Privacy Policy

Wuubi Labs Ltd. is the controller for the Wuubi website and mobile applications. Company number: 17237615; registered in England and Wales; registered office: 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom. For privacy questions, rights requests and data protection complaints contact iletisim@wuubi.com, with “Privacy” in the subject if possible. Legal notices may also be sent to hukuk@wuubi.com or our registered office.

This notice covers visitors, members, contributors, message participants, guardians and earning programme participants. The young-person notice supplements it. Acknowledging this notice is not consent to all processing. ICO Data Protection Register No: ZC276849. An ICO fee registration records payment of the statutory data protection fee; it does not certify the security or legal compliance of a service.

You provide registration and profile details such as email, username, name, password, private date of birth and optional biography and images. Passwords are stored as hashes. We record account verification, legal document versions and preferences. A young person supplies the proposed guardian email address so we can send an invitation explaining the source and use of that address. The recipient may confirm their authority and authorise the account; we retain a minimal authorisation record. Identity documents are not routinely requested.

Using features creates submissions, uploads, stories, comments, group membership, following relationships, bookmarks, messages and attachments, quiz/test answers or results, poll responses, scores and notifications. Earning participation adds programme acceptance, ledger entries, payment requests and a Turkish IBAN where required. Do not put sensitive personal information in public submissions or entertainment tests.

Devices and service operations provide IP addresses, user agent, session and access records, push subscription or notification tokens, error details and limited anti-abuse signals. With optional analytics permission we collect page or screen activity, events, session identifiers and limited referral/campaign information. A hashed identifier is still personal data where it can be linked back to a person or device.

Other users may mention you, send you messages, report content or supply evidence in a dispute. Providers may return delivery, security and payment status information. We use public editorial material and staff-provided inputs in editorial tools; private messages, guardian records and payment details are not authorised inputs to editorial AI tools.

Account creation, authentication, requested publishing and messaging, saved progress and enabled earning functions: we use information necessary to provide the service you request and perform the applicable agreement. Under the UK GDPR this is contractual necessity where applicable; under the KVKK it is the directly related necessity for establishing or performing a contract. Optional profile information is not made a condition where it is unnecessary.

Security, abuse prevention, proportionate moderation, service reliability and handling non-statutory disputes: we assess the legitimate interests of protecting users and operating a trustworthy service against the effects on individuals, especially children. Under the KVKK this ground is used only where processing is necessary and does not harm fundamental rights and freedoms. Processing required by a specific law, competent order, accounting duty or rights request relies on the relevant legal obligation or establishment, exercise or protection of a right, as applicable.

Optional behavioural analytics and optional client diagnostics use separate, withdrawable permission. Where consent or explicit consent is the applicable legal ground, refusal does not prevent core use. We do not treat a general acceptance of terms as consent. Essential security logs, requested notifications and operational payment records are distinguished from optional behavioural measurement; they are not made optional merely by sharing technical infrastructure.

We do not use entertainment test results to make decisions with legal or similarly significant effects, or to infer health, political, religious or sexual characteristics for advertising. If a new feature needs special-category processing or a materially different purpose, it requires its own assessment and appropriate information and legal ground before use.

Public editorial submissions and public interactions can be seen by others and may be copied or indexed outside Wuubi. Private profile and contact rules limit access through our service, but recipients may retain messages or screenshots they lawfully receive. We do not promise that deleting an account removes copies held independently by other people or search engines; we take applicable notification and removal steps.

Accounts are for people aged 13 and over. For ages 13–17 we require guardian authorisation, use private profiles and restricted messaging, block sensitive content and disable behavioural tracking and earning participation. A date of birth is not published on a public profile. An account with an unknown age receives restricted access until age information is completed. A guardian’s authorisation does not give automatic access to a young person’s private conversations.

Tell us if an account appears to belong to a child under 13, an age restriction has been bypassed, or a young person is at risk. We may restrict access, seek proportionate clarification and remove information where required. We do not routinely collect identity documents for every member. Any additional assurance must be proportionate to the actual risk and explained separately.

We use infrastructure, storage, delivery and security services, including Amazon Web Services; optional client diagnostics may use Sentry (Functional Software, Inc.). Google reCAPTCHA may process security signals during protected actions; Google Analytics is used only where configured and optional analytics is enabled. Mobile push delivery may involve Expo, Apple or Google. Transactional email uses AWS WorkMail in Ireland (eu-west-1). Banks process payment instructions for earning withdrawals.

