVKK art. 9.

6. Retention Period

Personal data is kept for as long as required by the processing purpose and within legal retention obligations. When you delete your account, your data is deleted or anonymised; database backups are rotated within at most about 5 weeks. Data whose retention period has expired is deleted, destroyed or anonymised.

7. Your Rights under KVKK

Under Article 11 of KVKK, you have the right to:

• Learn whether your personal data is processed
• Request information if it has been processed
• Learn the purpose of processing and whether it is used in line with that purpose
• Know the third parties in Türkiye or abroad to whom it is transferred
• Request rectification if it is incomplete or inaccurate
• Request erasure or destruction under KVKK art. 7
• Request that rectification/erasure be notified to third parties to whom data was transferred
• Object to a result against you arising from analysis of the processed data exclusively by automated systems
• Claim compensation for damage caused by unlawful processing

8. Applications

To exercise your rights, send your request to nextcandle@upigai.com from the email address registered to your account, together with information that allows us to verify your identity. Requests are concluded free of charge within 30 days at the latest; if the process requires an additional cost, the tariff set by the Personal Data Protection Board may apply. You can permanently delete your account and personal data yourself in the app via Settings > Privacy > Delete account.