PRIVACY POLICY

Privacy Policy

Who is Hain

360 Global Studio Yazılım ve Teknoloji A.Ş. (trading as Global360 Studio) · global360.studioLast updated: 26 August 2026

0. Language Versions and Which Version Applies to You

This Privacy Policy is published in five languages:

Which version applies to you:

  • Users resident in France, Belgium, Luxembourg and other French-speaking EU countries → the French version.
  • Users resident in Germany, Austria or Switzerland → the German version.
  • Users resident in Türkiye → the Turkish version, which sets out your rights under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK").
  • Users resident in Spain, Mexico and other Spanish-speaking countries → the Spanish version.
  • Users resident in all other countries → this English version.

Each version is drafted for the law that applies to its audience (GDPR, UK GDPR, CCPA/CPRA, KVKK and so on). You only need to read the version in your own language. You are under no obligation to read the versions in other languages.

Where versions differ, the mandatory provisions of the data protection law that applies to you always prevail. This clause is not intended to limit any user's mandatory rights under their local law.

1. Introduction and Data Controller

This Privacy Policy ("Policy") explains the conditions under which the personal data of people ("you", "User") who use the mobile application "Who is Hain" (titled "Hain Aramızda" in Türkiye) (the "App"), developed and published by 360 Global Studio Yazılım ve Teknoloji Anonim Şirketi ("we", "us", "Company" or "Developer"), is collected, processed, stored and protected.

This Policy applies to all versions of the App downloaded from the App Store, to all content, features and services offered inside the App, and to support processes relating to the App.

By downloading, installing or using the App you are deemed to have read and understood the practices described in this Policy. If you do not accept this Policy, please do not use the App and remove it from your device.

Identity and contact details of the data controller (Article 13(1)(a) GDPR; Article 10 of Turkish Law No. 6698):

  • Legal name: 360 GLOBAL STUDIO YAZILIM VE TEKNOLOJİ ANONİM ŞİRKETİ — a joint stock company incorporated under the laws of the Republic of Türkiye, trading as "Global360 Studio"
  • Registered office: Adalet Mahallesi, Manas Bulvarı, Folkart Towers, No: 39, Suite 2511, Bayraklı / İzmir, Türkiye
  • Trade registry: İzmir Trade Registry Office, registration no. 274399
  • Chamber of commerce: İzmir Chamber of Commerce, registration no. 2324400
  • Tax number: 0012806176
  • Telephone: +90 545 827 23 60
  • E-mail: contact@global360.studio
  • Website: https://global360.studio

We have not appointed a Data Protection Officer, because the nature and scale of our processing does not meet the criteria in Article 37 GDPR. All data protection matters are handled directly at the contact details above.

Because the controller is established in Türkiye, Turkish Law No. 6698 ("KVKK") also applies to our processing activities in addition to the law of your own country. Your rights under your local law are set out in Sections 11 and 12 and are in no way reduced by this.

2. Summary: The Key Points

The details are set out in the sections below, but the most important points are:

  • The App is a "pass-and-play" party game played together on a single device. NO membership, account, e-mail address, phone number or registration of any kind is required to play.
  • The player names you enter and the settings you choose are stored ONLY ON YOUR OWN DEVICE; they are NOT SENT to us or to any server.
  • We operate no server of our own; your game data is never transferred to any environment we could access.
  • In-app purchases and subscriptions are handled entirely through Apple's App Store infrastructure; your payment card details never reach us in any form.
  • The free version of the App uses Google AdMob advertising technology, which may process limited device data (see Sections 3.3 and 5).
  • We do not sell your data, we do not share it with any third-party artificial intelligence service, and nothing from the App is used to train any AI model.
  • When you delete the App from your device, all game data stored on the device is deleted as well.

