Privacy Policy

101 Okey: Sultan · Version 1.0 · Effective: 1 November 2026

This Privacy Policy explains how personal data is collected, used and shared when you play 101 Okey: Sultan (the "Game") or use the website 101sultan.com, and what rights you have. The Game is available worldwide, so this policy is written to meet the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA (CCPA). The statutory Turkish notice is the KVKK Aydınlatma Metni (Turkish only); this English policy covers the same points. The Turkish version of this policy is Gizlilik Politikası.

1. Controller and representatives

2. In short

• No ads. We do not read the advertising identifier (IDFA/AAID), do not track you across other apps or websites, and do not sell or share your personal information.
• We do not ask for your real name, phone number or address. With Sign in with Apple/Google we receive only your account identifier (and your e-mail if the provider shares it).
• Voice chat is never recorded; it is relayed live to players at your table only.
• Payment card details never reach us; payments are handled by Apple or Google.
• The Game is for adults (18+) only.

3. Data we process, why, on what legal basis and for how long

Legal bases in the table correspond to: contract = GDPR/UK GDPR Art. 6(1)(b), KVKK Art. 5(2)(c); legal obligation = Art. 6(1)(c), KVKK Art. 5(2)(ç); establishment, exercise or defence of legal claims = Art. 6(1)(f), KVKK Art. 5(2)(e); legitimate interest = Art. 6(1)(f), KVKK Art. 5(2)(f); consent = Art. 6(1)(a), KVKK Art. 5(1). We do not process special categories of data (health, biometric, religion, ethnic origin etc.); voice is never recorded or used for recognition, so no biometric data is processed.

Information stored on your device is described in the Cookie & SDK Policy.

Legitimate interests

We rely on legitimate interests to protect the Game and accounts against cheating, fraud, chip trading and attacks; to review reports for community safety; to fix errors and keep the service running; to keep consent and transaction records so we can defend legal claims; and to apply responsible-play tools. We balanced these interests against your reasonable expectations and rights (data minimisation, short retention, no advertising, no profiling). You may object to such processing on grounds relating to your particular situation (GDPR Art. 21).

4. How we collect data

Data is collected electronically, automatically and partly automatically, from what you enter in the app and in forms on 101sultan.com, the actions sent to our game servers while you play, the Apple/Google sign-in providers (identifier only, and e-mail if you allow it), App Store / Google Play and our purchase-validation service. Providing account data is necessary to use the Game; without it we cannot create an account.

5. Recipients

We do not sell your data or share it for advertising. We use these service providers (processors):

Other players can see your username, avatar, level, title, leaderboard rank, table chat messages and (if you are VIP and turn your mic on) hear your voice.

6. International transfers

IS.TEAM LLC is established in the United States. Your data is processed and stored outside Türkiye — on our servers in Germany (Google Cloud, Frankfurt) and at service providers in the USA; nothing is stored in Türkiye. Safeguards:

• Türkiye (KVKK Art. 9): standard contracts announced by the Turkish Personal Data Protection Board, notified to the Authority within 5 business days of signature.
• EEA (GDPR Chapter V): the EU Standard Contractual Clauses (Commission Decision 2021/914, Art. 46 GDPR) or, where the recipient is certified, the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• United Kingdom: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU SCCs, or the UK Extension to the Data Privacy Framework.

When you give data directly to us it is processed by a company in the USA; the same safeguards and security measures apply. You can ask for a copy of the safeguards at destek@101sultan.com.

7. Security

All connections use TLS (HTTPS/WSS); access tokens are short-lived; refresh tokens are stored only as hashes; chip movements are recorded in an append-only double-entry ledger; server access is restricted to authorised staff. If a personal data breach is likely to affect your rights we will notify the competent authorities and, where required, you.

8. Your rights

Write to destek@101sultan.com to exercise any right. Requests are free and answered within 30 days (under the GDPR this may be extended by two further months for complex requests; we will tell you). To protect your account we may ask for information that identifies it (username and friend code).

