← Back to Home

Data Processing Agreement

Last Updated: December 17, 2025

Data Processing Transparency: This agreement outlines how BondAlchemy processes your personal data under GDPR, CCPA, and other privacy regulations. Your journal, saved readings and raw birth data stay on your device and in your private iCloud account, where we cannot reach them. Your name, your AI questions and your usage do leave the device — see sections 4.3 and 5 for exactly where they go and who can see them.

1. Introduction

This Data Processing Agreement ("DPA") forms part of the contract between you ("Data Subject" or "User") and Halim Öztürk ("Data Controller" or "we") for the use of BondAlchemy mobile application ("Service").

This DPA supplements our Privacy Policy and Terms of Use, providing additional details on data processing activities for compliance with:

  • General Data Protection Regulation (GDPR) - EU
  • California Consumer Privacy Act (CCPA) - USA
  • Other applicable data protection laws

2. Definitions

For the purposes of this DPA:

  • Personal Data: Any information relating to an identified or identifiable natural person
  • Processing: Any operation performed on personal data, including collection, storage, use, and deletion
  • Data Controller: Halim Öztürk, determining the purposes and means of processing
  • Data Subject: You, the user of BondAlchemy
  • Sub-processor: Third-party service providers who process data on our behalf

3. Nature and Purpose of Processing

3.1 Data We Process

BondAlchemy processes the following categories of personal data:

Data Category Purpose Legal Basis (GDPR)
Personal Name App personalization and user experience Contractual necessity
Personality Preferences Personalized insights and compatibility analysis Contractual necessity
Relationship Values Compatibility matching and AI coaching Contractual necessity
Journal Entries Dream analysis and pattern recognition Contractual necessity
AI Conversations Life coaching and relationship guidance Contractual necessity
Compatibility Data Relationship compatibility analysis Contractual necessity
Subscription Data Access control and billing (handled by Apple) Contractual necessity
Device Identifiers Subscription verification only (RevenueCat) Legitimate interest

3.2 Special Categories of Data

Personality data and relationship preferences may be considered sensitive data under GDPR Article 9. We process this data with your explicit consent when you complete the onboarding questionnaire in the app.

4. Data Storage and Location

4.1 On-Device Storage (Apple Core Data)

  • Location: Locally on your iOS device
  • Encryption: iOS file system encryption
  • Access: Only you have access
  • Retention: Until you delete the app or clear data

4.2 iCloud Sync (Optional)

  • Service: Apple iCloud (CloudKit framework)
  • Location: Apple data centers (region-specific)
  • Encryption: End-to-end encryption by Apple
  • Access: Only you via your Apple ID
  • Developer Access: ZERO - We cannot access your iCloud data

4.3 Developer Data Access — what we can and cannot see

What we genuinely cannot access:
  • Your personality profile, journal entries and saved readings as stored on your device
  • Anything synced to your private iCloud database — that belongs to your Apple Account and is closed to us
  • Your raw birth date and time, which are used for on-device chart calculation and are not uploaded
What we can see, and previously claimed we could not:
  • Your AI conversations in transit. Every AI request is routed through a backend service operated by Halim Öztürk before reaching OpenAI, so it passes through our infrastructure. We do not read it for any purpose other than operating and debugging the service, and we never sell or share it — but "no access" was the wrong word and we have corrected it.
  • Your name and usage, in analytics. The app attaches your name to your analytics profile, so those events are linked to you rather than anonymous.

5. Sub-processors and Third-Party Services

We engage the following sub-processors to provide the Service:

Sub-processor Purpose Data Shared Location
Apple Inc. iCloud sync, In-App Purchases, place-name geocoding User-controlled iCloud data, transaction receipts, the birth place you type USA / region-specific
Halim Öztürk backend Routing AI requests, holding API credentials, rate limiting Your question text, conversation context, in-app user ID, and your first name where the reading addresses you personally USA
OpenAI LLC AI-powered features (GPT models, image generation) The same request content forwarded by our backend — not anonymised; it can include your first name and whatever you wrote USA
RevenueCat Inc. Subscription management Anonymous app-user ID, subscription status, and the zodiac-sign and age-group attributes USA
Mixpanel Inc. Product analytics Usage events, your in-app user ID, your name, and the IP address from which an approximate city is derived USA

5.1 Sub-processor Guarantees

We rely on each sub-processor's own data protection terms, which include Standard Contractual Clauses or an equivalent transfer mechanism for transfers out of the EEA and the UK. Under those terms they process the data on our instructions, apply appropriate technical and organisational security measures, and do not use it for their own unrelated purposes. Retention follows each provider's published practices, described in their privacy policies linked from our Privacy Policy.

Please do not enter information you would not want transmitted — including health details, financial details, or identifying information about other people.

6. Data Subject Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

6.1 Right of Access (Article 15)

You can access all your personal data directly within the BondAlchemy app. Navigate to Profile > Settings to view your stored information.

6.2 Right to Rectification (Article 16)

You can edit and correct your personal information at any time within the app's Profile section.

