Privacy Policy
Last updated: October 7, 2026
This policy explains how your personal data is processed when you use SBOY (sboyapp.com). It serves as the notice required by the EU General Data Protection Regulation (GDPR) and by Turkey's Personal Data Protection Law No. 6698 (KVKK), Article 10.
1. Who is responsible for your data
The data controller is Necati Gezer, who operates SBOY as an individual. For any privacy question or request, contact: necati@sboyapp.com
2. What data we process
- Account data: email address, full name, password (stored only in irreversibly hashed form by our authentication provider), profile photo and, optionally, phone number and date of birth.
- If you sign in with Google, the data we receive from Google: your email address, name and profile picture. We do not access anything else in your Google account (emails, contacts, Drive files, etc.).
- Resume content: everything you type into or upload to your resume (experience, education, skills, contact details, resume photo), saved versions of your resumes, ATS scores, and job descriptions you paste to tailor a resume.
- Uploaded files: a PDF/DOCX you upload is processed only to extract its text; the file itself is not stored. The extracted text may be saved as part of a resume in your account.
- Subscription data: subscription status, renewal/end dates, and the customer/subscription IDs issued by our payment provider. Your card details never reach us.
- Usage and technical data: IP address, browser and device information, approximate location (country), pages you visit, clicks, and how you arrived at our site (e.g. an ad campaign).
- Your correspondence with us: messages you send by email.
Resumes may by their nature contain special categories of data such as health, religion or association membership. Including such information is your choice; we process it only to help you build your resume. We recommend leaving it out unless it is necessary.
3. Tools you can use without an account (ATS test and single-bullet try)
In the no-signup ATS test and the “single bullet” try, the resume or text you enter is processed only to produce the result; it is not saved to our database and is not written to our logs. In the single-bullet try, your text is sent to our AI provider to write the bullet. If you choose to carry a result into your resume after signing up, it is kept only temporarily in your own browser's storage.
4. Why we process your data and on what legal basis
| Purpose | Legal basis (GDPR Art. 6 / KVKK Art. 5) |
|---|---|
| Creating your account, signing you in, storing and letting you edit your resumes | Performance of a contract (GDPR 6(1)(b), KVKK 5(2)(c)) |
| AI writing suggestions, ATS scoring, tailoring a resume to a job posting | Performance of a contract |
| Managing Pro subscriptions and enforcing usage limits | Performance of a contract |
| Invoicing and accounting records | Legal obligation (GDPR 6(1)(c), KVKK 5(2)(ç)) |
| Keeping the service secure, preventing abuse and excessive requests (e.g. IP-based rate limiting) | Legitimate interests (GDPR 6(1)(f), KVKK 5(2)(f)) |
| Measuring site usage, understanding the effect of our marketing, improving the product | Legitimate interests |
| Answering your questions and requests | Legitimate interests; performance of a contract where the request relates to it |
| Establishing, exercising or defending legal claims | Legitimate interests / KVKK 5(2)(e) |
We do not use your data to send you marketing emails, we do not sell it, and we do not use it for anyone else's ad targeting.
5. How we collect data
We collect data electronically, by fully or partly automated means: through the signup and login forms, Google sign-in, the resume builder and file upload fields, subscription notifications from our payment provider, cookies and similar technologies, and email correspondence.
6. Who we share data with (international transfers)
We share your data only with the following service providers that act on our behalf, and only as far as needed to run the service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication, database, profile photo storage, password reset emails | Outside Turkey |
| Railway | Backend server hosting | Outside Turkey |
| Vercel | Website hosting | Outside Turkey |
| Anthropic | AI features: resume text, job descriptions and chat messages are sent to generate responses. Under the provider's commercial terms this content is not used to train AI models. | USA |
| Google (Google Analytics, Google sign-in) | Site usage statistics; signing in with a Google account | Outside Turkey |
| Lemon Squeezy | Selling Pro subscriptions and processing payments (as merchant of record). Your email address and account ID are passed to the checkout page. | USA |
Because these providers' servers are located outside Turkey (and, for some, outside the EU), your data is transferred internationally. We carry out these transfers in line with KVKK Article 9 and the GDPR's transfer rules, under the providers' data processing agreements and standard contractual clauses.
Apart from this, we disclose data only when required by a lawful request from a competent public authority.
7. Google user data
When you sign in with Google, we access only your email address, name and profile picture, and use them only to create your account, identify you and display them in your account. SBOY's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, or use it to train AI models.
8. Cookies and browser storage
| Name | Purpose | Duration |
|---|---|---|
| sb-…-auth-token (Supabase) | Keeping you signed in (essential) | Session / refreshed |
| NEXT_LOCALE | Remembering your language (essential) | 1 year |
| COUNTRY | Showing prices and language for your country (essential) | 24 hours |
| _ga, _ga_* (Google Analytics) | Measuring visits and site usage (analytics) | Up to 2 years |
We also keep a few small entries in your browser's local storage (localStorage/sessionStorage): which source first brought you to the site, whether you have already seen certain tips, text to be carried from the no-signup tools into your account, the email you typed on the login form (to prefill a password reset), and an internal-traffic flag for analytics. These stay on your device; the first-visit source is used only for analytics measurement.
You can delete or block cookies in your browser settings. To opt out of Google Analytics on all websites, you can use Google's browser add-on (tools.google.com/dlpage/gaoptout). If you block essential cookies, some features such as signing in may not work.
9. How long we keep data
- Account and resume data: for as long as your account exists. When you ask us to delete your account, it is deleted or anonymised within 30 days at the latest.
- Resumes you delete: deleted together with all their versions.
- Invoice and subscription records: for the period required by tax and commercial law (usually 10 years).
- Server logs: for our hosting providers' retention periods, usually a few weeks.
- Analytics data: up to 14 months in Google Analytics.
10. Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interests. You may also lodge a complaint with the data protection authority in your country.
Under KVKK Article 11 you have the right to learn whether your data is processed and request information about it, to learn the purpose of processing and whether it is used accordingly, to know the third parties in Turkey or abroad to whom it is transferred, to request correction of incomplete or inaccurate data, to request erasure or destruction under KVKK Article 7, to request that corrections and erasures be notified to those third parties, to object to a decision against you resulting exclusively from automated analysis, and to claim compensation for damage caused by unlawful processing.
You can correct or delete your profile details and resumes yourself in your account. For any other request, including deleting your account entirely, just email necati@sboyapp.com from the address registered to your account. We will resolve your request free of charge within 30 days at the latest after verifying your identity. If you are not satisfied with our answer, you may complain to the Turkish Personal Data Protection Authority (KVKK).
11. Security
Your data is transmitted over encrypted connections (HTTPS); passwords are stored only in hashed form; database access is restricted by authorisation rules; and excessive requests to the service are rate-limited. No system is entirely risk-free, but we take reasonable technical and organisational measures to protect your data. In the event of a data breach we will notify the authorities and affected users as required by law.
12. Age requirement
SBOY is intended for users aged 16 and over. If we learn that we are processing the data of someone under 16, we will delete it.
13. Changes
We may update this policy from time to time. The current version is always available on this page; we will announce significant changes on the site or by email.