KVKK Privacy Notice

1. Identity of the data controller

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is LenaRise. This notice is issued under Article 10 of the KVKK and explains why your personal data is processed when you use the LenaRiseOS platform, on what legal ground, who it is transferred to, and what rights you hold.

• Legal name: LenaRise
• Address: [to be completed]
• Trade registry (MERSİS) number: [to be completed]
• Tax office and number: [to be completed]
• Registered electronic mail (KEP) address: [to be completed]
• Phone: [to be completed]
• Email: [email protected]

2. Categories of personal data processed

The data processed is not limited to what you provide at sign-up; it also covers the records created as you use the platform:

• Identity: first name, last name.
• Contact: email address, phone number, brand website.
• Customer transactions: subscription and trial records, plan selection, support correspondence, your approval and rejection decisions.
• Financial: billing name, billing address, tax or national identification number, payment references. Your card details are never stored by LenaRise; they are held by the payment institution.
• Transaction security: IP address, session records, sign-in attempts, device and browser information, API key usage, audit trail entries.
• Brand and content data: brand voice, colour palette, personas, no-gos, the images and text you upload, and the content produced on the platform.
• Connected account data: usernames, access tokens and publishing records for the social accounts you connect.

LenaRiseOS does not seek to collect special categories of personal data (health, biometrics, religion, political opinion and the like), and such data should not be uploaded. The content of the free text and images you upload is under your control; if you upload personal data belonging to third parties, establishing the legal basis for it is your responsibility.

3. Purposes of processing

• Creating your account, verifying your identity and managing your session.
• Concluding and performing the subscription agreement; starting the free trial and tracking its remaining time.
• Billing, collection and keeping accounting records.
• Building your brand memory so the modules (Agency, Social, Design, LenaChat) can produce output specific to you.
• Publishing content to the social accounts you connect, with your approval, and measuring its performance.
• Keeping the platform secure, detecting abuse and unauthorised access, and maintaining the audit trail.
• Answering support requests and communicating with you.
• Improving the service, debugging faults and producing aggregate usage statistics.
• Meeting statutory obligations and responding to requests from competent authorities.
• Where you have given explicit consent: sending product announcements and marketing messages.

4. Legal grounds for processing

Each purpose above rests on one of the following grounds in KVKK Article 5:

• Art. 5/2-c — Directly related to the conclusion or performance of a contract: account creation, subscription, trial, billing, running the modules.
• Art. 5/2-ç — Compliance with a legal obligation: invoicing and accounting records, requests from competent authorities.
• Art. 5/2-e — Establishment, exercise or protection of a right: retaining consent and transaction records in case of a dispute.
• Art. 5/2-f — Legitimate interests: platform security, abuse detection and service improvement. Processing on this ground is balanced so that it does not harm your fundamental rights and freedoms.
• Art. 5/1 — Explicit consent: taken only for marketing messages and for cross-border transfers where the law requires consent. You may withdraw consent at any time; withdrawal does not make earlier processing unlawful.

5. Transfers of personal data

Your personal data is not sold. It is transferred to the following parties only to the extent needed to provide the service:

• Hosting and infrastructure providers.
• Payment and collection institutions.
• Email and notification delivery providers.
• Artificial intelligence model providers — the prompts sent for content generation and analysis fall in this category.
• The social media platforms you connect — only the content you approve for publication.
• Competent public authorities where required by law.
• Independent auditors and the legal and financial advisers we engage.

Your data is hosted in Türkiye as a rule. Because some of the providers above are located abroad, transfers outside Türkiye are made where necessary under KVKK Article 9, relying on standard contractual clauses, an undertaking, or another safeguard permitted by law. Current provider list and destination countries: [to be completed].

6. Method of collection

Data is collected electronically, by wholly or partly automated means: sign-up and payment forms, your actions inside the panel, calls made with your API key, cookies and similar technologies, the interfaces of the third-party platforms you connect, and support correspondence.

7. Retention periods

Personal data is retained for as long as the purpose requires, taking into account the limitation periods set by law. Once the period expires, data is deleted, destroyed or anonymised.

• Account and brand data: [to be completed] after the account is closed.
• Invoicing, payment and accounting records: for the period required by tax and commercial legislation (as a rule, ten years).
• Session, sign-in and transaction security records: [to be completed].
• Support correspondence: [to be completed].
• Marketing consent records: [to be completed] after consent is withdrawn.

8. Your rights as a data subject

Under KVKK Article 11 you may apply to the data controller and request to:

• Learn whether your personal data is being processed.
• Request information about it if it has been processed.
• Learn the purpose of processing and whether the data is used accordingly.
• Know the third parties in Türkiye or abroad to whom the data is transferred.
• Have incomplete or inaccurate data corrected.
• Have the data erased or destroyed under the conditions in KVKK Article 7.
• Have corrections, erasures and destructions notified to the third parties the data was transferred to.
• Object to a result to your detriment arising from analysis carried out solely by automated systems.
• Claim compensation if you suffer damage due to unlawful processing.

Some of these rights can be exercised directly from the panel: under Profile → Security → KVKK you can download a full copy of your data or request the deletion of your account.

9. How to apply

You may submit your requests through the channels below, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application is concluded within thirty days at the latest and is free of charge as a rule; where the process incurs a separate cost, the fee in the Board's tariff may apply.

• Written application address: [to be completed]
• Registered electronic mail (KEP) address: [to be completed]
• From the email address registered in our system: [email protected]
• From the panel: Profile → Security → KVKK

If your application is refused, the answer you receive is unsatisfactory, or no answer is given in time, you may file a complaint with the Personal Data Protection Board within thirty days of learning the answer and in any event within sixty days of your application (KVKK Article 14).

10. Automated analysis and artificial intelligence

LenaRiseOS uses your brand memory to produce content, visuals and analysis, and the approvals you give feed that memory. The outputs are SUGGESTIONS and pass through your approval before anything is published.

No decision producing legal effects concerning you, or significantly affecting you, is taken solely by automated means. If you believe you have encountered such a case, you may exercise your right to object under KVKK Article 11 through the channels above.

11. Changes to this notice

This notice may be updated to reflect changes in the law or in our service. The current version is always published at this address and the effective date is shown at the top of the page. Updates that materially change its scope are additionally notified by email before they take effect.