1. About This Notice
This Turkish Data Protection Notice is provided in accordance with Law No. 6698 on the Protection of Personal Data (KVKK)— Turkey's primary data protection legislation, equivalent in purpose to the EU General Data Protection Regulation (GDPR).
This notice applies to users whose personal data is processed under Turkish jurisdiction alongside our general Privacy Policy. If you are located outside Turkey, your data is still protected under the standards described in our Privacy Policy, including GDPR where applicable.
Data Controller: Burak (individual developer, based in Turkey)
- Contact (including KVKK requests): support@viviq.co
- Website: viviq.co
The data controller currently operates as a sole individual. If this entity is later incorporated as a legal company, this section will be updated and users will be notified via in-app message or email.
2. Personal Data We Process
2.1 Identity & Contact Data
- Name, username
- Email address
2.2 Usage & Transaction Data
- App usage information (screens visited, features used)
- Credit usage history and subscription details
- Crash reports and performance data
- IP address and geographic region (for security and region detection)
- Device type, operating system, and app version
2.3 Visual Data (Photos)
Photos you upload are processed only during the analysis session and are permanently deleted from our servers once processing is complete. They are never stored, sold, or used to train AI models without your explicit consent.
2.4 Payment Data
All payments are processed by Apple App Store or Google Play. Viviq does not store or process credit card numbers or payment instrument details.
3. Legal Basis for Processing
| Purpose | Legal Basis (KVKK Art. 5) |
|---|---|
| Account creation and authentication | Performance of a contract (Art. 5/2-c) |
| Providing the photo analysis service | Performance of a contract (Art. 5/2-c) |
| Credit and subscription management | Performance of a contract (Art. 5/2-c) |
| Service improvement and error analysis | Legitimate interest (Art. 5/2-f) |
| Security and fraud detection | Legitimate interest (Art. 5/2-f) |
| Legal compliance | Explicit legal obligation (Art. 5/2-a) |
4. Data Transfers
4.1 Domestic Transfers (Within Turkey)
Personal data may be shared with competent public authorities where legally required, in accordance with KVKK Article 8.
4.2 International Transfers (KVKK Art. 9)
To operate the Service, we transfer certain data to the following international sub-processors. Each is bound by a Data Processing Agreement (DPA); EU-origin transfers use Standard Contractual Clauses (SCCs).
| Company | Role | Data Shared | Country |
|---|---|---|---|
| Anthropic | AI photo analysis (Claude API) | Photo content (deleted after processing) | USA |
| OpenAI | AI image editing — image-to-image (Pro feature) | Photo content (deleted after processing; not used for model training per OpenAI API policy) | USA |
| fal.ai | AI visual generation — text-to-image (Pro feature, alternate engine) | Generated prompt only (no source photo transmitted) | USA |
| Supabase | Database, authentication, and backend | Account data, usage data, credit balance | EU / USA |
| RevenueCat | Subscription and in-app purchase management | Subscription status, purchase history | USA |
Transfers are carried out where the destination country provides adequate protection, or under appropriate safeguards as required by KVKK Article 9.
5. Retention Periods
| Data Category | Retention Period |
|---|---|
| Account and identity data | While account is active + 30 days after deletion request |
| Usage and transaction data | 2 years from last activity |
| Uploaded photos | Immediately deleted after analysis (never stored permanently) |
| Subscription and payment records | 5 years (tax compliance; held by Apple/Google) |
| Security and access logs | 1 year |
6. Your Rights Under KVKK (Article 11)
If your data is processed under Turkish jurisdiction, you have the right to:
- Know whether your personal data is being processed.
- Request information about the processing if it is.
- Learn the purpose of processing and whether it is used accordingly.
- Know the recipients — third parties to whom data has been transferred, domestically or abroad.
- Request correction of incomplete or inaccurate data.
- Request erasure or destruction where conditions under KVKK Article 7 are met.
- Request notification to third parties of any correction or erasure.
- Object to automated decisions that produce adverse effects on you.
- Claim compensation for damages arising from unlawful processing.
7. How to Submit a Request
To exercise any of the above rights, contact us at:
- Email: support@viviq.co
- Website: viviq.co
We will respond within 30 (thirty) days of identity verification, free of charge. Where a request involves additional cost, the fee schedule set by the Personal Data Protection Authority (KVKK Board) applies.
If your request is rejected, deemed insufficient, or left unanswered, you have the right to file a complaint with the Personal Data Protection Authority of Turkey (KVKK Board) at kvkk.gov.tr.
8. Security
We implement technical and administrative measures — including HTTPS encryption, access controls, secure storage, and regular security audits — in compliance with KVKK Article 12 obligations.
9. Cookies
For details on our use of cookies, please see our Cookie Policy.
10. Updates
This notice may be revised to reflect changes in applicable law or our data processing activities. Material changes will be communicated via in-app notification or email.