Effective date: March 17, 2026

1. DATA CONTROLLER

This Privacy Policy explains how personal data is collected, used, stored, and protected by HAN YAZILIM BILISIM HIZMETLERI ALI ANIL CAN (“Pasaj”, “we”, “us”, “our”) when you use the Pasaj mobile application.

For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”), Pasaj acts as the Data Controller.

2. DATA WE COLLECT

We collect personal data through third-party authentication providers and through your direct interaction with the Pasaj application.

Authentication Data

• Unique user identifier (UID)
• First name and last name
• Email address (Provided via Google or Apple Sign-In)

Profile Data

• Profile photo
• Display name

User-Generated Content

• Book images
• Book titles, authors, and descriptions uploaded by you

Device & Technical Data

• Device model
• Operating system version
• Firebase Cloud Messaging (FCM) notification tokens

Usage Data

• Interaction logs
• Feature usage and activity events (Collected to improve app reliability, performance, and user experience)

We do not intentionally collect sensitive personal data.

3. HOW WE USE YOUR DATA

Your personal data is processed only where legally permitted and for the following purposes:

Service Provision

• Creating and managing user accounts
• Enabling book listings and exchanges between users

Content Moderation

• Reviewing uploaded content for safety, accuracy, and compliance using automated systems

Notifications

• Sending transactional and service-related notifications via Firebase Cloud Messaging (FCM)

Security & Fraud Prevention

• Detecting spam, abuse, unauthorized access, and other malicious activity

Analytics & Improvements

• Monitoring app performance
• Improving usability, stability, and features

All processing is based on one or more lawful grounds under GDPR, including contract performance, legitimate interests, legal obligations, and user consent where required.

4. THIRD-PARTY DATA PROCESSORS

We use trusted third-party service providers that process data on our behalf under strict contractual and security obligations:

Google Cloud Platform & Firebase

• Firestore database
• Cloud Storage
• Cloud Functions
• Firebase App Check
• Firebase Cloud Messaging (FCM)

Google Vertex AI

• Automated content moderation
• Metadata analysis and extraction

Apple & Google

• User authentication (Sign in with Apple / Google)
• Subscription and in-app purchase processing (where applicable)

These providers act as data processors and only process data according to our instructions.

5. DATA RETENTION

Active Accounts Personal data is retained for as long as your account remains active.

Account Downgrades Excess data may be restricted but retained to allow future restoration.

Account Deletion Upon deletion request, personal data is permanently deleted or anonymized within 30 days, unless legal obligations require longer retention.

6. INTERNATIONAL DATA TRANSFERS

Your data may be processed and stored in data centers located in the European Union and the United States through Google Cloud services.

Where required by law, appropriate safeguards are applied, including Standard Contractual Clauses (SCCs) or equivalent mechanisms to ensure adequate data protection.

By using Pasaj, you acknowledge and consent to these transfers where legally permitted.

7. YOUR PRIVACY RIGHTS

Depending on your location, you may have the following rights under GDPR, CCPA/CPRA, and other applicable laws:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Withdraw consent at any time (where processing is based on consent)
• Object to or restrict certain processing activities
• Request data portability (GDPR)
• Opt out of the sale or sharing of personal data (Pasaj does not sell personal data)

To exercise your rights, contact us at: support@pasaj.io

We may require identity verification before fulfilling requests.

8. DATA SECURITY

We implement appropriate technical and organizational measures to protect your data, including:

• Firebase App Check
• Secure authentication mechanisms
• Restricted API keys
• Access controls and monitoring

Despite these measures, no system can be guaranteed to be 100% secure.

9. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes will be communicated through in-app notifications or other appropriate means.

Continued use of Pasaj after updates constitutes acceptance of the revised policy.

10. CONTACT INFORMATION

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

HAN YAZILIM BILISIM HIZMETLERI ALI ANIL CAN
Email: support@pasaj.io