Personal Data Protection Notice

Version: 2026-10-11

1. Data Controller

Under Article 10 of the Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed, within the scope described below, by FIST Teknoloji Limited Şirketi ("FIST Teknoloji", "Raudio", "we") as data controller.

• Title: FIST Teknoloji Limited Şirketi
• Head office address: Ayazağa Mah. Kemerburgaz Cad. Vadi İstanbul Park 7A Blok No: 7B İç Kapı No: 4, Sarıyer / İstanbul
• Trade Registry No: 1050991 (Istanbul Trade Registry)
• MERSIS No: 0387141311500001
• Tax Office / No: Maslak Tax Office / 3871413115
• Registered Electronic Mail (KEP) address: fistteknoloji@hs01.kep.tr
• Contact e-mail: raudio.destek@fistteknoloji.com
• Website: https://fistteknoloji.com

2. Personal Data Processed

Raudio processes only the data listed below. No data that is not in the list is collected.

Account (required)

• Your e-mail address and password. Your password is stored one-way encrypted; no one, including us, can read it.
• If you use "Continue with Apple", the first name, last name and e-mail address that Apple shares (with "Hide My Email", Apple gives you a private relay address).
• First and last name in the sign-up form.
• Optionally, your mobile phone number in the sign-up form (those who use "Continue with Apple" are asked in the profile step). If you do not give a number, you can still recover your account with the code sent to your e-mail address alone. A phone number you give is used only as an extra check, when you reset your password, in addition to your e-mail address (matching it with the number on record); you are not called, no SMS is sent to you, and the number is not shared with anyone.
• Your account's user ID (a random number generated by the system).

Profile (optional)

• The name we address you by, last name and city. City is optional and can be left blank. City is used to match you with nearby content, to produce aggregate statistics such as how many users we have in which cities and to plan campaigns and discounts accordingly, and, if you turned on the "Dinleme alışkanlıklarım" ("My listening habits") preference, to analyze your listening events together with your city. You can delete it at any time by clearing the city field on the profile card in Settings.
• Gender and form of address (Bey, Hanım, Hanımefendi, Efendim, Abi, Abla; in Türkiye also Aga and Aşko). Used only to determine how you want bulletins and greetings to address you.

Driving habits (optional)

• How many days a week you drive (between 1 and 7).
• Your typical driving time (morning, evening or varies).

Preferences and content

• The topics you choose and the custom topics you add (the RSS link or topic title you type).
• Your bulletin length, style, topic depth and Smart Routine setting (time, days, time zone), and the bulletins pre-planned for you for Smart Routine.
• Bulletins created for you and the sections you saved.
• Use of your daily text-to-speech quota (how many characters were voiced).

Consent records

• Which version of this text you read and when.
• Whether your "listening habits" and "e-mail" preferences are on or off and when they were changed; whether the listening-habits permission was given in the sign-up form or in Settings.

Only with your explicit consent: listening events

• If you tick the optional box "I agree to my listening habits being used to improve bulletins" in the sign-up form, or later turn on the "Dinleme alışkanlıklarım" ("My listening habits") preference in Settings: whether you finished or skipped a section, and the ID and time of the section, bulletin and topic. The text or audio of the section is not added to this record.

Security records

• For sign-up and password-reset requests, to prevent abuse (brute-force attempts, e-mail flooding), a one-way encrypted (hash) digest of your e-mail address and network address (IP) and the time of the request are stored; the addresses themselves are not stored. These records are deleted automatically within 24 hours at the latest.

Data that stays on your device

• Your Home and Work locations and the places you recently went to are stored only on your device and are not sent to our servers.
• If the "Dinleme alışkanlıklarım" ("My listening habits") permission is on, the information about which topic you listened to, for how long, with which narrator and at what time of day, for the "En Sevdiğin Konular" ("Your Favorite Topics") card in the Profile tab, is stored only on your device and is not sent to our servers. This data is deleted when you turn the permission off, delete your listening records, sign out or delete your account.
• The coordinates of your current location are used on your device only when you say "Konumumu kullan" ("Use my location"), while route time is calculated and while a bulletin plays with voice alerts on; they are not sent to our servers. Address search and route calculation are done with Apple Maps and are subject to Apple's own privacy terms.
• When the weather is shown for your journey and when a driving alert is given for rain, ice, fog or strong wind, the coordinates of your current location and, if you chose a route, of the destination are sent to Apple's weather service (WeatherKit); they are not sent to our servers. The result is stored on your device for 6 hours and is not queried again during that time.
• If voice alerts are on, the text to be spoken in the alert (for example the name of your destination, the name of a nearby car park, the headline of a breaking news item) is sent to our servers and to ElevenLabs to be turned into speech. This text is not stored. Your coordinates are not sent.

