KVKK Privacy Notice

In accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and related legislation, Adyrra (the “Company” or “Data Controller”), the operator of the Nefin documentation and AI API routing platform (the “Platform” – adyrra.com), is the data controller that determines the purposes and means of processing your personal data and is responsible for establishing and managing the data filing system.

• Email: info@adyrra.com
• Platform website: adyrra.com

This Notice has been prepared to inform software developers using the Platform, tenant administrators and visitors of adyrra.com (“Data Subjects”) in a transparent and clear manner — in full compliance with Article 10 of the KVKK and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform — about how their personal data is collected, the purposes and legal grounds of processing, the parties to whom it is transferred, and their rights under Article 11 of the KVKK. This text is a unilateral disclosure statement and does not replace a declaration of explicit consent.

The personal data processed in connection with use of the Platform and the services provided is categorized below:

• Identity and Contact Data: Name, surname, corporate email address, phone number (if any), account verification information, and contact data shared in API access and tenant opening requests.
• Customer Transaction and API Usage Data: Tenant account configuration information, organizational slug structures created, API key (token / bearer token) usage metrics, quota and request-frequency records, technical support records and tickets.
• Transaction Security and Technical Data: Internet Protocol (IP) addresses, server and system access logs, request/response status codes (HTTP status codes), port information, user-interface and API-level error reports, operating system and browser/device information, session and security cookie records.
• AI Interaction and Content Data: User messages, text-based prompts and system instructions sent to the Platform via the Nefin API endpoints (in particular /t/<slug>/.../chat/completions and related sub-routing paths), together with the technical responses and telemetry data returned as a result of routing and processing these prompts.

Your personal data is collected in accordance with Articles 4, 5 and 6 of the KVKK through:

• Fully or partially automated methods:
  • Platform registration and profile creation interfaces,
  • Direct technical calls and data transmissions to the Nefin API endpoints,
  • Technical access logs kept by server software, databases and firewalls,
  • Mandatory technical cookies and analytics tools used on the adyrra.com website,
• Non-automated methods (provided they are part of a data filing system):
  • Support requests, forms and official correspondence sent in writing or electronically to the support center, official email channels or our administrative units,

In each case, the data is collected electronically, directly from the Data Subject or through tenant administrators authorized by the Data Subject.

Within the framework of the processing conditions in Article 5 of the KVKK, rather than general and vague legal grounds, each data category, concrete activity carried out and legal basis is expressly matched below:

Our Company does not base any processing activity on vague purposes that may arise in the future; it limits each processing purpose in line with the principles of data minimization and proportionality.

The personal data collected is transferred only to the following recipient groups and for the stated purposes, in full compliance with the conditions set out in Articles 8 and 9 of the KVKK and the principles of data security:

• AI model and service providers:
  • Recipient group: AI model providers selected via the Platform (Codex/OpenAI, Gemini/Google, Grok/xAI, Claude/Anthropic, etc.).
  • Purpose and scope of transfer: Limited transfer of the prompts and technical data that the user routes through the API to the /t/<slug>/.../chat/completions endpoints, solely to generate the requested API response, complete model routing and deliver the technical results to the user.
  • Legal ground and cross-border aspect: This transfer is a mandatory technical component for the performance of the service/terms of use agreed with the Data Subject (KVKK Art. 5/2-c). Where the model providers’ servers and technical infrastructure are located abroad, the transfer is carried out on the basis of the current transfer mechanisms set out in Article 9 of the KVKK (adequacy decision, appropriate safeguards, binding corporate rules or standard contracts approved by the Board), or, where those conditions are absent, in exceptional cases within the legal framework required by the legislation.
• Infrastructure, hosting and cloud service providers:
  • Recipient group: Secure technology suppliers that host the Platform’s databases, logging infrastructure and server hardware.
  • Purpose of transfer: Server hosting, system redundancy, ensuring data security and service continuity.
  • Legal ground: KVKK Art. 5/2 (c) (performance of contract) and Art. 5/2 (f) (legitimate interest in data security), together with the provisions of KVKK Arts. 8 and 9.
• Competent public authorities and judicial bodies:
  • Recipient group: Legally authorized ministries, administrative authorities, information security institutions, public prosecutors’ offices and courts.
  • Purpose of transfer: Fulfilling statutory notification obligations, judicial investigations and responding to court orders.
  • Legal ground: Fulfilment of legal obligations under KVKK Art. 5/2 (a) and Art. 5/2 (ç); KVKK Art. 8/1.

