KVKK Disclosure Text

Within the scope of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by the following legal entity as the data controller: Company: eCloud Yazılım Teknolojileri Address: Şanlıurfa, Turkey Email: [email protected] Platform: aigency.dev As eCloud Yazılım Teknolojileri, we show the utmost sensitivity regarding the security of your personal data. This disclosure text has been prepared within the scope of Article 10 of KVKK and the Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation of Disclosure.

The following categories of personal data are processed through the AIGENCY platform: • Identity Information: Name, surname, username • Contact Information: Email address, phone number • Account Information: Password (encrypted), account creation date, account type • Transaction Security: IP address, session information, log records, device information • Financial Information: Billing address, payment history (credit card info stored by payment provider) • Usage Data: Platform usage statistics, preferences, AI interaction data • Marketing: Communication preferences, notification settings

Your personal data is processed for the following purposes: • Performing membership operations and account management • Providing and improving AIGENCY platform services • Personalizing AI models and optimizing user experience • Executing payment and billing transactions • Responding to customer support requests • Ensuring platform security and preventing unauthorized access • Fulfilling legal obligations (tax legislation, KVKK, etc.) • Statistical analysis and reporting (with anonymous data) • Conducting information and communication activities (with explicit consent)

Your personal data may be shared with the following parties within the scope of Articles 8 and 9 of KVKK: • Legal Authorities: Authorized public institutions in case of court orders, prosecution requests, or legal obligations • Payment Providers: Payment institutions for secure execution of payment transactions (minimum necessary information only) • Infrastructure Providers: Server and cloud service providers (under data processing agreements) • Business Partners: With limited and anonymous data to improve service quality Your data is not transferred abroad without your explicit consent. In case of international transfer, the conditions specified in Article 9 of KVKK are complied with.

Your personal data is retained for the period required by the processing purpose: • Account Information: As long as the account is active and deleted within 30 days of account deletion request • Transaction Security Data: Retained for 2 years as required by Law No. 5651 • Financial Data: Retained for 5 years as required by Tax Procedure Law No. 213 • AI Interaction Data: Deleted upon account deletion request • Communication Records: Retained for 3 years from support requests After the retention period expires, personal data is deleted, destroyed, or anonymized in accordance with KVKK and related legislation.

You have the following rights under Article 11 of KVKK: • Learning whether your personal data is processed • Requesting information if your personal data has been processed • Learning the purpose of processing and whether they are used in accordance with their purpose • Knowing the third parties to whom your personal data is transferred domestically or abroad • Requesting correction of your personal data if processed incompletely or incorrectly • Requesting deletion or destruction of your personal data within the framework of the conditions prescribed in Article 7 of KVKK • Requesting notification of correction and deletion operations to third parties to whom your personal data has been transferred • Objecting to the emergence of a result against you through the analysis of processed data exclusively through automated systems • Requesting compensation for damages in case your personal data is processed unlawfully Application Method: To exercise the above rights, you can send an email to [email protected] with identity verification documents. Your applications will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request. If the process requires additional cost, the fee determined by the Personal Data Protection Board will be charged.