KVKK Disclosure and Explicit Consent Notice

Legal basis: Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), Art. 10 (disclosure) and Art. 5/2 (explicit consent). This text is Turkish law — there is no equivalent German or EU statute with the same article numbers; it supplements the Privacy Policy.

1. Data Controller

The organization operating the saaskaya platform is the "data controller" under KVKK. Contact: destek@saaskaya.com.

2. Disclosure Obligation (KVKK Art. 10)

This text is prepared to inform you about the processing of your personal data. The data processed, purposes, legal bases, recipients, and your rights are explained below.

3. Personal Data Processed

• Identity/matching: email address
• Contact: magic link, contact-form messages
• Transaction security: IP, session cookie, browser information
• Financial: payment provider customer ID, subscription status (no card data)
• Service content: the description given to the AI, generated site content

4. Purposes of Processing

• Account creation and authentication
• AI site generation and chat-driven editing
• Subscription, payment, and domain management
• Security and abuse prevention
• Fulfilling legal obligations (logs, invoicing)

5. Legal Bases (KVKK Art. 5/2)

• Performance of a contract: data required for the subscription and site publishing
• Legal obligation: log retention, legal requests
• Legitimate interest: security, rate-limiting, abuse prevention
• Explicit consent: beta invitation, marketing (obtained separately)

6. Data Transfer

Your personal data may be transferred to the following third parties:

• AI providers (DeepSeek, Anthropic): your site description and chat text — transfer abroad with appropriate safeguards under KVKK Art. 9
• Creem: handles checkout, tax/invoicing, and payment processing as Merchant of Record/payment facilitator for subscription/digital-product payments
• Stripe: payment processing where used as a transition/fallback payment provider
• Cloudflare R2: image storage
• Resend/SMTP provider: transactional email
• Domain registrar (Porkbun/NameSilo): domain owner information for WHOIS

7. Explicit Consent Statement

By accepting a beta invitation and creating an account, you give your explicit consent to the processing and transfer to third parties of your personal data for the purposes stated above. You can withdraw this consent at any time by writing to destek@saaskaya.com; withdrawing consent may require deleting your account.

8. Your Rights (KVKK Art. 11)

• Learn whether your personal data is being processed
• Request information if it is
• Query the purpose of processing and whether it's used accordingly
• Request correction of incomplete/incorrect data
• Request deletion or destruction
• Request that third parties it was shared with are informed
• Object to results of automated analysis

Requests must be made in writing to destek@saaskaya.com; they are answered within 30 days.

9. Data Retention Periods

• Account data: for as long as the account is active + 30 days after a deletion request
• Logs: 90 days
• Backups: 14-day rolling window

10. Children's Data

We do not knowingly process the data of people under 18. The service is not offered with parental consent either — saaskaya is intended for adult professionals.

11. Contact and Requests

Contact the data controller at: destek@saaskaya.com