KVKK privacy notice
In accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, we explain how your personal data is processed.
Last updated:
This English version is a courtesy translation. The Turkish version is legally binding; where the two differ, the Turkish text prevails. Read the Turkish version
Data controller
The data controller for your personal data is Mehmet Konukçu, who provides the Koldash service (Türkiye). You can contact the data controller at gizlilik@koldash.app. For a general overview of our privacy practices, see the Privacy policy.
Categories of personal data processed
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Identity and contact | Name, email address, email verification status | Creating and managing the account, communication | Art. 5(2)(c) (performance of a contract) |
| Account security | Hashed password, session record, IP address, browser/device information, session lifetime | Authentication, account and service security | Art. 5(2)(c) (performance of a contract), Art. 5(2)(f) (legitimate interest) |
| Meeting content | Meeting title and purpose, transcript, AI suggestions, summary, context, custom terms and file text | Providing the transcription, suggestion and summary service | Art. 5(2)(c) (performance of a contract) |
| Live audio stream | Audio processed during the meeting (not recorded and not stored) | Transcribing the audio live | Art. 5(2)(c) (performance of a contract) |
| Screenshot | A single screenshot, taken only when Look at Screen is used (kept in memory until the meeting ends; not stored) | Generating answers and suggestions from what’s on screen | Art. 5(2)(c) (performance of a contract) |
| Template | Template name, purpose, languages, custom terms, additional context text, text of context files | Personalizing meeting preparation and suggestions | Art. 5(2)(c) (performance of a contract) |
| Customer transactions and usage | Trial, minute pack and subscription details, minutes and tokens used, order and payment records | Defining entitlements, invoicing, monitoring fair use, accounting and tax obligations | Art. 5(2)(c) (performance of a contract), Art. 5(2)(ç) (legal obligation), Art. 5(2)(f) (legitimate interest) |
| Error reports | Error type, stack trace, route, environment, version, internal user ID | Detecting and fixing errors, service reliability | Art. 5(2)(f) (legitimate interest) |
We do not store your card details; payments are collected through a third-party payment service provider. The “Inference” section of meeting summaries does not infer personality, health, ethnic origin, religion, political opinion or sexual orientation.
Purposes of processing
- Creating, verifying and managing your account,
- Transcribing meeting audio live and generating suggestions and an end-of-meeting summary,
- Storing your templates and meeting history in your account,
- Defining your trial, pack and subscription entitlements, measuring usage and invoicing,
- Keeping the service secure and preventing abuse and quota circumvention,
- Responding to your support requests and data subject requests,
- Meeting our obligations under the law.
Legal bases
- Performance of a contract (Art. 5(2)(c)): your data must be processed to provide the service.
- Legal obligation (Art. 5(2)(ç)): obligations such as keeping invoice, payment and accounting records for the period required by law.
- Legitimate interest (Art. 5(2)(f)): keeping the service secure and preventing abuse, provided this does not harm your fundamental rights and freedoms.
- Transfer abroad (Art. 9): your data is transferred to service providers abroad on the basis of the standard contracts announced by the Personal Data Protection Board, one of the appropriate safeguards provided for in Article 9 of the Law.
Method of collection
Your data is collected electronically, by automated or partly automated means, when you create an account, sign in, prepare templates and hold meetings through the macOS app, as well as through your purchases and the emails you send us. When an error occurs in the app, on the website or on the server, an error report is created automatically. No data is collected on the website for analytics or tracking.
Recipient groups
Your data is not sold and is not shared for advertising. It is transferred to the following recipient groups to the extent the service requires.
- Speech recognition provider (Soniox, USA): live audio stream and custom terms.
- AI provider (OpenAI, USA): transcript, template and preparation content, text of context files, and screenshots when Look at Screen is used (the latest ones are sent again with later AI requests in the same meeting, until the meeting ends).
- Hosting and database service providers: account, session, meeting, template and usage data.
- Payment service provider: purchase and payment information.
- Email delivery service provider (Resend): email address and the content of account emails (email verification and password reset links).
- Error monitoring service provider (Sentry, Functional Software, Inc., EU data region): error type, stack trace, route, environment, version and internal user ID. Transcripts, AI text, request bodies, cookies, email addresses, screenshots and session replays are not transferred.
- Authorized public authorities and institutions: upon request, within the scope of obligations arising from the law.
Your rights as a data subject
Under Article 11 of the Law, you can exercise the following rights by applying to the data controller.
- To learn whether your personal data is processed,
- If it has been processed, to request information about it,
- To learn the purpose of processing and whether the data is used in line with that purpose,
- To know the third parties in Türkiye or abroad to whom the data is transferred,
- To request correction if the data is incomplete or inaccurate,
- To request deletion or destruction of the data under the conditions set out in Article 7 of the Law,
- To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
- To object to a result against you arising from the analysis of the processed data exclusively through automated systems,
- To claim compensation if you suffer damage due to unlawful processing.
How to submit a request
You can send requests concerning the rights above, with information that identifies you and a description of your request, from the email address registered to your account to gizlilik@koldash.app. Requests are handled in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.
You do not need to submit a request to delete your account: you can delete it yourself from your account page on the website or in the macOS app via Settings → Account → “Delete Account…”. Data linked to a deleted account is kept for 90 days and then permanently deleted. Details are in the privacy policy.
Depending on its nature, your request is concluded free of charge within 30 days at the latest. If the action requires an additional cost, a fee according to the tariff set by the Personal Data Protection Board may be charged.
If you find the response to your request insufficient, you retain the right to file a complaint with the Personal Data Protection Board within 30 days of learning of the response, and in any case within 60 days of the date of your request.