Privacy Policy
Last updated: 28 September 2026
This English text is provided for convenience. The Turkish version is the legally binding one; if the two differ, the Turkish version prevails.
Luma is a mobile app where clients have live voice or video sessions with independent advisors on tarot, cup reading, astrology, birth charts, palm and face reading and dream interpretation, and where they can send reading requests with text or photos. This policy explains which personal data we process when you use Luma, why we process it, who we share it with and what your rights are under the Turkish Personal Data Protection Law No. 6698 (KVKK). Additional information for users in the European Union is in section 13.
Contents
1. Data controller
The data controller for your personal data is:
Buska Yazılım Bilgi Teknolojileri Limited Şirketi15 Temmuz Mah. Bahar Cad. No: 61, Bağcılar / İstanbul, Türkiye
Güneşli Tax Office, tax number 1911418389
Email: info@buskayazilim.com
In this policy, "Buska" and "we" refer to this company; "Luma" refers to the app and this website.
2. Who this covers
- Clients: Users who create an account and have sessions with advisors.
- Advisors: Independent advisors who provide services through the app. Additional terms for advisors are set out in the advisor agreement.
- Website visitors: Visitors to luma.buskayazilim.com. This website uses no cookies, analytics or tracking technologies; our server keeps standard access logs only.
3. What data we process
| Category | Data | Source |
|---|---|---|
| Account | Phone number, optional email address, display name, optional profile photo | You, at sign-up |
| Verification | Verification codes sent by SMS or email (stored as a hash), the IP address and time of the code request | At sign-in |
| Session records | The participants, start and end time, duration and coins spent. The audio and video content of sessions is not recorded. | Your use of the app |
| Reading requests | The text and photos you send (for example a cup, palm or face photo) and the advisor's reply | You and the advisor |
| Appointments | Appointment time, status, cancellation and refund details | Your use of the app |
| Ratings and reports | Ratings and reviews you leave, reports you file and their handling | You |
| Coins and purchases | Coin balance and history, and the store transaction identifiers of purchases made through the App Store or Google Play. We never receive your card details; payment is collected by the store. | The stores and your use of the app |
| Notifications | Your device's push notification token and your notification preferences | Your device |
| Technical data | App version, device and operating system type, IP address, error and access logs | Your device and our servers |
| Advisor data | Application details (field of expertise, experience, bio, links), approval status, earnings records and the details needed for payouts | The advisor |
We do not ask for special categories of data such as race, religion or health. We recommend that you do not share such information in sessions or reading requests.
4. Purposes and legal bases
| Purpose | Legal basis (KVKK article 5) |
|---|---|
| Creating your account, verifying your identity and signing you in | Formation and performance of a contract |
| Providing sessions, appointments and reading requests with advisors | Performance of a contract |
| Managing coin purchases, balances, refunds and advisor earnings | Performance of a contract; legal obligation for financial records |
| Sending notifications about session requests, replies and appointment reminders | Performance of a contract; legitimate interest |
| Keeping the service secure, preventing abuse and fraud, handling reports and suspending accounts where necessary | Legitimate interest; legal obligation |
| Responding to legal requests and resolving disputes | Legal obligation; establishment, exercise or protection of a right |
| Providing the AI reading feature | Explicit consent |
| Improving the service and fixing errors | Legitimate interest (with anonymised or aggregated data where possible) |
5. Sessions and reading requests
- Voice and video sessions are transmitted in real time and encrypted over LiveKit infrastructure. Buska does not record, listen to or store sessions; only the time, duration and billing details of a session are kept.
- The text and photos you send in a reading request are visible only to the advisor you chose and, if a report is filed, to our review team.
- Advisors are independent service providers and are required to keep what they learn in sessions confidential. You can report a breach from within the app.
6. AI readings
The app offers the option of having a reading request interpreted by an AI service. This feature runs only when you start it, and we ask for your explicit consent before first use.
- Data sent: The text and photos of your reading request. Your name, phone number and account details are not sent.
- Provider: [Name and country of the AI provider]. The provider processes this data only to produce the reading.
