KVKK Information Notice
Under Article 10 of Turkish Law No. 6698 (KVKK): which personal data we process, for what purpose and on what legal basis, who we share it with, and your rights.
Last updated: 19 July 2026 · Version v1.1
This notice is issued under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the related Communiqué on the procedures for fulfilling the duty to inform. For our general practices see the Privacy Policy; for cookies see the Cookie Policy.
1. Identity of the data controller
| Data controller | Birileri Dış Ticaret Danışmanlık Sanayi ve Ticaret Limited Şirketi |
|---|---|
| Brand | Smartifie |
| MERSİS | 0177070525100001 |
| Trade registry no | 227539 — Izmir Trade Registry |
| Tax office / Tax ID | Karşıyaka Tax Office / 1770705251 |
| Address | Bahariye Mah. 1865 Sk. Karadoğan Blok No: 9, İç Kapı No: 1, Karşıyaka / İZMİR |
| Phone | +90 555 561 45 47 |
| info@smartifie.com | |
| KEP | kayacan.kirpikli@hs01.kep.tr |
| KVKK contact person | Kayacan Kırpıklı — kayacan.kirpikli@smartifie.com |
2. Our role depends on the product variant
| Variant | Your business data | Account, licence, payment, support |
|---|---|---|
| Device-local (Windows/Android/iOS/macOS) | Stays on your device, never reaches us — you are the controller | We are the controller |
| Cross-platform / cloud | On our servers (Türkiye) — we are the processor, you are the controller | We are the controller |
| Custom DB add-on | On your own database server; we do not store your credentials — we are the processor | We are the controller |
3. Personal data we process
| Category | Data |
|---|---|
| Identity | Name, surname, (where required for invoicing) national ID / tax number |
| Contact | E-mail, phone, billing address |
| Customer transactions | Product/plan purchased, licence records, subscription history, support requests |
| Financial | Payment records, invoice details (card numbers are not stored by us) |
| Transaction security / technical | IP address, device and browser information, device fingerprint for licence activation, session and audit logs |
| Account security | Whether your e-mail is verified; if you enable two-factor authentication, the authenticator secret and recovery codes; a short-lived cookie recording that your password was confirmed recently for a sensitive action; a record if two-factor authentication was reset. No phone number is collected — an authenticator app is used instead of SMS. |
| AI assistant | The content of messages you write to the assistant and product context; token usage counters |
| Marketing (if any) | Only if you give explicit consent: newsletter subscription |
4. Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Opening the account, issuing and verifying the licence, delivering the product | Art. 5/2-c — conclusion/performance of the contract |
| Taking payment, issuing invoices, accounting records | Art. 5/2-ç — legal obligation (Tax Procedure Law, Commercial Code) |
| Handling support requests | Art. 5/2-c — performance of the contract |
| Preventing licence piracy and abuse | Art. 5/2-f — legitimate interest |
| Account security: e-mail verification, two-factor authentication, password re-confirmation, rate limiting | Art. 5/2-f — legitimate interest; Art. 12 — data security obligation. Not based on consent. |
| Operating the AI assistant | Art. 5/2-c — performance of the contract (the assistant is part of the product) |
| Analytics cookies (Google Analytics) | EXPLICIT CONSENT |
| Marketing e-mail (not sent today) | EXPLICIT CONSENT + Law 6563 / IYS permission |
5. Method of collection
We collect your data electronically and by automated means: through website forms, account creation and sign-in, checkout, licence activation and periodic verification calls, the in-product AI assistant, support e-mails, and cookies that depend on your consent.
6. Recipients and transfers abroad
| Recipient | Purpose | Country |
|---|---|---|
| Anthropic PBC | Generating the AI assistant's reply | USA |
| Google Ireland/LLC | Analytics — only with your consent | EU/USA |
| Iyzico | Taking payment in Türkiye | Türkiye |
| Paddle | Merchant of Record for sales outside Türkiye: payment, invoice, tax | EU / UK |
| Pentech Bilişim Teknolojileri San. ve Tic. Ltd. Şti. | Server hosting (VM) — all data held on the server | Türkiye — Bursa |
| Google Play · App Store · Trendyol · Amazon | Distribution and collection if you purchased via that channel | USA / TR |
| Competent public authorities | Legal obligation (Art. 8/2-a) | Türkiye |
Your data is not sold for marketing.
7. Retention periods
| Data | Period |
|---|---|
| Invoice, payment, accounting records | 10 years (Commercial Code Art. 82) |
| Account, licence, subscription records | While the account exists + 10 years to the extent tied to invoicing |
| Support correspondence | 3 years after the request is closed |
| Audit and security logs — raw IP address | 90 days; the raw IP is then deleted, only city/country remains. Deletion runs automatically once a day. |
| AI assistant chat content | Not stored on our servers; only token usage counters are kept |
| Two-factor authentication secret and recovery codes | While two-factor authentication is on; deleted when it is turned off or reset by our support team |
| Password confirmation (step-up) cookie | 15 minutes |
| Cookie consent record | In your browser's localStorage, until you delete it |
8. Data security
We apply encryption in transit and at rest, access control, logging and regular security audits (KVKK Art. 12). In the event of a data breach we notify the Board within 72 hours and inform you as soon as possible.
Account-specific measures. Starting a trial, buying a plan and linking a device require a verified e-mail address. Two-factor authentication is optional on every account and required for accounts that manage billing, seats or other people's access (authenticator app; no SMS). For sensitive actions such as removing a device or changing billing details, your password is requested again. If you lose both your phone and your recovery codes, our support team can reset two-factor authentication; you are notified by e-mail when this happens.
9. Your rights (KVKK Art. 11)
You have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties to whom it is transferred at home or abroad; to request correction if it is incomplete or inaccurate; to request erasure or destruction where the conditions are met; to request that correction, erasure and destruction be notified to those third parties; to object to a result adverse to you arising from analysis solely by automated systems; and to claim compensation if you suffer damage due to unlawful processing.
You may send your requests to kayacan.kirpikli@@smartifie.com or info@@smartifie.com, or to our registered electronic mail (KEP) address. We respond free of charge within 30 days at the latest. If you find our reply insufficient, you may complain to the Turkish Personal Data Protection Board.
10. Where explicit consent is collected
The duty to inform and explicit consent are fulfilled separately. This page is the information notice only; where explicit consent is required, it is collected on the screen of the relevant action, separately and never pre-ticked: the cookie notice for analytics cookies, the subscription form for commercial e-mail. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.
11. Changes
We update this notice from time to time; the version number and last-updated date change with every revision. Questions: info@@smartifie.com.