Prompts and data content that users transmit via the API is limited to the extent required by the technical transmission and model execution processes of the selected AI provider; it is not sold or transferred by our Company to third parties for commercial or advertising purposes.

Data processing activities on the Platform’s website (adyrra.com) are strictly separated by cookie type:

• Essential cookies: Strictly necessary for the site to function, for API documentation pages to be displayed, and for session continuity and security. These cookies are processed without requiring explicit consent under the legitimate interest and contract performance grounds of KVKK Art. 5/2 (c) and (f).
• Functional, performance and analytics cookies: Non-essential cookies used to save user preferences, measure site traffic or optimize services. They are disabled by default unless users make an active, freely given choice (opt-in) through the Cookie Preference Panel presented on first access to the website. The cookie notice and consent mechanism are operated independently of this Notice.

The Platform is an API routing and documentation infrastructure and does not request biometric data, health data, criminal conviction data or any other special categories of personal data under KVKK Art. 6 from users.

Data Subjects and tenant administrators are obliged not to include special categories of personal data in the prompt content they send to model endpoints via the API. If it is detected that unauthorized special categories of personal data have been included in the AI routing processes, our Company reserves the right to apply ex officio the necessary technical and administrative security measures (access restriction, masking, cryptographic measures, logging and destruction) determined in accordance with Articles 6 and 12 of the KVKK and the Personal Data Protection Board’s decision dated 31.01.2018 and numbered 2018/10.

Your personal data is retained for the periods required by the processing purposes and for the limitation and retention periods prescribed in the relevant legislation:

• System and access logs are retained for at least 2 (two) years in accordance with Law No. 5651 and related legislation,
• Account and contract data is retained for the general limitation periods (10 years) under the Turkish Code of Obligations and the Turkish Commercial Code,
• Instantaneous prompts and technical telemetry data transmitted via the API are retained, after model routing has been provided, only for the minimum period technically necessary for operational debugging and security verification.

If all processing conditions and grounds for retention cease to exist, personal data is deleted, destroyed or anonymized, ex officio or upon the Data Subject’s request, in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data and the Company’s Personal Data Retention and Destruction Policy. Data processors and third parties to whom personal data has been transferred are also notified immediately of the necessary destruction operations under KVKK Art. 11/1 (f).

As a data subject, you can apply to our Company at any time to exercise the following rights:

• Learning whether your personal data is processed,
• Requesting information if your personal data has been processed,
• Learning the purpose of processing and whether it is used in accordance with its purpose,
• Knowing the third parties to whom personal data is transferred, domestically or abroad,
• Requesting correction of personal data if it is incomplete or inaccurately processed, and requesting that this operation be notified to the third parties to whom the data has been transferred,
• Requesting deletion or destruction of personal data where the reasons requiring its processing have ceased to exist, even though it has been processed in accordance with the KVKK and other relevant laws, and requesting that this operation be notified to the third parties to whom the data has been transferred,
• Objecting to the emergence of a result against you through analysis of the processed data exclusively by automated systems,
• Claiming compensation for damages if you suffer damage due to unlawful processing of your personal data.

To exercise the rights above, you may submit your applications, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• From an email address registered in our system: From your verified email address registered in our system, to info@adyrra.com, writing “KVKK Data Subject Information Request” in the subject line.

Your application must include your name, surname, Turkish ID number (for foreigners, nationality, passport number or, if any, foreign ID number), residential or business address for notification, email address for notification, and the subject of the request, as required by legislation.

Our Company will conclude applications as soon as possible and within thirty (30) days at the latest, depending on the nature of the request, free of charge as a rule. If the process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged. Application processes are recorded and responses are delivered to the Data Subject by verifiable methods.

This Notice enters into force on the date it is published on the Platform. Our Company reserves the right to unilaterally revise this Notice in line with changes in legislation, Board decisions or updates to the Platform’s technical operations. The updated text becomes valid as soon as it is published on the adyrra.com website (/nefin/kvkk.html or /nefin/privacy.html). Log records proving that the disclosure was made, and the version history, are kept by the Data Controller.