Legal
KVKK Notice
This notice is prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data. It explains for what purpose and on what legal ground we process your personal data, and how you can exercise your rights.
1. Identity of the data controller
The data controller is Agentscope Yapay Zeka Teknolojileri A.Ş., whose full trade name, MERSİS number, address and e-mail address appear in the details at the top of this page.
This notice covers the services at agentscope.ai, hyper.agentscope.ai and platform.agentscope.ai. For the data of our enterprise customers, the data controller is the relevant organization; in that relationship our company acts as a data processor.
2. Personal data processed, purposes, legal grounds and retention
The table below shows every category of personal data we process, with the purpose, the legal ground under Article 5 of the Law, and the retention period for each.
| Data category | Purpose | Legal ground (Law No. 6698, Art. 5) | Retention |
|---|---|---|---|
| Identity and contact: first name, last name, e-mail address, organization name, profile image | Creating the account and providing the service | Art. 5/2-c — necessary for the conclusion and performance of a contract | For as long as the account is open; deleted on request |
| Customer transaction: conversation content, uploaded files, agent configurations | Providing the service and producing the answer | Art. 5/2-c — performance of a contract | For as long as the account is open; deleted on request |
| Transaction security: sign-in records, session records, audit trail, IP address on rate-limit violations | Ensuring security, preventing abuse, legal evidence | Art. 5/2-f — legitimate interest; Art. 5/2-e — establishment of a right | Kept for security and legal evidence; on request the link to your identity is severed |
| Marketing form data: name, e-mail address, company name, message, campaign parameters | Handling contact and demo requests | Art. 5/2-f — legitimate interest (responding to your request) | 24 months from last contact |
| Newsletter record: e-mail address | Sending commercial electronic messages | Art. 5/1 — explicit consent | Until you withdraw your consent |
| Analytics: named usage events, country code | Improving the product and the interface | Art. 5/1 — explicit consent (cookie consent) | 12 months |
| Finance: subscription and payment records | Managing the subscription, invoicing | Art. 5/2-c — performance of a contract; Art. 5/2-ç — legal obligation | The period required by tax legislation |
| Bug report: report text, browser details, optional screenshot | Fixing defects | Art. 5/2-f — legitimate interest | Screenshot 90 days; report text until resolved |
We do not collect special categories of personal data (such as health, religion or biometrics) and you should not enter such data into the platform. If you enter such data into a conversation of your own volition, it is processed within the customer transaction category and the responsibility is yours.
3. How personal data is collected
Your personal data is collected by wholly or partly automated means, through the following channels:
- Filling in the contact, demo or newsletter forms on our websites.
- Registering for and using the platform.
- Cookies and similar browser technologies, if you give consent.
- Contacting us by e-mail.
- An enterprise customer inviting you as a user.
4. Parties to whom data is transferred and the purpose
Within the framework of Article 8 of the Law, and only to the extent necessary to deliver the service, your personal data is transferred to the following parties:
- Our cloud infrastructure and AI model providers — to operate the service.
- Our analytics provider — only if you give consent, to improve the product.
- Our bot protection and e-mail delivery providers — for security and communication.
- Authorised public institutions — only where a legal obligation applies.
The full list of providers and the data that reaches each of them is in the tables of the Privacy Policy.
We do not sell or transfer your personal data to third parties for marketing purposes.
5. International transfers
The core of the service runs inside the European Union (Germany and the Netherlands). Nevertheless, the following processing leaves the European Union and constitutes an international transfer under Article 9 of the Law:
| Recipient and country | Purpose of transfer | Data transferred |
|---|---|---|
| Google Cloud — multi-region endpoint | Running the default AI models | Conversation content and uploaded documents |
| Google Cloud — United States | Running the relevant model, only when it is selected | Conversation content and uploaded documents |
| Cloudflare — global network | Bot protection | IP address at the moment of verification |
| Resend — United States | Sending sign-in codes and invitation e-mails | E-mail address and name |
| Slack — United States | Notifying the team of a form submission | E-mail address and company name from the form |
The Turkish Personal Data Protection Board has not issued an adequacy decision for these countries. Work to put in place the appropriate safeguards under Article 9 of the Law (standard contract) is in progress for these transfers; this notice will be updated once it is complete. To obtain information on the current legal basis of a transfer, write to the address in the details above.
Analytics data is processed, by deliberate choice, on a service hosted inside the European Union and is not transferred outside it.
6. Your rights as a data subject
Under Article 11 of the Law, by applying to the data controller you have the right to:
- Learn whether your personal data is processed.
- Request information if it has been processed.
- Learn the purpose of processing and whether the data is used in accordance with that purpose.
- Know the third parties to whom the data is transferred, in Türkiye or abroad.
- Request correction if the data is incomplete or inaccurate.
- Request deletion or destruction within the conditions of Article 7 of the Law.
- Request that correction, deletion and destruction be notified to the third parties to whom the data was transferred.
- Object to an adverse outcome arising from analysis carried out exclusively by automated systems.
- Claim compensation if you suffer damage due to unlawful processing.
For processing based on consent (newsletter and analytics) you may withdraw your consent at any time. Withdrawal does not render the processing carried out until that point unlawful.
7. How to apply
To exercise your rights you can send your request through one of the following channels:
- By writing to the e-mail address in the details above, from the e-mail address registered in our system.
- By a signed written petition to the address in the details above, together with a document verifying your identity.
- From within the application: you can delete your account and its content yourself via the account deletion step in settings; no separate application is needed for a deletion request.
Your application must clearly state your name, surname, contact details and the subject of your request. Depending on its nature, your request is concluded free of charge as soon as possible and within thirty days at the latest; if the process requires an additional cost, the fee in the tariff set by the Board may be charged.
On a deletion request, the personal content in your account is deleted; in records we are legally required to keep, the link to your identity is severed and you are informed of this.
If your application is rejected or no reply is given within thirty days, you may lodge a complaint with the Personal Data Protection Board: kvkk.gov.tr.
8. Updates
This notice may be updated in line with changes in legislation or in our processing activities. The effective and last-updated dates at the top of the page show which text applies.
Agentscope Yapay Zeka Teknolojileri A.Ş.