DRAFT — This text has not been legally reviewed and is not final.

Privacy Notice (KVKK)

Last updated: 01.11.2026

This notice is given under Article 10 of Turkey's Personal Data Protection Law No. 6698 ("KVKK") and the related Communiqué on the duty to inform. It explains how your personal data is processed when you use the feednik.com website and the Feednik app (the "Service"). More detail is in our Privacy Policy; the two documents are consistent.

This notice is for information only; you are not asked to consent to it. For processing based on explicit consent (e.g. marketing emails) your consent is asked separately, optionally and with an unticked box; not giving it does not stop you from using the Service.

1. Data controller

[DATA CONTROLLER / COMPANY NAME], Yumurtacı Abdi Bey Cad. No:4, Kadıköy, Istanbul, Türkiye. Email: readarlyapp@gmail.com · KEP: [REGISTERED E-MAIL ADDRESS (KEP)] · MERSIS: [MERSIS NUMBER]

2. Categories of personal data

• Identity: handle, display name.
• Contact: email address.
• Customer transactions: profile type, role, description and goals, topics, countries, keywords, people and stocks you follow, publications you save, like or mark as not interesting, notes, company profile details, plan, trial and subscription status, notifications, what you write to us.
• User content: posts, polls, votes and files shared in rooms and discussions, direct messages, documents and links added to your library, and the text and summaries extracted from them.
• Transaction security: one-way password hash, session data, IP address, server access and error logs, AI usage records, device push token, moderation and report records.
• Marketing: only if you opt in, your marketing email preference.
• Legal transactions: consent records (document version, time, IP), requests from authorities and dispute records.

We do not aim to process special categories of personal data (health, religion, ethnic origin, etc.); please do not share them in the Service.

3. Purposes and legal grounds

• Creating and managing your account, personalised content, summaries, notifications and service emails, social features, library analysis, plans and subscriptions — establishment and performance of a contract (Art. 5/2-c).
• Information security, moderation, preventing abuse, fixing errors, improving the Service with aggregate statistics — legitimate interests (Art. 5/2-f).
• Obligations under Law No. 5651, tax law and other laws, requests from competent authorities — expressly provided by law and legal obligation (Art. 5/2-a, ç).
• Use as evidence in disputes, consent records — establishing, exercising or protecting a right (Art. 5/2-e).
• Public information about publication authors and well-known people in the "People" feature (name, title, public writings and talks) — data made public by the data subject (Art. 5/2-d) and legitimate interests. These people can also use their rights under Art. 11 and ask to be removed from the Service.
• Marketing, announcement and newsletter emails — explicit consent (Art. 5/1) and consent under Law No. 6563; we register in the Message Management System (İYS) before sending. No marketing emails are sent at present. You can withdraw consent at any time in Account settings or via the link in the email.

4. Processing with AI

For features such as summaries, impact notes, briefs, room summaries and moderation, publication content, a short summary of your profile, your questions, the text of your document when you ask for a library analysis, every post you share in rooms (for moderation before it is published), a small copy of images attached in rooms, and room posts for room summaries (with personal-data patterns removed) are sent to our AI provider Anthropic PBC (USA). Your email address, password, payment details and direct messages are not sent. We do not use your data to train our own models. Anthropic does not use the content we send to train its models. It generally deletes it within 30 days; content its automated systems flag as violating its usage policy may be kept for up to 2 years, and longer where the law requires. AI-generated summaries, answers and analyses are labelled "AI-generated" on publication pages and in AI features; the short summary lines on feed cards are also AI-generated. The AI relevance score, the personalised feed and automated moderation are not decisions with legal effect on you; under Art. 11(1)(g) you can object to a result against you arising solely from automated analysis (e.g. a blocked post) and ask for human review at readarlyapp@gmail.com.

5. Transfers

Within Türkiye: competent public authorities and courts, on request and as required by law.

Abroad (only as needed to provide the Service, to providers acting as data processors):

• hosting: [HOSTING PROVIDER] (servers in Germany, EU) and off-site backup: [OFF-SITE BACKUP PROVIDER AND COUNTRY];
• AI: Anthropic PBC (USA);
• email delivery: Resend, Inc. (USA) or an SMTP email service provider [PROVIDER IN USE AND COUNTRY];
• subscriptions: RevenueCat, Inc. (USA) — a pseudonymous user number with device and transaction data; payment is taken by Google Play and the Apple App Store;
• push notifications (if you allow them): Google Firebase Cloud Messaging (USA), Apple Push Notification service.

Third parties your browser contacts directly (they receive your IP address): Google Fonts and publishers' image servers. They are not data processors acting for us.

Transfers from Türkiye (KVKK Art. 9): Under KVKK our server in Germany also counts as abroad. The Turkish Data Protection Board has no adequacy decision for Germany or the USA, so we transfer data to these providers only under the standard contracts published by the Board, and we notify each signed contract to the Board within 5 business days of signing. We do not rely on the occasional-transfer exceptions in KVKK Art. 9(6) for the regular transfers needed to run the Service.

6. How data is collected

Your data is collected electronically, partly by automated means, through sign-up and profile forms, your use of the app and website, emails you send us, subscription notifications from the stores via RevenueCat, and server logs.

7. Retention

Your data is kept while your account is open; when you delete your account it is removed from the live system straight away and stays in on-server backups until the last 14 daily copies roll over (about 14 days). Sessions are kept for 30 days. Server and traffic logs are kept for [PERIOD — between 1 and 2 years] under Law No. 5651 Art. 5(3). AI usage records and usage statistics are anonymised and kept after account deletion; reports and moderation records are kept until the review is resolved + [6 months]. Tax and accounting records are kept for the statutory period. The detailed table is in section 8 of the Privacy Policy. When a period ends, data is deleted, destroyed or anonymised.

8. Your rights (KVKK Article 11)

By applying to the data controller you can:

• learn whether your personal data is processed,
• request information if it is,
• learn the purpose of processing and whether data is used accordingly,
• know the third parties in Türkiye or abroad to whom it is transferred,
• ask for correction if it is incomplete or inaccurate,
• ask for deletion or destruction under the conditions of KVKK Article 7,
• ask that correction, deletion or destruction be notified to third parties who received the data,
• object to a result against you that arises solely from automated analysis,
• claim compensation if you suffer damage from unlawful processing.

9. How to apply

You can download and correct your data and delete your account in Profile → Account settings. For other requests, under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply in writing to Yumurtacı Abdi Bey Cad. No:4, Kadıköy, Istanbul, Türkiye, by KEP to [REGISTERED E-MAIL ADDRESS (KEP)], using a secure electronic signature or mobile signature, or from the email address registered in your account to readarlyapp@gmail.com. Include your full name, contact details and your request. We resolve your application free of charge within 30 days at the latest; if the action involves an extra cost, the fee in the Board's tariff may be charged.

If your application is rejected, you find the answer insufficient, or we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of your application (kvkk.gov.tr).

Other documents: Terms of Use · Privacy Policy · Cookie Policy · Account and data deletion · Support