3. Data Collected and Processed

3.1. Data you enter directly, stored only on your device

For the App to work, the following data is kept in your device's local storage (inside the app sandbox):

  • a) Player names: the player names you enter on the game setup screen. These names do not have to be real names; you may use nicknames. If you enter no name, the App uses default labels such as "Player 1", "Player 2".
  • b) Game settings: sound effect and music preferences, discussion time, visibility of traitor information, the selected app language and similar configuration preferences.
  • c) Purchase state flags: flags indicating whether purchases such as the ad-free experience have been activated on the device.

This data is not transmitted to us, cannot be viewed by us, is not uploaded to any server and is not shared with third parties. The security of this data is provided by your device's operating system security mechanisms (the app sandbox).

3.2. Data processed through the Apple App Store

When you make an in-app purchase or take out a subscription, the payment transaction is carried out entirely by Apple. In this context:

  • a) Your payment and billing details (card number, bank details, etc.) are processed ONLY by Apple; this information is never transmitted to us and cannot be seen by us.
  • b) For the purpose of validating a purchase, Apple provides the App only with anonymous transaction validation information (receipt validation).

3.3. Data processed through advertising technology

In the free (ad-supported) version of the App, our advertising provider is Google Ireland Limited and Google LLC (product name: Google AdMob). Limited to the purposes of serving ads, ad measurement and fraud prevention, the ad network may process the following types of data:

  • a) Device information: device model, operating system version, screen resolution, language and region setting, time zone.
  • b) App information: app version, ad impression and click interactions, session information.
  • c) Network information: IP address (may be used to infer approximate geographic location; precise/sensitive location data is NOT COLLECTED).
  • d) Advertising identifiers: the Apple Advertising Identifier (IDFA) is processed only if you GIVE EXPRESS PERMISSION within the App Tracking Transparency framework. If you do not grant permission, ads are shown without personalisation (contextually); you can carry on using the App exactly as before.
  • e) Crash and performance data: the advertising SDK may collect crash logs and basic performance measurements (load times, error rates and similar) for stability and debugging purposes. This data is processed solely to maintain and improve the operation of the App; it is not used for marketing.

Google's privacy policy: https://policies.google.com/privacy Google's advertising partners: https://business.safety.google/adspartners

Google processes this data under its own privacy policy, acting in its own capacity as controller/processor. When you purchase the ad-free experience subscription, no ads are displayed inside the App, the advertising SDK is never initialised, and the advertising-related processing described in this section ceases entirely as far as the App is concerned.

3.4. Data we do NOT collect

In the interests of transparency, we state explicitly that the App does NOT COLLECT the following data:

  • Full name, national identity number, e-mail address, phone number (there is no account system)
  • Precise location (GPS) data
  • Contacts, photos, camera or microphone data
  • Health data, biometric data
  • Social media account information
  • Browser history
  • What you say during play or the content of the games you play (the game is played entirely on the device and in the physical room)

4. Purposes of Processing and Legal Bases

The limited data that is processed is processed for the following purposes and on the following legal bases (Article 6 GDPR / Article 5 KVKK):

  • Purpose — Legal basis
  • Providing the core functions of the App (storing player names and settings on the device) — Performance of a contract — Art. 6(1)(b) GDPR
  • Validating and maintaining purchases and subscriptions — Performance of a contract — Art. 6(1)(b) GDPR
  • Financing the service through contextual advertising in the free version — Legitimate interests — Art. 6(1)(f) GDPR
  • Personalised advertising — Consent (ATT / consent screen) — Art. 6(1)(a) GDPR
  • Crash and performance measurement to maintain the service — Legitimate interests — Art. 6(1)(f) GDPR
  • Handling your support requests and data protection applications — Performance of a contract and legal obligation — Art. 6(1)(b) and 6(1)(c) GDPR
  • Fulfilling legal obligations — Legal obligation — Art. 6(1)(c) GDPR

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that showing contextual advertising and keeping the App stable does not override your interests, because no profile is built, no identifier is used for personalisation and no data reaches us. You may object to this processing at any time under Section 11.

Your data is not processed for purposes other than those stated above; it is not subject to profiling, credit scoring or automated decision-making producing legal effects.