6.3 Right to Erasure ("Right to be Forgotten") (Article 17)

You can delete your data by:

  • Deleting individual entries within the app (journal entries, conversations, etc.)
  • Clearing all app data in Settings > Privacy > Clear All Data
  • Uninstalling the app (removes local data)
  • Contacting us at halimozturk@windowslive.com for complete data deletion

6.4 Right to Restriction of Processing (Article 18)

You can disable specific features or stop using the app at any time to restrict processing.

6.5 Right to Data Portability (Article 20)

Currently, data export is limited to share functionality. We are developing a comprehensive data export feature for future releases.

6.6 Right to Object (Article 21)

You can object to data processing by discontinuing use of the Service and deleting your data.

6.7 Right to Withdraw Consent (Article 7)

You may withdraw consent at any time by deleting your data or uninstalling the app. This does not affect the lawfulness of processing before withdrawal.

7. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

7.1 Right to Know

See Section 3 for categories of personal data collected and purposes of processing.

7.2 Right to Delete

Same as GDPR Right to Erasure (Section 6.3).

7.3 Right to Opt-Out of Sale

We do NOT sell personal information. We have never sold personal data and will never sell your data to third parties.

7.4 Right to Non-Discrimination

We do not discriminate against users who exercise their CCPA rights.

8. Security Measures

We implement industry-standard security measures to protect your data:

8.1 Technical Measures

  • Encryption at Rest: iOS file system encryption for local data
  • Encryption in Transit: HTTPS/TLS 1.3 for all network communications
  • iCloud Encryption: End-to-end encryption managed by Apple
  • API Key Security: AI provider credentials are held on our backend, not inside the app

We make no claim beyond the measures listed above. In particular, the app does not implement certificate pinning, and AI requests are not anonymised — earlier versions of this page stated otherwise, and that was incorrect.

8.2 Organizational Measures

  • Local-first storage for your journal, readings and birth data
  • Security updates applied as part of ongoing app maintenance
  • Minimal data collection principle
  • Halim Öztürk is a one-person studio; access to backend logs and analytics dashboards is limited to the developer
  • No sale of personal data, and no sharing with advertisers or data brokers

9. Data Retention

Personal data is retained according to the following schedule:

Data Type Retention Period Deletion Method
Local Core Data Until you delete the app or clear data User-initiated or app uninstall
iCloud Data Until you disable iCloud sync and delete from Apple account User-initiated via Apple iCloud settings
AI Requests (our backend & OpenAI) Retained for operational and abuse-monitoring purposes under our backend's and OpenAI's own practices — not "not stored" On request by e-mail, quoting your in-app user ID
Analytics Profile (Mixpanel) Retained under Mixpanel's published retention practices On request by e-mail, quoting your in-app user ID
Subscription Data (RevenueCat) Duration of subscription and afterwards under RevenueCat's retention practices On request by e-mail

10. Data Breach Notification

In the event of a data breach:

  • We will notify affected users within 72 hours via in-app notification
  • We will report the breach to relevant supervisory authorities as required by GDPR
  • We will take immediate remedial action to contain and resolve the breach
  • Your journal, saved readings and raw birth data are held locally and in your private iCloud, so they are outside any breach on our side; the exposure would be to the analytics, subscription and AI-request data described in sections 3 and 5

11. International Data Transfers

Your data may be transferred to and processed in the following locations:

  • Apple iCloud: Region-specific data centers (EU users' data stays in EU)
  • Halim Öztürk backend: USA — AI request content, including your first name where the reading addresses you personally
  • OpenAI API: USA — the same request content, not anonymised
  • Mixpanel: USA — usage events linked to your in-app user ID and name
  • RevenueCat: USA — anonymous app-user ID, subscription status, zodiac sign and age group

These transfers rely on the Standard Contractual Clauses or equivalent transfer mechanisms in our providers' data protection terms, as required by GDPR Chapter V.

12. Children's Privacy

BondAlchemy is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us immediately at halimozturk@windowslive.com.

13. Changes to This DPA

We may update this DPA from time to time to reflect changes in our data processing practices or legal requirements. We will notify you of material changes through:

  • In-app notification
  • Updated date at the top of this document
  • App Store update notes

Continued use of the Service after changes constitutes acceptance of the updated DPA.

14. Contact Information

For questions about this Data Processing Agreement, to exercise your data rights, or to file a complaint:

14.1 Data Controller

14.2 EU Representative (if applicable)

If you are in the European Economic Area and wish to contact our EU representative, please email us at the address above for representative contact details.

14.3 Supervisory Authority

You have the right to lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection laws.

Summary: Your journal, saved readings and raw birth data are stored locally on your device and optionally in your private iCloud account, which we cannot access. Your name, your AI questions and your usage data are processed by us and by the sub-processors in section 5 — that is what makes the AI features work. Nothing is sold, nothing goes to advertisers or data brokers, and nothing is used to track you across other apps. You can access, rectify, delete and port your information; e-mail us with your in-app user ID and we will action it.

By using BondAlchemy, you acknowledge that you have read, understood, and agree to this Data Processing Agreement in conjunction with our Privacy Policy and Terms of Use.