3. Purposes of Processing

• Creating your account, enabling you to sign in and confirming your e-mail address.
• When you recover your account after forgetting your password, if you gave a phone number, checking in addition to your e-mail address that your number matches the number on record (account security).
• Preventing abuse of sign-up and password-reset requests (brute-force attempts, e-mail flooding).
• Addressing you by your name and chosen form of address, and preparing and reading aloud a driving bulletin personalized to your preferences.
• Showing the weather for your journey and giving a spoken driving alert if there is rain, ice, fog or strong wind.
• Keeping your bulletins and saved items across your devices, and preparing the bulletin in advance for Smart Routine.
• Producing aggregate statistics that do not identify you, using your city (for example how many users come from which cities), and planning campaigns and discounts accordingly.
• Only if you consent: analyzing your listening events together with your city to improve bulletins; sending e-mails about news, suggestions, campaigns and discounts.
• Fulfilling our legal obligations and ensuring the security of the service.

Your data is not sold, not rented, and not shared for advertising or profiling. Raudio does not track you across apps and websites.

4. Method of Collection and Legal Basis

Your data is collected directly from you through the app, by electronic means. Processing is based on the following grounds under Article 5 of the KVKK:

• Establishment and performance of a contract: account, preferences, preparing bulletins and reading them aloud.
• Explicit consent: listening events and news e-mails. These two consents are separate from each other and from your confirmation that you read this text, are off by default and can be withdrawn at any time. Consent for listening events is given by ticking the optional box in the sign-up form or by turning the preference on in Settings; the box starts unticked and consent is not deemed given unless you tick it.
• Legal obligation and legitimate interest: cases required by legislation, ensuring the security of the service and your account (including, if a phone number was given, matching the number when a password is reset) and producing aggregate statistics that do not identify you; this interest does not harm your fundamental rights and freedoms. Analysis of listening events on an individual basis and sending direct e-mail, however, rely solely on your explicit consent.

5. To Whom Data Is Transferred

Your data is shared with the service providers below, only to the extent needed to provide the service. Your account's user ID is not sent to providers other than Supabase and Apple. Your phone number is stored only on Supabase; it is not sent to any other provider.

• Supabase: database, authentication, file storage and server functions. All of your account data is stored here.
• Google (Gemini): the artificial intelligence service that writes the bulletin text from news text. Sent: topic names, publicly available news headlines and texts, the custom topic text you add, the bulletin length and narrator style, and, if the bulletin will address you, your name and form of address. Your e-mail address and last name are not sent.
• ElevenLabs: turning the bulletin and alert text into speech. Sent: the text to be voiced; this text may contain your name and form of address, and in alerts the name of a destination or car park. Your e-mail address and last name are not sent.
• Resend: sending account confirmation and password e-mails. Sent: your e-mail address and the content of the e-mail.
• Apple: "Continue with Apple", address search, route calculation and weather (WeatherKit). When you delete your account, your link with Apple is revoked.
• Google News and Google Suggest: to get suggestions for the text you type when adding a topic and to find current news on your topic. Topic text is sent to these services from your device and from our servers; your identity is not sent.

Apart from lawful requests of authorized public bodies, your data is not shared with anyone other than the above.

6. Transfer Abroad

The servers and headquarters of the service providers above are outside Türkiye. Your personal data is therefore transferred abroad under Article 9 of the KVKK:

• Supabase (headquartered in the USA): your data is stored on servers in Germany (Frankfurt).
• Google (USA): the artificial intelligence service, Google News and Google Suggest.
• ElevenLabs (USA): speech.
• Resend (USA): sending e-mail.
• Apple (USA): Sign in with Apple, Maps and weather.

