KVKK Privacy Notice

1. Data controller

Under Personal Data Protection Law No. 6698 ("KVKK"), the data controller is [Şirket Ltd. Şti.] (MERSİS: [0000000000000000], address: [İstanbul], KEP: [firma@hs01.kep.tr], email: destek@kervan.com.tr). This notice is provided under Article 10 of the KVKK.

2. Personal data we process

• Identity and contact: email address; for invoices, full name, Turkish ID number, address and city; for companies, company name, tax number and tax office.
• Account and security: a hash of your password (the password itself is not stored), two-factor authentication data, session information (sign-in time, IP address, browser details), signup IP address, email verification and password reset records (codes are stored only as hashes).
• Legal compliance: declared country of residence and when you declared it, your declaration that you do not reside in Iran, when you accepted the terms, the country derived from your IP address, your browser time zone, and compliance records related to regional restrictions.
• Transactions and finance: top-up orders (reference code, amount, VAT, exchange rate, bonus), the sender name and account for bank transfers, refund requests, balance and balance alert settings.
• Usage logs (metadata): request time, model, token counts, duration, status and error code, cost, request ID, the API key's name and ID, client IP address, and the client type inferred from the API used. Request and response content is not stored.
• Marketing: your consent to commercial electronic messages (if given).

3. Purposes and legal grounds

• Opening your account, providing the Service, crediting balance, invoicing and refunds: concluding and performing the contract (KVKK Art. 5(2)(c)).
• Issuing invoices, keeping accounting records and responding to requests from authorities: complying with legal obligations (Art. 5(2)(ç)).
• Enforcing regional restrictions and sanctions rules: legal obligation and legitimate interest (Art. 5(2)(ç) and (f)).
• Account security, preventing fraud and trial credit abuse, keeping the Service running properly: legitimate interest (Art. 5(2)(f)).
• Establishing, exercising and defending legal claims: Art. 5(2)(e).
• Campaign and announcement emails: your explicit consent (Art. 5(1)), which you can withdraw at any time.

4. How we collect data

We collect personal data electronically through the site, the console and the API, either from you or automatically while you use the Service (through server logs and cookies). Bank transfer sender details come from our bank account statements.

5. Transfers within Türkiye

For the purposes above only, personal data may be shared with our e-invoice / e-Arşiv provider [private integrator], our accountant, banks for payments and, once card payments launch, a payment institution, and with competent public authorities on request.

6. Transfers abroad

To provide the Service, personal data is transferred to the recipients below outside Türkiye. These transfers are made under Article 9 of the KVKK as amended by Law No. 7499: to countries with an adequacy decision; where there is none, by signing the standard contracts published by the Personal Data Protection Board and notifying the Authority; and where neither is possible, only occasionally and in the cases listed in Article 9(6) (for example, where the transfer is necessary to perform our contract with you).

• Hetzner Online GmbH (Germany, EU): server hosting; account, transaction and usage records are kept on these servers.
• Vercel Inc. (USA and global edge network): hosting of the website and console; your IP address and browser details are processed in the process.
• Model providers [provider names and countries]: the content of your API requests is passed to the relevant provider to generate the response. We don't store the content; the providers' own retention terms may apply.

7. Retention periods

We keep personal data for the periods below; afterwards it is deleted, destroyed or anonymized.

• Account and contract data: while the account is open and for [10 years] after it is closed.
• Payment, invoice and refund records: [10 years] (Tax Procedure Law and Turkish Commercial Code).
• Usage logs: [2 years].
• Session and security records: [1 year].
• Marketing consent: until you withdraw it.

8. Your rights under KVKK Article 11

By applying to the data controller, you can:

• Find out whether your personal data is processed,
• Request information about it if it is,
• Find out the purpose of processing and whether data is used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom it is transferred,
• Ask for it to be corrected if it is incomplete or inaccurate,
• Ask for it to be deleted or destroyed under the conditions in KVKK Article 7,
• Ask for corrections, deletions or destruction to be notified to the third parties it was transferred to,
• Object to a result against you that arises solely from automated analysis of your data,
• Claim compensation if you suffer damage from unlawful processing.

9. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply in writing to [İstanbul], to our KEP address [firma@hs01.kep.tr], or by email to destek@kervan.com.tr from the email address registered in our system. We will answer within 30 days free of charge; if the request involves extra cost, a fee may be charged under the tariff set by the Board. If your application is rejected or you find the answer insufficient, you can complain to the Personal Data Protection Board.