Privacy Policy
Draft · Awaiting legal review
DRAFT — needs legal review. This text is a working draft and is not yet in force.
This policy explains how Quvos handles personal data on quvos.io, quvos.dev and quvos.app. It is written to meet both the Turkish Personal Data Protection Law No. 6698 ("KVKK"), including the duty to inform (aydınlatma yükümlülüğü, Art. 10), and the EU/UK General Data Protection Regulation ("GDPR").
1. Who is responsible
For account, billing, security and website data, the data controller (veri sorumlusu) is [Company legal name], [address], MERSİS no. [MERSİS no], VERBİS registration [VERBİS registration].
- Privacy contact: [email protected]
- Data protection officer: [DPO contact]
- EU representative (GDPR Art. 27): [EU representative]
- UK representative: [UK representative, if needed]
For workspace content that customers put into Quvos (for example personal data in their repositories, documents or apps), the customer is the controller and Quvos acts as processor (veri işleyen) under our Data Processing Agreement. Questions about such data should go to the workspace owner first.
2. What we collect and why
| Data | Examples | Purpose | GDPR basis | KVKK basis (Art. 5) |
|---|---|---|---|---|
| Account data | name, e-mail, password hash, sign-in provider ID, 2FA data (TOTP secret, recovery code hashes, passkey public keys) | create and secure your account | contract (6(1)(b)) | 5(2)(c) performance of contract |
| Sign-in and activity data | sign-in IP, user agent, time, last activity | security, session management, inactivity policy | legitimate interests (6(1)(f)) | 5(2)(f) legitimate interest |
| Workspace content | projects, Git repositories, Agents, Skills, documents, knowledge base, chats with AI Agents, app and Agent telemetry, encrypted secrets | provide the Service | contract (6(1)(b)) | 5(2)(c) |
| Billing data | plan, invoices, billing address, tax ID, payment status | billing, accounting, tax | contract; legal obligation (6(1)(c)) | 5(2)(c), 5(2)(ç) legal obligation |
| Abuse signals | hashed IP and device fingerprint at sign-up, disposable-address checks, resource usage patterns | prevent fraud and abuse | legitimate interests | 5(2)(f) |
| Audit and support access logs | who did what and when, support access reasons | security, accountability | legitimate interests; legal obligation | 5(2)(ç), 5(2)(f) |
| Consent records | document, version, time and IP of acceptance | prove acceptance of terms | legal obligation; legitimate interests | 5(2)(ç), 5(2)(e) establishing a right |
| Communications | support tickets, abuse reports | answer you | contract; legitimate interests | 5(2)(c), 5(2)(f) |
We collect this data directly from you, from your use of the Service (automatically), from the identity provider you choose (Google, Microsoft or GitHub: name, verified e-mail and provider ID), and from payment providers (payment status). Card data is entered directly with Stripe or iyzico; Quvos never stores full card numbers.
We do not use personal data for advertising, do not sell it and do not make decisions with legal or similarly significant effects based solely on automated processing. Automated abuse signals may trigger throttling or a request for card verification; suspensions are reviewed by a person and can be appealed.
3. AI processing
To answer prompts, Quvos sends prompts and the relevant content to the AI model providers configured for your workspace. If you bring your own key (BYOK), that provider's terms apply to that traffic. Quvos does not train AI models on customer content, and we select providers whose terms prohibit training on it. [confirm]
4. Who receives data
- Sub-processors that run the Service: cloud hosting [GCP, hosting region], Stripe, iyzico, AI model providers [list], e-mail delivery [provider TBD]. The current list is in the DPA.
- Members of a Teams workspace see the names and e-mail addresses of other members and the content of that workspace.
- Authorities, where required by law or a binding order.
- A successor in a merger or acquisition, subject to this policy.
5. International transfers
Some recipients are outside Türkiye and, for EU users, outside the EEA.
- KVKK: transfers abroad follow amended Article 9 of Law No. 6698. We rely on an adequacy decision where one exists; otherwise on appropriate safeguards, mainly the standard contracts published by the Personal Data Protection Board, notified to the Board within five business days of signature; and, for occasional transfers, the exceptions in Art. 9(6). [confirm per recipient]
- GDPR: we rely on adequacy decisions (including the EU-U.S. Data Privacy Framework where the recipient is certified) or the European Commission's Standard Contractual Clauses (and the UK Addendum), with supplementary measures where needed.
Primary hosting is in [hosting region]. You can ask for a copy of the safeguards at [email protected].
6. How long we keep data
- Account data: while the account exists. Free accounts inactive for 12 months get a notice, a second notice 30 days later, and are deleted 30 days after that. Paid accounts are not deleted for inactivity.
- Workspace content: until the workspace is deleted. A deleted workspace can be restored for 30 days, then it is purged and its data keys are destroyed, which makes backups unreadable.
- Backups: encrypted per-workspace backups for a plan-dependent period (Free 7 days, Pro 14, Max 30, Teams 30), plus database point-in-time recovery for [period TBD].
- Exports: downloadable for 7 days, then deleted.
- Billing records: as required by tax and commercial law (in Türkiye generally 10 years).
- Security, audit and abuse logs: [period TBD], longer only where needed for an investigation or legal claim.
When the retention period ends, data is deleted, destroyed or anonymised in line with the KVKK Regulation on the Deletion, Destruction or Anonymisation of Personal Data and our retention and destruction policy [link TBD].
7. Security
Passwords are stored only as hashes. Secrets are encrypted per workspace with a per-tenant data key. Sessions are bound to one workspace and use secure, HttpOnly cookies. Two-factor authentication is available. Support staff may access a workspace only read-only, for at most 8 hours, with a written reason; the owner is notified and sees the access log, and support never sees secret values, terminals or personal chats. More detail is in the security annex of the DPA.
8. Your rights
Under KVKK Article 11 you may: learn whether your data is processed; request information about it; learn the purpose and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request that correction or deletion be notified to recipients; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
Under GDPR Articles 15–22 you may: access your data (15); have it rectified (16); have it erased (17); restrict processing (18); be told about notified recipients (19); receive it in a portable format (20); object to processing based on legitimate interests (21); and not be subject to solely automated decisions with significant effects (22). Where processing is based on consent, you can withdraw it at any time.
Many rights can be exercised directly in account settings (edit profile, export, delete account). Otherwise write to [email protected]. KVKK applications may also be made in writing to [address] or by registered e-mail (KEP) to [KEP address], in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer within 30 days (KVKK) or one month (GDPR, extendable where allowed) and may need to verify your identity.
You may complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr) after applying to us, or to the supervisory authority of your EU/EEA country of residence or work, or the UK ICO.
9. Cookies
We use only strictly necessary first-party cookies. See the Cookie Policy.
10. Children
The Service is not directed at children under [16]. If you believe a child has given us data, contact [email protected].
11. Changes
We may update this policy. Material changes are announced in advance by e-mail or in the Service and, where required, we ask you to accept the new version. Each version is kept at https://quvos.io/en/legal/privacy.