Because these transfers are continuous, they are made, under Article 9 of the KVKK, to countries with an adequacy decision or on the basis of appropriate safeguards such as the standard contract published by the Personal Data Protection Board. [TO BE VERIFIED: signing of the standard contracts and notification status to the Authority]

Bulletins cannot be prepared or read aloud without these service providers; the scope of the transfer is stated clearly above. If you do not want the transfer, you can delete your account with "Hesabı sil" ("Delete account") in Settings.

7. Commercial Electronic Message Permission

If you turn on the "Yenilik e-postaları" ("News e-mails") preference, we may send commercial electronic messages about news, suggestions, campaigns and discounts to your e-mail address on behalf of FIST Teknoloji Limited Şirketi, in accordance with the Law No. 6563 on the Regulation of Electronic Commerce.

• This permission is optional; it is not a condition of opening an account or using the service and it is off by default.
• You can turn the permission off at any time, without giving a reason and free of charge, in the "Tercihlerin" ("Your preferences") section in Settings. After you turn it off, no commercial messages are sent to you.
• Account confirmation, password and security e-mails are not commercial messages; they are sent as a requirement of the service.

8. Children and Age Limit

Raudio is not directed at children. People below the age rating stated on the App Store should not use Raudio, and we do not knowingly collect personal data from them. If we notice the account of such a user, we delete the account and its data. If you are under 18, turn on the preferences that require explicit consent (listening habits, news e-mails) only with the knowledge and approval of your legal guardian.

9. Retention Period

Your data is kept for as long as the purpose of processing requires, that is, as long as your account is open. When you delete your account with "Hesabı sil" ("Delete account") in Settings, your profile, preferences, bulletins, saved items, listening events and audio files are permanently deleted from our servers; if you signed in with Apple, your link with Apple is also revoked. Copies in database backups are deleted automatically within the backup cycle.

• Bulletins (text and audio) are deleted automatically within 7 days at the latest after they are created, together with the bookmarked sections of that bulletin. Text copies you saved with "Bülteni kaydet" ("Save bulletin") (up to 50) are deleted automatically 90 days after they are saved, unless you delete them earlier.
• Security records (hash digest of the e-mail and network address, request time) are deleted automatically within 24 hours at the latest.
• You can also delete your listening events without deleting your account, with "Dinleme kayıtlarımı sil" ("Delete my listening records") in Settings.

10. Your Rights and How to Apply

Under Article 11 of the KVKK you have the following rights:

• To learn whether your personal data is processed and, if it is, to request information.
• To learn the purpose of processing and whether it is used in line with that purpose.
• To know the third parties to whom data is transferred in Türkiye or abroad.
• To request correction if it is incomplete or inaccurate.
• To request deletion or destruction under Article 7 of the KVKK.
• To request that correction and deletion be notified to third parties to whom data was transferred.
• To object to a result against you arising from the analysis of the processed data exclusively by automated systems.
• To request compensation for damage if you suffer damage because of unlawful processing.

You can use most of these rights from within the app: in Settings you can view the data stored about you and correct your profile on the profile card, turn the two preferences on and off at any time in the "Tercihlerin" ("Your preferences") section, download your data as JSON with "Verilerimi indir" ("Download my data") and delete your account with "Hesabı sil" ("Delete account").

You can send your other requests, together with information that helps us verify your identity, in the following ways:

• By e-mail, from the e-mail address registered in the app, to raudio.destek@fistteknoloji.com,
• To the KEP address fistteknoloji@hs01.kep.tr,
• In writing to our head office address above.

Your application is concluded free of charge within thirty days at the latest, depending on the nature of the request; if the process requires a separate cost, a fee according to the tariff set by the Personal Data Protection Board may be charged. If you find the reply insufficient, you may file a complaint with the Personal Data Protection Board within thirty days of learning the reply and in any case within sixty days of the date of application.

11. Security

Your data is protected in transit with TLS. Each user can access only their own data (row-level access control at the database level). Passwords are stored in irreversible form. If your personal data is obtained unlawfully, the necessary notifications are made to the Board and to the people affected under Article 12 of the KVKK.