Data Processing Notice (KVKK Article 10)
DRAFT – This text has not yet been reviewed by legal counsel. The binding version will replace it here.
Purpose and identity of the controller
This notice is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform natural persons who use the First You service about how their personal data is processed.
Controller: İsterdim Ki Dijital Platform İşletmeciliği Limited Şirketi (First You). Address: Osmanağa Mah. Söğütlüçeşme Cad. Palas Elektronikçiler Çarşısı No: 7 İç Kapı No: 6, Kadıköy / İstanbul, Türkiye. MERSİS number: 0481145653800001. Registered electronic mail (KEP): -. Phone: +90 532 570 44 10. Contact for personal data matters: halisemre@gmail.com.
Categories of personal data processed
- Identity and contact data: email address, language preference, Telegram user id and chat id.
- Transaction security data: login sessions, device and browser information, IP address, login link and passkey records.
- Customer transaction data: subscription plan, period, payment status, invoice records, model and token counts, daily and monthly usage counters.
- Content data: your conversations with the assistant, the notes and memory items you ask it to keep, reminders, and the photos, PDF and text files you upload. This content is stored encrypted with an AES-256-GCM key unique to you.
- Invoicing data: name, surname, phone, address and Turkish ID number are collected on iyzico’s payment page at checkout and passed to iyzico; First You does not store them. Card details never reach First You servers.
- Audit log: content-free records of actions in your account (for example “reminder created”).
Information you choose to include in your conversations may contain special categories of personal data such as health or belief. First You does not ask for such data; to the extent you share it, it is processed only to provide the service and on the basis of your explicit consent. You may choose not to share such information.
Purposes of processing
- Providing the service: creating your account, linking your Telegram account, producing the assistant’s replies, delivering reminders, storing notes and files, running web search when you ask for it.
- Subscription and billing: collecting payments, renewing periods, enforcing AI budgets and usage limits, issuing invoices.
- Security: authentication, session management, preventing abuse and unauthorised access, incident investigation.
- Legal obligations: keeping records required by tax and commercial law, answering lawful requests from competent authorities.
- Communication: login links, account and payment notices, data deletion and export notifications. Your personal data is not used for marketing profiling or advertising.
Recipient groups and purpose of transfer
Your personal data is transferred to the following recipient groups only as far as needed to provide the service:
- Hosting provider: Hetzner Online GmbH (Germany/Finland); servers and object storage. Your data at rest stays inside the European Union.
- AI model (test period): replies are produced by a language model running on hardware under the operator's control in Türkiye. Your messages and files are not sent to any third-party AI provider.
- Connection provider: Tailscale Inc. (USA): brokers the encrypted connection between our server and the model hardware; transit only, end-to-end encrypted, Tailscale cannot see the content.
- Search engines (web search) (DuckDuckGo, Brave, Mojeek, Qwant): when you ask for a web search, only the search query is sent through our own server, without your identity and stripped of personal details; your chat history and files are not sent.
- Payment institution: iyzico Ödeme Hizmetleri A.Ş. (Türkiye); collecting payments, renewing the subscription and processing invoicing data.
- Email provider: Brevo (Sendinblue SAS, France); login links and notices.
- Messaging channel: Telegram FZ-LLC; the channel you use to talk to the assistant. Telegram’s own privacy terms apply.
- Competent public authorities: only within the obligations arising from law and to the extent requested.
Transfers abroad: your personal data is transferred abroad for hosting (Germany/Finland), connection brokering (Tailscale, USA; cannot see content), email delivery (France) and the identity-free queries sent to search engines. During the test period no transfer to an AI provider abroad takes place; the model runs on hardware under the operator's control in Türkiye. These transfers rely on the explicit consent you give when you start using the service, under Article 9 of the KVKK. Without that consent the service cannot be provided. You can withdraw your consent at any time by deleting your account; withdrawal does not affect processing carried out before that date.
Method of collection and legal grounds
Your personal data is collected by partly or fully automated means through the forms on the website and dashboard, the messages and files you send over Telegram, payment notifications from the payment institution, and server logs.
- KVKK art. 5/2-c: processing directly related to the conclusion or performance of a contract (account, assistant, memory, reminders, files, subscription).
- KVKK art. 5/2-ç: processing necessary for the controller to comply with a legal obligation (invoice and payment records).
- KVKK art. 5/2-f: processing necessary for the legitimate interests of the controller, provided it does not harm your fundamental rights and freedoms (security, abuse prevention, service quality).
- KVKK arts. 5/1, 6 and 9: explicit consent (transfers abroad and any special categories of data contained in your content).
Retention period
Your data is kept while your subscription lasts. 30 days after it ends, your content and your encryption key are permanently deleted; only a storage plan extends this period.
7 days after an account deletion request all your data is deleted, your Telegram link is removed, your account is anonymised and your encryption key is destroyed. Once the key is destroyed, any copies remaining in backups become unreadable. You can withdraw the request from the dashboard within those 7 days.
Invoice and payment records, which contain no content, are kept for the period required by tax and commercial law.
Your rights under Article 11 of the KVKK
- To learn whether your personal data is processed and, if so, to request information about it.
- To learn the purpose of processing and whether the data is used in line with that purpose.
- To know the third parties to whom the data is transferred, in Türkiye or abroad.
- To request rectification if the data is incomplete or inaccurate.
- To request erasure or destruction under the conditions of Article 7 of the KVKK.
- To request that rectification, erasure or destruction be notified to the third parties to whom the data was transferred.
- To object to a result against you that arises from analysis carried out exclusively by automated systems.
- To claim compensation for damage caused by unlawful processing.
How to apply
Use “Download my data” in the dashboard to receive all data in your account as one file (free once every 30 days) and “Delete my account” to start erasure.
For other requests, under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may apply in writing to Osmanağa Mah. Söğütlüçeşme Cad. Palas Elektronikçiler Çarşısı No: 7 İç Kapı No: 6, Kadıköy / İstanbul, Türkiye, to the registered electronic mail address -, or from the email address registered in our system to halisemre@gmail.com. The application must state your name, surname, the subject of your request and your contact details.
Applications are answered free of charge within 30 days at the latest; where the operation requires an additional cost, the fee set by the Personal Data Protection Board may be charged.
If your application is refused, the answer is insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date.