KVKK Disclosure Notice

As VeriTeknik Bilişim Basın ve Yayın Ltd. Şti., we process your personal data as data controller under the Personal Data Protection Law No. 6698 (KVKK). Data controller: VeriTeknik Bilişim Basın ve Yayın Ltd. Şti. Address: Kültür Mahallesi Yüksel Caddesi No:29/16 Çankaya Ankara Tax office: Mithatpaşa Tax number: 9240436283 Email: gdpr@veriteknik.com

Your personal data is processed for the following purposes: • Performance of service contracts • Customer relationship management • Billing and payment transactions • Providing technical support • Fulfilling legal obligations • Security and fraud prevention • Statistical analysis For AI assistant connections, the purposes are to manage authorization and permission boundaries, carry out your requested operations, return results to your assistant, obtain required approvals, enforce spend caps and audit operational security. Notifications inform you about connection, security, approval and service operations.

Your personal data is processed based on the following legal grounds specified in Articles 5 and 6 of KVKK: • Your explicit consent • Establishment or performance of a contract • Fulfillment of legal obligations • Our legitimate interests • Establishment, exercise or protection of a right

Categories of personal data processed: • Identity information (name, surname, ID number) • Contact information (phone, email, address) • Financial information (bank account, billing info) • Transaction security information (IP address, log records) • Customer transaction information (order, request history) • Connection record: application name, user and company association, permission groups, spend cap, creation, use, expiry and revocation dates; hashes of authorization codes, access and refresh tokens; approval requests and a short-lived tool-result cache. • Tool inputs sent by your assistant on your behalf: operational data such as server, domain and support ticket identifiers, file paths, read-only diagnostic commands, DNS values and support messages. • Data returned by tools according to your request and permissions: company members’ identity and organizational information (email, title, role, membership and access history); customer and staff names in support communications; server names, IP addresses, domains, DNS values and configurations; balances, spending, prices, tax, invoices, payment status and method, refunds and contracts; support messages and activity history. • Content and activity read from your servers at your request: file contents and paths, logs, usernames, connection IP addresses and times, processes, containers, backup information and command output. Monitoring and service history may include availability, latency, certificate status, events, bandwidth and snapshot information. • Server command records: who ran which command on which server, when, its exit code and standard output/error output (stdout/stderr). Audit and traffic records may include IP address, time, action, user and browser information. The MCP connection does not ask for card details and does not store or use card details for payment operations; card fields are removed from operation inputs. Free-form content such as support messages, files and command output may contain personal data. Do not include card details or secrets in this content.

Data is collected electronically through website and customer hub forms, service operations and support communications; operational security data is collected through system logs. For AI assistant connections, after OAuth authorization in which you select a company and permission groups, data is collected through requests your assistant sends to our MCP endpoint and the results those requests produce in our service systems.

• The AI assistant provider you choose to connect (for example, OpenAI for ChatGPT or Anthropic for Claude) receives tool results and, where needed, an approval link at your request. That provider processes data under its own privacy policy. • For domain availability checks, only the queried domain name is sent to the selected registrar (Alastyr, OpenProvider or DomainNameAPI, depending on configuration). Domain registration is a separate operation and may require registrant information. • When you request a TLS certificate, Let's Encrypt receives the domain and the email address you supply, or your account email if you do not supply one. • For notification delivery, the email delivery service (Google in the default SMTP configuration; the service used may differ), Slack, Telegram, Bird SMS and browser push services receive the recipient address/phone/chat identifier and notification content according to the channel. Delivery depends on the event type, linked channels and notification preferences; security notifications require email delivery. Support notifications may include ticket information. Meta WhatsApp is used only for other eligible notifications; MCP connection, approval and administrative-command notifications are not sent through that channel. • Sentry is used for error monitoring. Collection of user information, cookies, HTTP headers and bodies, URL query parameters, AI inputs/outputs, database query data and local variables is disabled in the configuration. • Cloudflare Turnstile receives the verification token and IP address for bot protection at sign-in. • Publication operations you request make DNS records and web files public. Servers or package repositories contacted by network diagnostics and administrative commands may receive request data depending on the command. • Data is shared with infrastructure, payment and e-invoice service providers to deliver the service, and with competent authorities when legally required. • Memory derived from a notification subject is processed in the Morpheus memory service; the text is sent to the configured embedding service to create a numerical representation for similarity searches. • Advertising conversion measurement: when the advertising integration is configured, a completed VPS order may send the gclid advertising click identifier, conversion action, event time, order value and currency to Google Ads; it may send the oppref advertising reference, order event identifier, event type and time, source page address and channel information, value, currency and product details (product code, name, type, quantity, value and currency) to OpenAI (ChatGPT Ads). The purpose is to measure which advertisement led to the order. This includes VPS orders placed through an MCP connection. Order attribution relies on an advertising click captured when you accepted marketing cookies. For orders placed outside the browser, previously recorded consented advertising attribution on your account is used; it is not used if recorded marketing consent has been withdrawn. The recorded marketing preference is checked again before sending to OpenAI, and nothing is sent if consent has been withdrawn. In the Email Security Posture flow, when a gclid is present and the Google Ads integration is configured, a completed scan and a lead converted into a sale may send the click identifier, conversion action, event time, value and currency to Google Ads. The scan sends a value of TRY 0; a lead converted into a sale sends the recorded sale value and TRY. The purpose is to measure which advertisement led to the scan or sale. These sending paths do not check the marketing cookie preference; rejecting cookies does not automatically stop these sends. To stop order measurement that depends on marketing consent, write to gdpr@veriteknik.com to withdraw the marketing consent recorded on your account. Rejecting marketing in the cookie banner stops new advertising attribution from being recorded in that browser; on its own it does not withdraw consent already recorded on your account. You can also send objections to advertising measurement in the Email Security Posture flow to this address.

Among the recipients above, AI assistant providers and international notification, certificate and bot protection services (for example, OpenAI, Anthropic, Slack, Telegram, Let's Encrypt and Cloudflare) may process data outside Turkey. When you connect an AI assistant and request an operation, tool results are sent to your chosen provider on your instruction. The KVKK provisions on international transfers apply to these transfers. Google (Google Ads) and OpenAI (ChatGPT Ads), which receive the data described above for advertising conversion measurement, may also process data outside Turkey in this role.

AI assistant connections are valid for 90 days. Connection records are deleted 2 years after revocation or expiry; those linked to paid orders are kept with the order for 10 years. The record of a billable operation (VPS creation or domain registration) whose outcome remains unresolved, and its associated connection record, are retained until reconciliation is complete; the 2-year deletion rule above does not apply to these records. Approval requests are valid for 15 minutes and the short-lived retry cache of a tool result for 10 minutes; they are deleted 24 hours after they expire. Periods for other data categories are explained in the Retention Periods section of the Privacy Policy.

You have the following rights under Article 11 of KVKK. You can use the application methods below to exercise these rights.

You can apply in writing or by other methods determined by the Personal Data Protection Board to exercise your rights.