5. Sharing with Third Parties

5.1. We DO NOT SELL your data, we do not rent it out and we do not transfer it to third parties for marketing purposes.

5.2. Limited processing activities are carried out only by the following recipients:

5.3. Equivalent protection of user data. Each third party listed above with whom the App shares user data — including advertising networks and third-party SDKs — is bound, by the agreements we have entered into with it and by its own published privacy commitments, to provide the same or an equal level of protection of user data as is stated in this Policy. We do not authorise any recipient to use data obtained through the App for its own unrelated purposes, and we do not permit onward disclosure other than as described in this Policy or as required by law. We have no parent company, subsidiary or other related entity that has access to user data.

5.4. Artificial intelligence. We do not share personal data with any third-party artificial intelligence service or model provider, and no data originating from the App is used to develop, train or improve any AI model, whether ours or a third party's.

5.5. Legal requirements: where competent public authorities and judicial bodies make duly formed requests under applicable legislation, information may be shared limited to the scope of the relevant request. However, as explained above, since we hold no server records belonging to our users, the data that could be shared is extremely limited.

5.6. Corporate transactions: if the Company is involved in a merger, acquisition or asset sale, the obligations under this Policy will be assumed by the acquiring party and users will be informed by reasonable means.

6. Advertising Identifier (IDFA), Tracking Permission and Consent Management

6.1. On iOS 14.5 and later, your express permission is requested under Apple's App Tracking Transparency ("ATT") framework before the App can track you across apps and websites owned by other companies.

6.2. Granting this permission is entirely optional. If you do not grant it:

  • No function of the App is restricted.
  • Ads continue to be shown without personalisation.
  • No paid feature depends on it, and we never ask you again in a way designed to pressure you.

6.3. You can withdraw the permission you granted at any time from Settings > Privacy & Security > Tracking on your device. Withdrawal takes effect immediately and costs nothing.

6.4. European consent screen (Google UMP): users in the European Economic Area, the United Kingdom and Switzerland are shown a separate consent screen on first launch, delivered through a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework (Google User Messaging Platform). You can grant or refuse consent for personalised advertising and the related processing on that screen, and you can change or withdraw your choice at any time from the privacy options inside the App.

6.5. Age of digital consent. Consent for personalised advertising is sought only from users who have reached the age of digital consent that applies in their country under Article 8 GDPR — 16 in Germany and Austria, 15 in France, 14 in Spain, 13 in Belgium, and as fixed by national law elsewhere between 13 and 16. Users below the applicable age are shown non-personalised, contextual advertising only, and no advertising identifier is processed for them for personalisation purposes.

6.6. Refusing consent never degrades the game. The full game, every category and every setting works identically whether you consent or not.

7. Retention and Deletion of Data

7.1. Data stored on the device (player names, settings, purchase flags) remains on your device unless you delete it or remove the App. We have not set a retention period for this data because we have no access to it.

7.2. When you remove the App from your device, all data the App stored on the device is permanently deleted by the operating system. We hold NO backup of this data; deletion cannot be undone.

7.3. You can change or delete player names from within the App at any time.

7.4. Your subscription records are linked to your Apple account and are subject to Apple's retention policies.

7.5. Advertising data: Google retains advertising-related data in accordance with its own published retention schedule. For information on Google's retention periods: https://policies.google.com/technologies/ads

7.6. What we ourselves retain: nothing, with one exception. We operate no server and hold no user database, so there is no account record, no game history and no advertising profile on our side to retain, back up or restore. The only personal data we hold at all is the content of any message you choose to send us at contact@global360.studio. We keep such correspondence for as long as is necessary to deal with your request and to be able to demonstrate that we dealt with it, and in any event no longer than 3 years after the matter is closed, unless a longer period is required by law. You may ask us to delete it sooner at any time.

