Data Protection Notice (KVKK)
Last updated: · Version: 2026-09-12
Draft text. This document must be reviewed by a lawyer before publication; the current version is informational and not final.
This English version is provided for information only. The agreement is governed by Turkish law and the Turkish text prevails in case of any discrepancy.
This notice has been prepared under article 10 of Law no. 6698 on the Protection of Personal Data (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. The Privacy Policy, which describes the service as a whole, is a separate document; this text sets out the purpose, legal basis, transfers and retention periods for each category of data.
1. Identity of the Data Controller
| Legal name | YouReply Teknoloji Ticaret Eğitim Danışmanlık Araştırma Organizasyon A.Ş. |
| Address | Hacettepe Üniversitesi Teknoloji Geliştirme Bölgesi, Beytepe Kampüsü, 6. Ar-Ge Binası C Blok, Çankaya / Ankara |
| Phone | +90 532 317 20 23 |
| info@youreply.com.tr | |
| MERSIS no | 0982 1041 0030 0001 |
| Trade registry no | 495271 |
| Tax office / no | Doğanbey Vergi Dairesi / 9821041003 |
For requests concerning the protection of personal data: kvkk@youreply.com.tr
2. Allocation of Roles
For account, billing and usage data, the Company is the data controller. For customer content uploaded to the Platform or pulled in through connectors, the rule is that the customer who owns the account is the data controller; for that data the Company acts as a data processor. The allocation of roles follows the agreement between the parties and the actual flow of data. The obligations the Company undertakes as a data processor are set out in article 5 of the Privacy Policy.
3. Categories of Personal Data Processed
- Identity and contact: name and surname, e-mail address, telephone number, the name of the organisation you work for
- Customer transaction: plan, order record, invoice details, payment reference
- Transaction security: IP address, session and access records, error logs
- Usage: the number of rows analysed, the time of the analysis, project and source records
- Analysed content: the texts you upload or pull in through connectors and the personal data of third parties that those texts may contain
- Connector credentials: password, application key, authorisation header
- Contact form messages: name, e-mail, telephone (optional), subject and message content
4. Purpose and Legal Basis by Category
| Data category | Purpose of processing | Legal basis (KVKK) |
|---|---|---|
| Identity and contact | Creating the account, managing sessions, providing the service | Directly related to the conclusion or performance of a contract (art. 5/2-c) |
| Customer transaction | Taking the order, collecting payment, issuing the invoice | Performance of a contract (art. 5/2-c) and compliance with a legal obligation (art. 5/2-ç) |
| Transaction security | Preventing unauthorised access, resolving errors, keeping records | Legal obligation (art. 5/2-ç) and legitimate interest (art. 5/2-f) |
| Usage | Calculating plan entitlements (rows, data sources, users) | Performance of a contract (art. 5/2-c) |
| Analysed content | Running the analysis and presenting the result to the customer | The legal basis relied on by the customer as data controller; for this data the Company is a data processor |
| Connector credentials | Pulling data from the connected source | Performance of a contract (art. 5/2-c) |
| Contact form messages | Responding to the request | Legitimate interest (art. 5/2-f) |
| Marketing communication | Sending commercial electronic messages | Explicit consent (art. 5/1) |
The legal basis that applies to special categories of personal data is explained separately in article 8.
5. Method of Collection
- Account and invoice details: through the registration and purchase forms, directly from you
- Usage and security records: automatically, by the Platform and the server infrastructure
- Analysed content: through file uploads parsed in your browser and through the pulls connectors make from third-party systems
- Contact form messages: through the web form on the marketing site
All data is collected electronically, by automated or partly automated means.
6. Recipient Groups and Purpose of Transfer
| Recipient group | Data transferred | Purpose of transfer |
|---|---|---|
| Language model provider | The text of the rows sent for analysis | Running the analysis |
| E-mail infrastructure provider | Name, e-mail address, message content | Sending transactional e-mails and form messages |
| Payment institution | Card and payment details | Collecting payment |
| Hosting provider | All data processed on the Platform | Providing the server and database infrastructure |
| Financial advisory and accounting | Invoice and order records | Statutory bookkeeping and declaration obligations |
| Authorised public institutions | The data requested | Requests for information and documents arising from legislation |
The names of the recipients, the types of data processed and the places where processing takes place are listed in the sub-processor table in article 6 of the Privacy Policy.
7. Transfers Abroad
The following transfers are made abroad:
- Analysed texts: to OpenAI servers outside Türkiye
- E-mails: to Amazon Web Services servers in the European Union (Frankfurt, eu-central-1)
- Embedded map: when the map on the contact page loads, the visitor IP address is sent to Google
Article 9 of the KVKK requires a basis for these transfers. This text does not declare that a completed transfer mechanism is already in place; work to establish that basis (standard contract, undertaking or explicit consent) is ongoing and this article will be updated once it is complete. The current status can be obtained from kvkk@youreply.com.tr.
8. Special Categories of Personal Data
The Company does not request special categories of personal data in order to provide the service and does not envisage processing such data. The texts you send for analysis may contain special categories of personal data such as health, belief, political opinion or trade union membership. Not processing such data without meeting the conditions in article 6 of the KVKK, and removing or masking it before upload, is the obligation of the customer as data controller. The Platform offers no automatic masking or anonymisation feature; the responsibility therefore sits before upload.
9. Retention Periods
| Item | Retention period |
|---|---|
| Account records | For as long as the account is open; deleted or anonymised when the account is closed |
| Project and source rows | Until you delete them or close the account; deleting a source permanently deletes its rows |
| Analysis results | Until you delete the analysis. Deleting a source does not remove the copies of text and quotations held in an analysis result (see article 9 of the Privacy Policy) |
| Connector credentials | Encrypted, until the connector is deleted; if you choose not to store them, only in memory for the duration of the pull |
| Application and security logs | For as long as the purpose of processing requires |
| Database backups | Deleted after 90 days |
| Contact form messages | Not written to the database; kept in the corporate mailboxes that receive the message for as long as the purpose of processing requires |
| Billing records | For the retention period required by legislation |
Data whose period has expired is deleted, destroyed or anonymised under the Company's retention and disposal practice.
10. Rights of the Data Subject
Under article 11 of the KVKK you have the right to:
- Learn whether your personal data is being processed
- Request information about it if it has been processed
- Learn the purpose of processing and whether the data is used in line with that purpose
- Know the third parties in Türkiye or abroad to which the data has been transferred
- Request correction if the data has been processed incompletely or incorrectly
- Request erasure or destruction within the framework of article 7 of the KVKK
- Request that correction, erasure and destruction be notified to the third parties to which the data has been transferred
- Object to a result against you arising from analysis carried out solely by automated systems
- Claim compensation if you suffer damage because of unlawful processing
11. How to Apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller you may submit your application in one of the following ways:
- By sending an e-mail to kvkk@youreply.com.tr from the e-mail address registered in our system
- By sending or hand-delivering a signed petition, together with a document evidencing your identity, to Hacettepe Üniversitesi Teknoloji Geliştirme Bölgesi, Beytepe Kampüsü, 6. Ar-Ge Binası C Blok, Çankaya / Ankara
Your application must state your name, surname, signature (for written applications), Turkish identity number, address for notification, the e-mail address and telephone number for notification if any, and the subject of your request. Applications are concluded as soon as possible and within thirty days at the latest, depending on their nature; if the process requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is refused, your right to complain to the Board is reserved.
12. Changes
This notice may be updated. The current version is published on this page and the document revision shown at the top of the page is changed.