KVKK Disclosure Text

Within the scope of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by the following legal entity as the data controller: Company: eCloud Yazılım Teknolojileri Email: [email protected] Platform: aigency.dev As eCloud Yazılım Teknolojileri, we show the utmost sensitivity regarding the security of your personal data. This disclosure text has been prepared within the scope of Article 10 of KVKK and the Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation of Disclosure.

The following categories of personal data are processed through the AIGENCY platform: • Identity Information: Name, surname, username • Contact Information: Email address, phone number • Account Information: Password (encrypted), account creation date, account type • Transaction Security: IP address, session information, log records, device information • Financial Information: Billing address, payment history (credit card info stored by payment provider) • Usage Data: Platform usage statistics, preferences, AI interaction data • Marketing: Communication preferences, notification settings

Your personal data is processed for the following purposes: • Performing membership operations and account management • Providing and improving AIGENCY platform services • Personalizing AI models and optimizing user experience • Executing payment and billing transactions • Responding to customer support requests • Ensuring platform security and preventing unauthorized access • Fulfilling legal obligations (tax legislation, KVKK, etc.) • Statistical analysis and reporting (with anonymous data) • Conducting information and communication activities (with explicit consent)

Your personal data may be shared with the following parties within the scope of Articles 8 and 9 of KVKK: • Legal Authorities: Authorized public institutions in case of court orders, prosecution requests, or legal obligations • Payment Providers: Payment institutions for secure execution of payment transactions (minimum necessary information only) • Infrastructure Providers: Server and cloud service providers (under data processing agreements) • Business Partners: With limited and anonymous data to improve service quality Your data is not transferred abroad without your explicit consent. In case of international transfer, the conditions specified in Article 9 of KVKK are complied with.

Additional data categories and purposes processed for the following V4.1 features: • Knowledge Base (KB): Files you upload and the text chunks and numerical vector embeddings derived from them. Purpose: semantic search only within your own chats. Legal basis: your explicit consent and performance of contract. • Scheduled Tasks: Task title, prompt text, selected assistant, cron schedule, run result summary, and status records. Purpose: automatic execution at the time you set and email notification (if enabled). Legal basis: performance of contract. • Deep Research: Research query, the response saved in the chat, and monthly usage counter. Purpose: providing multi-source research and monitoring plan quota. Legal basis: performance of contract and legitimate interest (abuse prevention). • Canvas Editor: Documents you create in the editor (title, content, language/mode), and daily AI edit counter. Purpose: providing editor service and monitoring plan quota. Legal basis: performance of contract. • Advanced Memory: Memory summary associated with your account and last update time. Purpose: providing cross-chat user context (only in chats where the toggle is on). Legal basis: your explicit consent. • API Access (apps): Application records you create (name, domain, allowed endpoint list, credit balance, API key) and api_logs (endpoint, status code, IP, user agent). Purpose: providing API service, abuse detection, and billing. Legal basis: performance of contract and legal obligation. This data is NOT used in AI model training and is not shared with third parties, including providers, for marketing purposes.

Your personal data is retained for the period required by the processing purpose: • Account Information: As long as the account is active and deleted within 30 days of account deletion request • Transaction Security Data: Retained for 2 years as required by Law No. 5651 • Financial Data: Retained for 5 years as required by Tax Procedure Law No. 213 • AI Interaction Data (chats, KB documents, task records, research results, canvas documents, memory summaries): Deleted within 30 days of account deletion request; when a KB is deleted, related files and embeddings are permanently removed • API Logs (api_logs): Retained for 12 months for abuse detection and billing control • Backups: Data in system backups is automatically deleted within 90 days at most through backup rotation • Communication Records: Retained for 3 years from support requests After the retention period expires, personal data is deleted, destroyed, or anonymized in accordance with KVKK and related legislation.

You have the following rights under Article 11 of KVKK: • Learning whether your personal data is processed • Requesting information if your personal data has been processed • Learning the purpose of processing and whether they are used in accordance with their purpose • Knowing the third parties to whom your personal data is transferred domestically or abroad • Requesting correction of your personal data if processed incompletely or incorrectly • Requesting deletion or destruction of your personal data within the framework of the conditions prescribed in Article 7 of KVKK • Requesting notification of correction and deletion operations to third parties to whom your personal data has been transferred • Objecting to the emergence of a result against you through the analysis of processed data exclusively through automated systems • Requesting compensation for damages in case your personal data is processed unlawfully Application Method: To exercise the above rights, you can send an email to [email protected] with identity verification documents. Your applications will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request. If the process requires additional cost, the fee determined by the Personal Data Protection Board will be charged.