Ce texte a été traduit pour votre commodité. En cas de divergence entre la version turque et la traduction, la version turque prévaut.
Privacy Policy
In short
- We only process the data needed to provide the service. We don't sell your data or use it for advertising.
- Your chat messages are sent through OpenRouter to the model provider you choose so that a response can be generated.
- Your API keys, tokens and saved logins are stored encrypted.
- You can delete your account and all your data at any time from Account Settings.
1. Data controller
This policy has been prepared by [Nom complet / raison sociale de l'exploitant] (“we”), the operator of the AI Agent service (the “Service”), in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”). Address: [adresse postale]. For any question or request about personal data: [adresse e-mail de contact].
2. Personal data we process
| Category | Data | How it is collected |
|---|---|---|
| Identity and contact | Username, email address; optionally first and last name | Sign-up form, account settings |
| Account security | Password (stored as an irreversible hash), session data, login attempts | During sign-in and sign-up |
| Content | Chat messages and responses, files and images you upload, generated documents, notes, calendar events, agent memory, automation definitions and results, test cases, finance/watchlist records | Content you enter while using the Service or that the agent produces at your request |
| Integration details | OpenRouter API key, GitHub token and username, Jira URL/email/token, usernames and passwords you save so the agent can sign in to websites | Added by you in account settings (stored encrypted) |
| Usage and cost | Selected model, token counts, estimated/actual cost, automation run history | Recorded automatically by the Service |
| Technical security | IP address, browser information, request times | Processed automatically by the server and infrastructure provider |
Please don't enter special categories of personal data such as health, religion or biometric data, or other people's personal data, into conversations, documents or automations unless necessary. If you do, you confirm that you do so on your own responsibility and in a way that respects the rights of the people concerned.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5(2) / GDPR Art. 6(1)) |
|---|---|
| Creating your account, authentication and providing the Service (chat, research, browser automation, document creation, integrations) | Conclusion and performance of a contract |
| Running the automations you request on time and delivering results and reminders | Performance of a contract |
| Account security, preventing abuse and unauthorised access, attempt limits, fair-use quotas | Legitimate interest |
| Debugging, monitoring service quality and costs | Legitimate interest |
| Requests from competent authorities and legal obligations (e.g. Turkish Law No. 5651) | Legal obligation |
| Establishing, exercising or defending legal claims | Necessity for establishing a right / legitimate interest |
We don't use your personal data for advertising, profiling or marketing, and we don't sell it to third parties.
4. Recipients of personal data
To make the Service work, data is shared with the following parties, only to the extent necessary:
- OpenRouter, Inc. and the model provider you choose (e.g. OpenAI, Anthropic, Google, DeepSeek): your chat messages, the agent's tool outputs and system instructions are sent with your own API key so that a response can be generated. How these providers process data is governed by their own policies; in your OpenRouter privacy settings you can disable providers that log data.
- Search and page-reading services: for web searches the query is sent to a search engine (DuckDuckGo infrastructure); for page-reading requests the URL is sent to a content-reading service (Jina AI Reader). Websites the agent visits with the browser see the visit as a request from our server.
- GitHub and Jira (Atlassian): only when you connect these integrations yourself and ask the agent to perform a related action.
- Infrastructure providers: the network/CDN provider used to connect the site securely to the internet (Cloudflare, Inc.); Google Fonts, jsDelivr and cdnjs, which serve fonts and some browser libraries. These providers can technically see your IP address.
- Email service: notifications such as calendar reminders are sent to your email address through an email provider (Google Gmail SMTP).
- Competent public authorities: only where required by law.
5. International transfers
Many of the providers above (OpenRouter, model providers, Cloudflare, Google, GitHub, Atlassian) operate servers outside Türkiye, mainly in the United States and the European Union. Your data is therefore transferred abroad when you use the Service. Transfers are carried out in line with the procedures in Article 9 of the KVKK and only as far as necessary to perform the action you start. Because you choose the model provider yourself on OpenRouter, we recommend choosing providers that don't retain data for sensitive content.
6. Retention
- Account and content data: for as long as your account is open. When you delete a conversation, document or record, the related data is deleted.
- When your account is deleted: your account and all associated content, files and integration details are deleted immediately. Copies that may remain in system backups are deleted within the normal backup rotation cycle.
- Login/sign-up attempt records: deleted automatically after 15 minutes to 1 hour.
- Access logs: for as long as required by legal obligations (Turkish Law No. 5651 and secondary legislation).
- Data held by third parties: data sent to OpenRouter and model providers is subject to their own retention policies.
7. Security
Passwords are stored as irreversible hashes; API keys, tokens and saved logins are stored encrypted and are not shown even to administrators. Connections are encrypted with HTTPS, login and sign-up attempts are rate-limited, and the agent is prevented from reaching internal network addresses and running commands on the server. Even so, no system is entirely risk-free; if we become aware of a data breach, we will notify the Turkish Personal Data Protection Board under Article 12 of the KVKK (and, where applicable, the competent supervisory authority under the GDPR) and the affected users.
8. Shared conversations
Your conversations are visible only to you by default. If you create a share link for a conversation, anyone with the link can view it without signing in. Shared pages are marked as closed to search engines, but we can't prevent the link from being passed on. You can turn sharing off at any time; a disabled link stops working.
9. Your rights under Article 11 of the KVKK
By contacting us you can:
- learn whether your personal data is processed and, if so, request information about it;
- learn the purpose of processing and whether the data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom the data is transferred;
- request correction of incomplete or inaccurate data;
- request erasure or destruction of the data within the framework of Article 7 of the KVKK;
- request that corrections and erasures be notified to the third parties to whom the data was transferred;
- object to a result against you arising exclusively from automated analysis;
- claim compensation if you suffer damage due to unlawful processing.
You can exercise your right to delete your account and data directly under Account Settings → Delete account. For other requests, write from your registered email address to [adresse e-mail de contact]. Requests are answered free of charge within 30 days at the latest. If you are not satisfied with the answer, you can lodge a complaint with the Turkish Personal Data Protection Board.
10. EU/EEA and UK users (GDPR)
If you use the Service from the European Union, the European Economic Area or the United Kingdom, your personal data is also processed under the General Data Protection Regulation (GDPR / UK GDPR). The data controller is the operator named above.
- Legal bases (Art. 6(1)): performance of a contract to provide your account and the Service (b); legitimate interest in security, preventing abuse and improving the service (f); legal obligations (c).
- Your rights: access, rectification, erasure, restriction of processing, data portability and objection; and the right to lodge a complaint with the data protection supervisory authority in your country. You can request a copy of your data in a machine-readable format.
- International transfers: transfers outside the EU/EEA (including to Türkiye and the United States) rely, where possible, on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.
- Automated decision-making: we don't make decisions about you based solely on automated processing that produce legal effects.
11. Age limit
The Service is not intended for people under 18. We close accounts that we know belong to people under 18.
12. Changes
We may update this policy. We will announce significant changes on the site or by email before they take effect. The current version is always on this page. For details about cookies, see the Cookie Policy.