Personal data notice (KVKK)

Data controller: Erkam Alper Özkan şahıs işletmesi (Alpiworks), Saimekadın Mah. Çalıkavak Cad. No: 7 İç Kapı: 10, Mamak / Ankara, Türkiye. Email: alper@alpiworks.com.

This notice is given to people who use Deckfy under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles of the Obligation to Inform. The detailed list of the data we process is in the Privacy policy.

Your personal data is processed to:

• open and manage your account,
• create, schedule and post carousels and report their results,
• take payments, invoice and keep sales records,
• prove that the agreement and pre-contract information were accepted,
• keep accounts secure, prevent abuse and fix errors,
• answer support requests,
• meet legal obligations and protect our rights in disputes.

Your personal data is processed on these grounds in Article 5(2) of the KVKK:

• it is directly related to entering into or performing a contract (c): your account, the service, connected accounts, support,
• it is needed to meet the controller's legal obligations (ç): invoices, sales records and agreement consents,
• it has been made public by the person concerned (d): public store reviews,
• it is needed to establish, exercise or defend a right (e): disputes,
• the controller's legitimate interest (f): security records and preventing abuse.

We currently do not rely on explicit consent for any processing.

Your personal data is collected electronically, by automated or partly automated means: directly from you at sign-up and in settings, from Google when you sign in with Google, from the Instagram and TikTok accounts you connect with your permission, from the App Store and Google Play pages of apps you add, from the payment provider, and from system logs created while you use the service.

Within the purposes above, your personal data may be shared with:

• our service providers: database and storage, AI generation, notifications, hosting and email services,
• the payment provider,
• Instagram (Meta) and TikTok, at your request,
• public authorities entitled by law,
• lawyers, courts and enforcement offices in a dispute.

Among our service providers, Supabase, Anthropic, OpenAI, Google and Expo are based in the United States, and your data may be processed on their systems outside Türkiye. Which data goes to which provider, and why, is set out in the Transfers abroad section of the Privacy policy.

We are working on putting in place the safeguards Article 9 of the KVKK requires for these transfers, and will update this notice when that is complete.

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is processed,
• request information about it if it is,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties it is transferred to in Türkiye or abroad,
• ask for incomplete or wrong data to be corrected,
• ask for it to be deleted or destroyed under Article 7,
• ask for corrections, deletions or destruction to be notified to those third parties,
• object to a result against you that comes solely from automated analysis,
• claim compensation for damage caused by unlawful processing.

To exercise your rights, send your request to alper@alpiworks.com from the email address registered to your Deckfy account, or in writing to the address above. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, include your name, your Turkish ID number if you are a Turkish citizen (otherwise your nationality and passport or ID number), your postal or email address for replies, and your request; written applications must be signed.

We resolve requests free of charge within 30 days at most, depending on their nature. If an action carries an additional cost, the fee set by the Personal Data Protection Board may apply. If your request is refused, you find the answer insufficient, or we do not answer in time, you can complain to the Board.