8. Children's Privacy

8.1. The App is rated 13+ on the App Store. It is a social party game aimed at a general audience, is not directed at children under 13, and does not knowingly collect personal data from children under 13.

8.2. The App is not part of Apple's Kids Category and is not configured for child-directed treatment in the advertising SDK, consistent with its 13+ rating.

8.3. As the App has no account system, the identity of no user — children included — can be known to us.

8.4. Users between 13 and the age of digital consent in their own country are shown non-personalised advertising only; see Section 6.5.

8.5. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at contact@global360.studio; if such data is identified it will be deleted immediately.

8.6. As purchases are handled through the Apple account, parents can supervise their children's purchases using Apple's Family Sharing and Ask to Buy features.

9. Data Security

9.1. Data is stored on your device, isolated from access by other applications by the iOS app sandbox architecture.

9.2. As we host no user data on any server of our own, the risk of a server-originated data breach is minimal as far as the App is concerned. This "no server, no database" design is itself our principal technical safeguard and reflects the data minimisation principle in Article 5(1)(c) GDPR.

9.3. The security of your device (device passcode, up-to-date operating system, etc.) is your responsibility; no liability is accepted for third parties who gain physical or remote access to your device reaching the data held on it.

9.4. Breach notification: in the event of a personal data breach affecting data accessible to us, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and will inform affected individuals where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Articles 33 and 34 GDPR and the corresponding provisions of Turkish Law No. 6698.

10. International Transfers

10.1. As on-device game data is not transferred anywhere, it is not subject to any international transfer.

10.2. The infrastructure of Apple and Google may be located outside your country, including in the United States and Ireland. If you use these services, the limited processing carried out under those providers' own privacy policies may take place abroad.

10.3. Where such transfers involve personal data from the EEA, the UK or Switzerland, the providers rely on their own transfer mechanisms, including the EU Standard Contractual Clauses adopted under Article 46 GDPR, the UK International Data Transfer Addendum and, where applicable, the EU–US Data Privacy Framework. Details are set out in the providers' own policies linked in Section 5.

10.4. Transfers out of Türkiye are made in accordance with Article 9 of Turkish Law No. 6698 as amended by Law No. 7499, which has applied since 1 June 2024, and with the Regulation on Procedures and Principles for the Transfer of Personal Data Abroad of 10 July 2024. Under that regime a transfer is made on the basis of an adequacy decision, failing which on the basis of one of the appropriate safeguards (standard contract, binding corporate rules, protocol or written undertaking with authorisation), and only failing those on the basis of one of the exceptions listed in the law. Consent is not our primary basis for international transfer.

11. Your Rights

Depending on where you live, you have some or all of the following rights in relation to your personal data:

  • Access — to obtain confirmation of whether your data is processed and a copy of it
  • Rectification — to have inaccurate or incomplete data corrected
  • Erasure — to have your data deleted
  • Restriction — to limit how your data is processed
  • Portability — to receive your data in a structured, machine-readable format
  • Objection — to object to processing based on legitimate interests, including for direct marketing
  • Withdrawal of consent — to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
  • Not to be subject to a decision based solely on automated processing that produces legal effects
  • To lodge a complaint with your competent supervisory authority

11.1. How to withdraw consent and how to have data deleted

Set out in one place, these are every route available to you. None of them costs anything and none of them requires you to contact us first:

  • Withdraw tracking consent (ATT): open Settings > Privacy & Security > Tracking on your device and switch off the entry for this App. Effective immediately.
  • Withdraw or change advertising consent (EEA, UK, Switzerland): open the privacy options inside the App, which reopens the consent screen. Effective immediately.
  • Delete the data held on your device: clear the player names inside the App, or remove the App from the device, which erases everything the App has stored. Irreversible, and no request to us is needed.
  • Delete data held by the advertising provider: use Google's own controls at https://myadcenter.google.com and https://policies.google.com/technologies/ads
  • Delete correspondence you have sent us: write to contact@global360.studio and ask; we delete it and confirm that we have done so.
  • There is no account to close. The App never asks you to register, so no profile of you exists on our side to be deleted.

