Privacy Policy

1. In short

• We don't store the content of your requests and responses.
• We keep only usage metadata, for billing and for your usage logs.
• We don't track you for advertising and we don't sell your data.

2. Request content

Requests you send to the API and the responses from the model pass through our servers to the relevant model provider and back to you. This content is not written to our database or logs. Model providers process requests to generate responses; their own retention terms may apply.

3. What we keep

• Account: email address, password hash, country of residence and declaration, marketing consent, language preference, session information (time, IP address, browser).
• Payments: order reference code, amount, exchange rate, bonus; sender name for bank transfers; invoice details; refund requests.
• Usage logs: time, model, token counts, duration, status code, cost, request ID, the API key's name and ID, client IP address and inferred client type.

4. How we use data

• To provide the Service, calculate your balance, issue invoices and make refunds.
• To show usage, cost and log screens in the console.
• To keep the Service secure and prevent abuse and fraud.
• To enforce regional restrictions and sanctions rules.
• To send account emails (verification codes, top-up confirmations, balance alerts) and, if you agreed, announcements.

5. Our service providers

• Hetzner Online GmbH, Germany (EU): server hosting.
• Vercel Inc., USA: website and console hosting.
• Model providers [provider names and countries]: processing requests.
• Emails are sent through our own SMTP server.
• IP location is determined with the DB-IP database (db-ip.com, CC BY 4.0), kept locally on our servers; your IP address is not sent to a third party for this. Country information passed on by our hosting provider may also be used.

6. Security

Connections are encrypted with TLS. Passwords are stored only as hashes; the session cookie is encrypted and signed; verification codes and password reset links are stored as hashes and expire quickly. Access to data is limited to people who need it for their work.

7. Retention and your rights

Retention periods and your rights under the KVKK are explained in the KVKK Privacy Notice. To close your account or access your data, write to destek@kervan.com.tr.

8. Children

The Service is not meant for anyone under 18, and we don't knowingly collect their data.

9. Changes

We may update this policy. We announce material changes by email or on the site; the current date is shown at the top of the page.