KVKK Privacy Notice

Categories, purposes and collection

Identity and contact (email), school/role, authentication and session, exam content and audio, usage and security records are collected electronically from users, administrators and application operations. Purposes are identity and access management, providing the exam workspace and requested AI/audio functions, security, audit and support.

Public access and demo requests

When the form is enabled, your full name, email address, request type, interface language, organisation and optional message are collected electronically from you. Organisation is mandatory for demo requests. These details are processed on the server and stored with restricted access in Supabase to evaluate and manage your request; Vercel provides hosting. Abuse protection uses keyed HMAC summaries, with no raw IP address stored in application request records. Contact fields are not supplied to AI providers or analytics events. The form does not create an account, grant access, send an automatic reply to the applicant or create a marketing subscription. When enabled, the configured SMTP email service processes only the request type, submission time and administration-page link for an internal notification to an authorised organisational inbox. Contact fields and the message are excluded; mail-server acceptance does not prove delivery.

Request records are kept for 90 days from submission and deleted by the daily cleanup after that period; abuse-prevention state expires after 48 hours and is also cleaned up daily. Backup and hosting-log retention has not been verified. The 90-day database cleanup does not delete notification-provider records or copies in recipient mailboxes; their retention must be assessed separately. The applicable legal grounds for responding to prospective users and preventing abuse, and the international transfer safeguards described below, require final verification before production collection. Reading this notice is not treated as consent to unrelated processing.

Legal grounds

Core account, access and exam processing is assessed under the legal grounds for establishing or performing a contract, meeting legal obligations and legitimate interests where applicable. Optional Clarity analytics and session recording are based on your explicit consent, which can be withdrawn from Cookie Preferences. These grounds and each processing activity require final legal review.

Recipients and transfers

Data may be shared with Supabase (authentication, database, storage), OpenAI (requested generation/audio), Vercel (hosting and cookieless analytics) and, with consent, Microsoft Clarity (session analytics). When enabled, the configured SMTP email service delivers internal notifications containing only request type, time and an administration link. Some processing may take place abroad. The actual locations, contractual safeguards and lawful international transfer mechanism have not yet been verified for this pilot.

Your rights

Under Article 11, you may learn whether your data is processed; request information; learn purposes and whether data is used accordingly; know recipients in or outside Türkiye; request correction or deletion/destruction where conditions apply and notice to recipients; object to a result against you produced solely by automated analysis; and seek compensation for unlawful processing damage. Contact info@agilekoc.com to make a request; we may need to verify your identity and the legally required application method. We will respond within the statutory period, at most 30 days.