• Delete your account in the app: Profile → Delete my account; without access to the app use the form at 101sultan.com/hesap-silme (Account Deletion).
• Withdraw marketing consent at any time in Settings → Notifications.

Türkiye (KVKK Art. 11)

You may learn whether your data is processed and request information about it; learn the purpose and whether data is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request rectification, and erasure or destruction under KVKK Art. 7, and notification of these to recipients; object to a result against you arising solely from automated analysis; and claim compensation for unlawful processing. How to apply is described in the KVKK Aydınlatma Metni; you may also apply via our representative in Türkiye. If your request is rejected or not answered in time you may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

EEA and United Kingdom (GDPR / UK GDPR Arts. 15-22)

• access (a copy of your data), rectification, erasure ("right to be forgotten"), restriction of processing, data portability (receiving data you provided in a structured, machine-readable format);
• objection to processing based on legitimate interests, and objection to direct marketing at any time;
• withdrawal of consent at any time (without affecting earlier lawful processing);
• not to be subject to decisions based solely on automated processing that significantly affect you (see §10).

You may also contact our EU representative [EU TEMSİLCİSİ] (EEA) or our UK representative [UK REPRESENTATIVE] (UK). Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the EEA member state of your habitual residence, place of work or the alleged infringement; in the UK with the Information Commissioner's Office (ICO, ico.org.uk). We would appreciate the chance to address your concern first.

US state privacy laws (California CCPA/CPRA and similar laws)

• Categories of personal information collected in the last 12 months: identifiers (player ID, device ID, username, e-mail, IP address); commercial information (purchase records); internet or network activity (gameplay and request logs); audio (voice chat is relayed live only and not recorded). We do not draw inferences or build profiles. Sources, purposes and retention periods are listed in §3; the categories of recipients (service providers/contractors and authorities only) in §5.
• We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not knowingly sell or share personal information of consumers under 16. A "Do Not Sell or Share" link is therefore not needed; Global Privacy Control (GPC) signals are consistent with how we already operate.
• We use sensitive personal information (e.g. account log-in credentials) only for permitted purposes such as providing the service and keeping it secure, and not to infer characteristics about you.
• Your rights: to know/access the personal information we collected and how it is used, to delete it, to correct it, to opt out of sale/sharing (not applicable, as there is none) and to limit the use of sensitive personal information. We will not discriminate against you (no different prices or service) for exercising your rights.
• How to submit a request: e-mail destek@101sultan.com with the subject "Privacy request — US", or delete your account in the app. We verify requests using information about your account. An authorised agent acting for you must provide your signed permission, and we may ask you to verify your identity with us directly. Where your state's law provides for it, you may appeal our decision by replying to our answer.

9. Children

The Game is intended only for persons aged 18 or over and is not directed to children. You are asked to confirm that you are 18+ at first launch. We do not knowingly collect personal data of anyone under 18 — including children under 13 within the meaning of the US Children's Online Privacy Protection Act (COPPA). If we learn of such an account we close it and delete its data. If you believe a child is using the Game, write to destek@101sultan.com.

10. Automated decisions

Automated signals help detect cheating and chip dumping; permanent bans are reviewed by a human and can be appealed. We do not make decisions based solely on automated processing that produce legal or similarly significant effects (GDPR Art. 22), and we do no profiling or advertising personalisation.

11. App permissions

Microphone: only when you tap the mic in voice chat. Notifications: only if you allow them; categories can be turned off in Settings. Location, contacts, photos, camera and advertising ID are not used.

12. Website

The website 101sultan.com uses no advertising, analytics or tracking cookies; see the Cookie & SDK Policy.

13. Changes

We may update this policy; material changes are announced in the Game before they take effect and the version number changes.

14. Contact

IS.TEAM LLC · 8 The Green, Ste A, Dover, DE 19901, United States · destek@101sultan.com · https://101sultan.com