Privacy Policy and KVKK Disclosure Notice

Last updated: 2026

This is an English translation of our Turkish privacy policy and KVKK ("Kişisel Verilerin Korunması Kanunu", Turkey's Law on the Protection of Personal Data, No. 6698) disclosure notice, provided for the convenience of our English-speaking readers. In the event of any discrepancy, the Turkish version is authoritative, and KVKK governs regardless of the language in which this notice is read.

Data Controller

This application is operated by [Company Name] ("we"). Under Law No. 6698 on the Protection of Personal Data ("KVKK"), we process your personal data, in our capacity as data controller, within the scope described below.

What Personal Data Is Collected?

While you use the application, we collect the following personal data:

  • The email address you provide at registration
  • Company profile information (company name and related corporate information)
  • The answers you provide during the survey process
  • Documents you upload for assessment purposes

Purpose of Collection

This data is processed in order to provide our legal risk X-ray service — that is, to evaluate your survey answers and the documents you upload in order to produce a legal risk analysis and report for your company.

Legal Basis

Your personal data is processed on the legal basis that it is necessary for the establishment and performance of the service agreement between us. For any processing activities not adequately covered by the performance of that agreement, your explicit consent is separately requested.

Who Your Data Is Shared With

The content of your survey answers and the documents you upload is sent to the API of OpenAI, L.L.C., headquartered in the United States, for the purpose of producing a legal risk analysis. This data is processed solely for that analytical purpose; OpenAI's policy of not using data received via its API for model training applies. Your company information, survey answers, and uploaded documents are held in a PostgreSQL database and file store hosted on Supabase infrastructure; this data is accessible only to the account holder of the relevant company. Our team accesses your data only in the course of a support request you have explicitly made, and solely to resolve that request.

Cross-Border Data Transfer

The OpenAI transfer described above constitutes a cross-border transfer of personal data under Article 9 of the KVKK. This transfer is based on the explicit consent you provide by accepting this Privacy Policy when you register for our service. If you wish to withdraw your consent, you may do so by closing your account and discontinuing use of the service, after which your survey answers and documents are no longer sent to OpenAI.

Website Usage Analytics and Ad Measurement

Separately from the service data described above, we use Google Analytics and Google Ads conversion tracking — only with your explicit consent (i.e. only if you accept the cookie banner at the bottom of the page) — to understand how our website is used and to measure the effectiveness of our advertising. These tools collect aggregated, anonymized statistics such as which pages you visit and whether you arrived via an ad; this is never linked to your survey answers, documents, or company information. This processing relies on your explicit consent under Article 5 of the KVKK and may constitute a cross-border data transfer due to Google's infrastructure; you can withdraw your consent at any time as described on our Cookie Policy page.

Retention Period

Your data is retained for as long as your account remains active. You may contact us to request the permanent deletion of your account or of a particular assessment; such requests are processed within a reasonable period.

Your Rights as a Data Subject

Under Article 11 of the KVKK, you have the right to apply to the data controller in order to:

  • Learn whether your personal data is being processed
  • Request information regarding such processing, if any
  • Learn the purpose of processing and whether the data is used in accordance with that purpose
  • Know the third parties, domestic or foreign, to whom the data is transferred
  • Request correction of the data if it has been processed incompletely or incorrectly
  • Request its erasure or destruction within the framework of the conditions set out in the KVKK
  • Request that any correction, erasure, or destruction carried out be notified to third parties to whom the data has been transferred
  • Object to a result that arises to your detriment as a consequence of the data being analyzed exclusively through automated systems
  • Request compensation for any damage you incur due to unlawful processing of your data

These headings are a general summary of the rights set out under Article 11 of the KVKK; they do not constitute legal advice.

Contact

For questions regarding our privacy policy or our data-processing practices, and for applications under the KVKK, you may contact us at destek@hukukcheckup.com.