11.2. Making a request to us

Send your request to contact@global360.studio, or by post to the registered office given in Section 1. We respond free of charge within 30 days (extendable where the law allows for complex requests, in which case we tell you within the first 30 days). We may ask for information to verify your identity, and we will only ask for what is strictly necessary for that purpose.

Important note: because your game data exists only on your own device, you can carry out deletion and correction of that data yourself, directly within the App or by removing the App. For requests relating to advertising data you may also contact Google directly.

11.3. Supervisory authorities

12. Region-Specific Provisions

12.1. European Economic Area, United Kingdom and Switzerland. The legal bases for our processing are set out in Section 4. You have the rights listed in Section 11 and the right to lodge a complaint with your local supervisory authority. If you are resident in Germany, Austria, Switzerland, France, Belgium, Luxembourg, Spain or another country covered by our other language versions, please refer to the version in your own language (Section 0).

12.2. Representative in the European Union (Article 27 GDPR) and in the United Kingdom (Article 27 UK GDPR). The Company is established in the Republic of Türkiye, outside the European Economic Area and outside the United Kingdom. We are in the process of appointing representatives in the Union and in the United Kingdom; their names and addresses will be published in this section as soon as those appointments are complete, and the "Last updated" date will be revised accordingly. In the meantime, and equally afterwards, you may contact us directly and without any intermediary at contact@global360.studio, by telephone on +90 545 827 23 60, or by post at the registered office given in Section 1. We deal with requests from data subjects in the EEA and the United Kingdom on exactly the same terms and within the same time limits as we would through a representative, and no right of yours is reduced by the fact that we are established outside those territories.

12.3. California (USA) — CCPA/CPRA. We DO NOT SELL your personal information. Transfers falling within "sharing" (cross-context behavioural advertising) can only occur at ad network level if you grant ATT permission; you can withdraw that permission at any time through your device settings, which serves as our "Do Not Sell or Share My Personal Information" mechanism. You also have the rights to know, delete, correct and to non-discrimination. We do not knowingly collect or sell the personal information of consumers under 16.

12.4. Other United States jurisdictions. Residents of states with comprehensive consumer privacy legislation in force — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Florida and others — have rights of access, correction, deletion, portability and to opt out of targeted advertising that are equivalent to those described above. The opt-out for targeted advertising is exercised through the same ATT and consent controls described in Section 6, and we honour opt-out preference signals sent by your device where they reach us.

12.5. Other jurisdictions. Your rights arising from local data protection legislation in force in other countries are reserved.

13. Changes to this Policy

13.1. We may update this Policy from time to time. The current text is published on this page, accessible from within the App, and the "Last updated" date is revised.

13.2. Where a change materially affects your rights or the way your data is processed, we publish the revised text at least 30 days before it takes effect and identify the change on this page. Throughout that period you remain free to stop using the App and, if you hold a subscription, to cancel it through Apple's subscription settings, so that the change never applies to you against your will. Changes that do not alter our practices — corrections of wording, updated links, clarifications — take effect on publication.

13.3. Where a change broadens the scope of processing that relies on your consent, your consent will be requested again. Continued use of the App is never treated as consent for a purpose that requires consent.

14. Contact

For any question, request or application regarding this Policy or the processing of your personal data:

  • 360 GLOBAL STUDIO YAZILIM VE TEKNOLOJİ ANONİM ŞİRKETİ (trading as Global360 Studio)
  • Adalet Mahallesi, Manas Bulvarı, Folkart Towers, No: 39, Suite 2511, Bayraklı / İzmir, Türkiye
  • E-mail: contact@global360.studio
  • Telephone: +90 545 827 23 60
  • Website: https://global360.studio

This Privacy Policy came into force on 26 August 2026. Related document: Terms of Use: https://global360.studio/whoishain/terms-of-use/en

This Privacy Policy came into force on 26 August 2026.