- Withdrawing consent: You can withdraw your consent at any time in the app settings or by writing to us. Withdrawal does not affect processing that took place before it.
7. Who we share data with
We do not sell your data and we do not share it for advertising. The service providers below process your data only for the stated purpose and on our instructions.
| Recipient | Purpose | Country |
|---|---|---|
| Buska servers | Hosting data and files | Türkiye |
| Cloudflare, Inc. | Photo and file storage | USA |
| LiveKit, Inc. | Voice and video session infrastructure (content is not recorded) | USA (servers in the European Union) |
| İleti Merkezi | Sending verification codes by SMS | Türkiye |
| Resend, Inc. | Sending verification codes and notifications by email | USA |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to your device | USA |
| RevenueCat, Inc. | Verifying and managing store purchases | USA |
| Apple Inc. and Google LLC | App stores and payment processing | USA |
| AI provider | AI readings (only with your consent) | [Country] |
| Public authorities | Legal obligations and official requests | Türkiye |
The advisor you talk to sees your display name and the content you send in order to provide the service. Advisors do not see your phone number or email address.
8. International transfers
Some of the service providers above are located outside Türkiye. These transfers are made in accordance with article 9 of the KVKK, with appropriate safeguards such as the standard contract approved by the Turkish Personal Data Protection Board. The transfer involved in the AI reading feature is additionally based on your explicit consent.
9. How long we keep data
| Data | Period |
|---|---|
| Account data | While your account is open. Deleted or anonymised permanently 30 days after your deletion request. |
| Verification codes | A code is valid for 5 minutes; records are kept for a short period. |
| Reading request photos | At most 90 days after the reading is answered. Deleted 30 days after account deletion. |
| Session, appointment and coin records | For the period required by financial and commercial record-keeping rules (up to 10 years). Your identifying details in these records are anonymised when your account is deleted. |
| Report records | After the review is completed, for the duration of the statutory limitation periods. |
| Technical logs | At most 90 days. |
| Banned accounts | An irreversible hash of the phone number and email is kept to prevent re-registration. |
10. Deleting your account
You can delete your account from within the app. When you request deletion, your name and photo are hidden immediately, and you can restore the account by signing in again within 30 days. After 30 days the account is deleted permanently. The steps and details are on the account deletion page.
11. Security
- All traffic between the app and our servers is encrypted with HTTPS.
- Voice and video sessions are encrypted in transit and are not recorded.
- Verification codes are stored as hashes, not in plain text.
- Access to data is limited to authorised staff whose role requires it.
12. Your rights
Under article 11 of the KVKK you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom the data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of the data under the conditions in article 7 of the KVKK,
- request that corrections and deletions be notified to the third parties to whom the data was transferred,
- object to a result that is to your detriment arising from analysis exclusively by automated systems,
- claim compensation for damage caused by unlawful processing.
You can send requests by email to info@buskayazilim.com or in writing to the address above. To verify your identity we may send a code to the phone number registered to your account. Requests are answered within 30 days at the latest. If your request is refused or not answered, you can lodge a complaint with the Turkish Personal Data Protection Board.
13. Users in the European Union
If you are in the European Union, your rights under the General Data Protection Regulation (GDPR) also apply.
- Legal bases: Performance of a contract for providing the service (article 6(1)(b)), legal obligation for financial records and legal requests (article 6(1)(c)), legitimate interest for security and preventing abuse (article 6(1)(f)), and consent for AI readings (article 6(1)(a)).
- Your rights: Access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
- Data transfers: Your data is stored on our servers in Türkiye and shared with the service providers listed in section 7. Transfers are made with appropriate safeguards under article 46 of the GDPR.
- Complaints: You have the right to lodge a complaint with the data protection authority in your country.
14. Children
Luma is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18. If we become aware that a child has created an account, we close the account and delete its data. You can report such a case to us.
15. Cookies
The app does not use cookies. This website uses no cookies, analytics or tracking technologies either.
16. Changes
We may update this policy from time to time. We announce significant changes in the app. The current version is always published on this page, with the last update date shown at the top.
17. Contact
For questions and requests about this policy: info@buskayazilim.com