KVKK Information Notice

1. Data Controller

The data controller is [ŞİRKET UNVANI / LEGAL NAME — e.g. Ad Soyad – Aymam Yazılım] ("Aymam AI"). Address: [AÇIK ADRES / REGISTERED ADDRESS]. Tax office / number: [VERGİ DAİRESİ / TAX OFFICE] / [VERGİ KİMLİK NO / TAX ID]. E-mail: [E-POSTA / EMAIL — e.g. destek@aymam.ai]. Registered e-mail (KEP): [KEP ADRESİ / REGISTERED E-MAIL (KEP) — if any].

Important: a shop that uses Aymam AI for its own business is the data controller for its own customers' data (for example, people who message it on Instagram); Aymam AI processes that data only on the shop's behalf and instructions, as a data processor. Shop customers should direct requests about their rights to the shop first; requests sent to us are forwarded to the shop.

2. Personal Data Processed

• Identity and contact: name, business name, phone / WhatsApp number, e-mail address, Instagram and Telegram usernames and IDs.
• Customer transactions: messages and commands sent via WhatsApp, Telegram and Instagram, product and price information, FAQs, post drafts, subscription and order details.
• Visual and audio records: product photos you send and the images and videos generated from them; for the Komşu service, security-camera footage and the event descriptions generated from it.
• Financial: billing details and payment status (card details are processed by the payment provider and never stored by us).
• Security: IP addresses, system and access logs.

3. Purposes

• Concluding and performing the service contract: content generation, scheduling and publishing posts, replying to messages, camera monitoring and alerts.
• Account management, customer support and running the free trial.
• Invoicing, payment tracking and meeting legal obligations.
• Information security, abuse prevention and improving service quality.
• With your explicit consent, sending product and campaign announcements.

4. Collection Method and Legal Grounds

Your data is collected by automated or partly automated means through WhatsApp, Telegram and Instagram messages, forms on our website, authorized access to Meta platforms (official APIs), and, for Komşu, connected camera streams.

It is processed on these grounds under KVKK Article 5(2): concluding or performing a contract (c), legal obligations (ç), establishing, exercising or protecting a right (e), and our legitimate interest provided it does not harm your fundamental rights (f). Marketing communications and other cases that require it rely on your explicit consent (Article 5(1)).

5. Recipients and International Transfers

Your data is shared with the following providers only as far as needed to deliver the service:

• Amazon Web Services (server hosting — Frankfurt, Germany)
• Meta Platforms (WhatsApp Business Platform and Instagram Graph API)
• Google (Gemini API — AI processing of text, images and video; under paid API terms, data is not used to train models)
• [ÖDEME KURULUŞU / PAYMENT PROVIDER — e.g. Stripe] (payment processing — card details are never stored on our systems)
• Telegram (only for users who choose to receive notifications on Telegram)
• Our e-mail service provider (contact and notification e-mails)

Because these providers' servers are located outside Turkey, data is transferred abroad. Transfers rely on the safeguards provided by KVKK Article 9, primarily the standard contracts published by the Turkish Personal Data Protection Board.

Data may also be shared with competent public authorities on request and with our accountant to meet legal obligations. We do not sell your data or give it to third parties for advertising.

6. Retention

• Instagram messaging records: up to 12 months.
• Account, product and content data: for the duration of the subscription; deleted within 30 days after it ends.
• Free-trial data: deleted when the trial ends.
• Camera footage and event logs (Komşu): [SÜRE / PERIOD — e.g. 30 gün / 30 days].
• Invoices and accounting records: the periods required by the Turkish Tax Procedure Law and Commercial Code (5–10 years).
• Security and access logs: up to 6 months.

7. Your Rights

Under KVKK Article 11 you may learn whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties in Turkey or abroad it is transferred to; request correction of incomplete or inaccurate data; request deletion or destruction under the conditions of Article 7; request that these actions be notified to recipients; object to an outcome against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.

Send requests in writing to [AÇIK ADRES / REGISTERED ADDRESS], via KEP to [KEP ADRESİ / REGISTERED E-MAIL (KEP) — if any], or from the e-mail address registered with us to [E-POSTA / EMAIL — e.g. destek@aymam.ai], in line with the Communiqué on the Procedures for Applications to the Data Controller. Requests are answered free of charge within 30 days at the latest.