Editorial AI features may involve OpenAI and media or generation providers used for the relevant editorial task. Automated editorial accounts and their activity must be identified transparently. Access to personal information is limited to authorised personnel and providers for the relevant purpose; private message access is limited to delivery, requested support, proportionate safety investigation or lawful requirements. We do not authorise private-message or payment information to be used as editorial AI input.

Core hosting uses AWS infrastructure in Germany; our configured media buckets are in the United States (us-east-1). Content delivery and external providers can process information in additional locations. UK and Turkish international transfer requirements are assessed separately. Where required, an applicable adequacy decision or valid safeguards and transfer assessment must cover the relevant recipient. A UK mechanism does not by itself satisfy Turkish requirements. Contact us for recipient and safeguard information applicable to your data; security-sensitive details may be redacted.

We may disclose necessary information to professional advisers, competent authorities or a successor in a genuine business reorganisation, subject to purpose limitation and applicable safeguards. We assess the legal basis and scope of requests. We do not claim that an unsigned processing agreement, unverified transfer certification or unappointed representative is already in place.

Account information and functional records are kept while needed for the account or requested feature, then erased or genuinely anonymised according to the closure and rights process. Ordinary closure offers 30 days to cancel. Statutory erasure requests are assessed separately and do not require that waiting period. Personal posts and comments are removed on erasure; editorial publications are retained only where publication rights and applicable data protection grounds allow.

Personal analytics events, sessions and person-linked summaries: up to 90 days. Non-identifiable analytics aggregates without user, device or session identifiers: up to 24 months. A new analytical use does not restart the original retention clock. Withdrawal stops future optional collection and clears optional identifiers; existing identifiable records are addressed according to the relevant rights request and legal basis.

Raw access and operational logs: normally 30 days; restricted security and technical audit records: normally 90 days. An identified incident, legal claim or lawful preservation requirement may justify a scoped hold, with a recorded reason and review date. Export files expire 14 days after completion. Unconfirmed guardian requests expire after 14 days. Backups rotate within 30 days and are isolated from ordinary use; erasure records are reapplied before a restored system returns to service.

Required accounting and payment evidence is retained for six years from the end of the relevant financial year, or longer where a specific legal requirement applies. Only the necessary financial information is retained, separately from the ordinary account. Minimal agreement, authorisation and rights-handling evidence may be retained for up to six years after closure for legal claims, following a documented necessity assessment. A legal hold is not a reason to retain an entire profile indefinitely.

Depending on applicable law, you may request information and access, correction, erasure, restriction, portability, objection and withdrawal of consent. Under the KVKK you may also ask whether data is processed, its purpose and recipients, request correction or deletion under the legal conditions and notification to recipients, object to an adverse result produced solely by automated analysis, and seek compensation for unlawful processing. Withdrawal does not invalidate lawful processing before withdrawal.

Use account settings or contact iletisim@wuubi.com. You do not need to buy a service, accept new terms, or use a particular form to exercise a right. We may ask only for proportionate verification and clarification. Automated export cooldowns do not limit statutory access requests. We normally respond to UK GDPR rights requests within one calendar month; where a lawful extension or pause applies we explain it. KVKK applications are answered as soon as possible and within 30 days, subject to applicable rules. We explain refusals and available escalation.

You may object to legitimate-interest processing on grounds relating to your situation. Optional analytics and diagnostics can be switched off separately. Contact us to raise a data protection complaint; we acknowledge receipt within 30 days, investigate and inform you of the outcome without undue delay. You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or, where applicable, to the Turkish Personal Data Protection Board at kvkk.gov.tr, following the applicable application and complaint rules. This does not restrict judicial remedies.

We use access controls, protected connections, password hashing and operational safeguards appropriate to the processing. No system is completely risk-free. Report a suspected disclosure privately so we can investigate. Where required, we notify the competent authority and affected people under the applicable breach notification rules.

We publish the revision date and retain prior legal versions. Material changes are brought to users’ attention through an appropriate channel. A new purpose requiring fresh consent does not become authorised merely because this notice changes. Provider details, transfer evidence and actual system behaviour must remain consistent with this notice.