Privacy Policy

Effective Date: 30.09.2025

Controller: Cerasus Teknoloji ve Reklam Hizmetleri A.Ş. (“Cerasus”, “we”, “us”, “our”)

Application: Zlay: Talk & Play (the “App”) and any related websites, widgets, or services (collectively, the “Services”).

Contact: support@cerasus.app

Postal (if applicable): Egitim mah. Eylul sok. No:9 D:4, Kadikoy/Istanbul, Turkey

Cerasus is committed to protecting your privacy and developing technology that enables a safe and enjoyable social gaming experience. This Privacy Policy explains what we collect, how we use and share it, and the choices you have. By using the App, you agree to the practices described here.

1) Information We Collect

A. Information you provide

● Account & profile: display name, username, avatar/photo, age range, gender (optional), bio, country/region, game preferences.

● Credentials: email and password (hashed); third-party sign-in IDs (if you choose).

● User-generated content (“UGC”): messages, posts, images, voice notes, gameplay chats, room titles, status, and any content you share.

● Support & feedback: information you provide when you contact support or respond to surveys.

B. Communications & Social

● Messages & calls: we process your messages and call metadata (time, participants, duration) to deliver the service, combat spam/abuse, and improve safety. Unless we specifically state otherwise in-app, calls are not end-to-end encrypted. We generally do not store call audio/video; however, limited retention may occur for troubleshooting or safety/abuse reports.

● Contacts (optional): if you choose to sync contacts or invite friends, we may access names, phone numbers and/or emails to match or invite friends. Hashing and minimization are applied where feasible. You can revoke access in your device settings.

C. Device & Usage

● Device identifiers: advertising ID (e.g., AAID/IDFA), device ID, OS version, language, timezone, app version.

● Log data: IP address, in-app events, session timestamps, crashes, diagnostics, performance data.

● Approximate location: inferred from IP for safety, compliance, language/region features, and content relevance. We do not collect precise GPS location unless you explicitly grant it for a feature that needs it.

D. Cookies/SDKs & Analytics

We use cookies and mobile SDKs for authentication, preferences, crash reporting, analytics, and advertising (including frequency capping, attribution, and interest-based ads). Analytics is typically aggregated and de-identified for product improvement.

E. Payments

If you make purchases, payments are processed directly through Google Play Store or App Store. We receive limited transaction metadata (e.g., purchase time, item, status) but not your full card details.

2) How We Use Information

We process data to:

● Provide the Services: create and manage accounts, enable social games, lobbies/rooms, matchmaking, chats, voice/video calls, friend lists, leaderboards, and notifications.

● Personalize & recommend: suggest players, rooms, games, events, and content you might enjoy.

● Safety & integrity: detect/prevent spam, fraud, cheating, harmful content, harassment; enforce our Terms/Community Guidelines; verify age eligibility.

● Communicate with you: service messages, updates, security alerts; with your consent where required, marketing or feature announcements.

● Improve the App: analytics, research, A/B tests, crash diagnostics, and quality assurance.

● Legal/compliance: comply with law, defend legal claims, and protect users’ and the public’s safety.

3) Sharing Your Information

We do not sell your personal information. We may share as follows:

● With other users: your public profile (name/username, avatar, country/region, status), basic gameplay stats, and content you choose to share in rooms/chats are visible to others according to your settings and the context (e.g., a public game room).

● Service providers & partners: hosting, analytics, content moderation, call/real-time media infrastructure, customer support, marketing/measurement, and payment processing—bound by confidentiality and data-protection obligations.

● Affiliates: within the Cerasus group to operate and improve the Services.

● Advertising & measurement partners: to deliver/measure ads, cap frequency, and combat fraud, using advertising IDs and aggregated data where possible.

● Legal, safety, and rights: to comply with law or valid requests, enforce terms, protect our users, Services, or the public.

● Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

4) Data Retention

We keep data only as long as needed for the purposes described:

● Account & profile: retained while your account is active; some logs may be kept for a limited period after deletion for fraud/safety/legal reasons.

● Messages & UGC: retained per feature design and legal/safety needs. You can delete certain content; residual copies may persist for a short time in backups.

● Diagnostics & analytics: retained for a limited window to improve performance and stability.

 When no longer necessary, data is deleted or de-identified.

5) Your Choices & Rights

● Access, correction, deletion: you can access or edit profile fields in-app. To request a copy, correction, or deletion of your data, use in-app settings (where available) or email support@cerasus.app.

● Marketing & notifications: control push/email marketing in settings or via unsubscribe links; manage device notification permissions.

● Contacts & permissions: revoke camera, microphone, contacts, location, and photo/media permissions via device settings.

● Ads choices: reset/limit your device Advertising ID; opt-out of interest-based ads where available.

6) Children’s Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information, we will delete it promptly. If you believe this has occurred, contact support@cerasus.app. (If your region sets a higher age of consent for online services, we comply with that threshold.)

7) Security

We implement administrative, technical, and physical safeguards to protect personal information (e.g., encryption in transit, access controls, monitoring). No online service can guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials.

8) Community Safety, Reporting & Moderation

Zlay: Talk & Play includes social features where you can meet new people, chat, and play together. To promote a safe environment:

● Blocking & reporting: you can block users and report content or behavior that violates our guidelines.

● Automated & human review: we may use automated tools and human moderators to detect and review potentially harmful or policy-violating content, including text, images, usernames, room titles, and metadata associated with calls/games.

● Enforcement: we may remove content, restrict features, or suspend accounts that violate our Terms or Community Guidelines.

9) Third-Party Links & Features

The App may include links or integrations with third-party content, games, or services. Their privacy practices are governed by their own policies. Review those policies before engaging.

10) Cookies & Similar Technologies

We and our partners use cookies/SDKs to operate the App, remember preferences, enable sign-in, measure performance, fix bugs, and deliver/measure ads. Where required, we seek your consent. You can manage preferences through device settings and, where available, in-app controls.

11) Permissions Used (Platform Disclosure)

Depending on your use, the App may request:

● Camera & Microphone: for video/voice calls, voice notes, and certain game features.

● Photos/Media/Files: to upload avatars or share images.

● Contacts (optional): to find friends/invite contacts (you can deny or revoke).

● Notifications: to alert you to messages, calls, invites, and updates.

● Approximate/Precise Location (optional): for region-based features or discovery (only if you grant permission).

● Network access & device state: to maintain sessions, prevent fraud, and optimize performance.

12) Data Deletion & Account Closure

You can request deletion via in-app settings (where available) or by emailing support@cerasus.app from your registered address. We may ask for verification. Certain data may be retained as required by law or for legitimate interests (e.g., fraud prevention, dispute resolution) and then deleted or de-identified.

13) Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated via the App or by email. Your continued use after the effective date constitutes acceptance of the updated Policy.

14) How to Contact Us

Questions or requests about this Policy or your data?

Email: support@cerasus.app

Postal (if applicable): Egitim mah. Eylul sok. No:9 D:4, Kadikoy/Istanbul, Turkey

Controller: Cerasus Teknoloji ve Reklam Hizmetleri A.Ş.