Hullcore · KVKK
Sub-processor List
Hullcore (Osman Can Çınar), as Data Controller, works with the service providers listed below to operate the Hullcore flagship application and the hullcore.dev website. These providers process personal data only for the purposes described in this list and are bound by the applicable data-transfer safeguards described below. This list reflects providers that are wired into the product today; rows marked as conditional apply only when the related feature is actually enabled or has moved from testing to production.
| Sub-processor | Country | Purpose | Data transferred | Scope/condition |
|---|---|---|---|---|
| Cloudflare, Inc. | United States (global edge network; data may be processed outside Turkey) | Contact/lead-form compute and storage (Workers + D1), bot/anti-abuse verification (Turnstile), DNS for the hullcore.dev zone, and Cloudflare Tunnel edge routing for the flagship mobile API (api.hullcore.dev) | Contact form: name, e-mail, message text, IP address, User-Agent, request Origin header, timestamp. Bot-check: visitor IP and a verification token. DNS/tunnel: connecting IP addresses for site and API traffic in transit. | Active |
| Netlify, Inc. | United States | Static web hosting for the hullcore.dev marketing site | Ordinary visitor IP address and standard HTTP request metadata for anyone loading the marketing site's pages | Active |
| Google LLC (Firebase / Google Cloud Platform) | United States (Google's global infrastructure) | Push notifications for the Android and iOS flagship apps; optional analytics/crash reporting (Firebase Analytics/Crashlytics) | Push: device push token. Analytics/crash — only after you make an explicit consent decision (denied by default on a fresh install): usage/analytics events and crash/performance diagnostics. The Analytics/Crashlytics SDK initializes on every launch, but collection itself stays off until you opt in. | Push — Active. Analytics/Crashlytics — Consent-gated (opt-in, default off) |
| NetGsm İletişim ve Bilgi Teknolojileri A.Ş. | Turkey | Intended production SMS/OTP provider for customer-facing SMS | Recipient phone number and OTP/message content | Conditional — not yet in production use |
| Twilio Inc. | United States | SMS delivery for OTP/phone verification, evaluated in testing | Recipient phone number and OTP code content | Conditional — testing only; not the production SMS provider, no live account |
| SMTP-compatible transactional e-mail provider (vendor selected at deployment; e.g. AWS SES) | Deployment region (not yet selected) | Intended transactional e-mail sending (e.g. account verification / invite e-mails) | Recipient e-mail address and message subject/body | Conditional — not yet in production use; no vendor selected today |
| Sentry (Functional Software, Inc.) | United States / European Union | Optional error and performance monitoring for the web surface | Error and performance diagnostics | Conditional — not configured for this application today; inert without a project key, and would activate only with your explicit consent where consent applies |
| Generative-AI / LLM provider (deployment-configured; e.g. Anthropic or Google) | Provider's own region, if/when adopted (commonly abroad) | In-app AI concierge assistant referenced in product materials | None today. If/when a real provider is connected: assistant message/prompt content and related knowledge-base context. | Conditional — mock only; no real AI provider is connected today, no data is sent |
Providers Established Abroad
Some of the sub-processors listed above are established outside Turkey. Personal data transferred to such providers is transferred under Article 9 of the Law on the Protection of Personal Data No. 6698 ("LPPD"), relying on the standard contract adopted by the Personal Data Protection Board as the transfer basis, together with the provider's own contractual and technical safeguards.
Notice of Changes
Where Hullcore (Osman Can Çınar) adds, removes, or replaces a sub-processor in a way that affects the processing of your personal data, this list is updated and the change is announced before it takes effect.
Model Training
Personal data processed through the Hullcore flagship application and hullcore.dev is not used to train the AI models of the sub-processors listed above. This applies to any AI provider named in this list only once, and for as long as, that provider is actually connected to the product; it is not itself a guarantee governing providers not listed here.
Currency
This list is effective as published and is kept up to date as sub-processors change. For questions about this list, contact legal@hullcore.dev.
Hullcore (Osman Can Çınar) · legal@hullcore.dev · https://hullcore.dev Version 1.0 · effective on publication Prepared in compliance with Google Play Developer Policies, Apple App Store Review Guidelines, LPPD, and GDPR.