Privacy Notice
DRAFT – This text has not yet been reviewed by legal counsel. The binding version will replace it here.
Controller
First You is operated by İsterdim Ki Dijital Platform İşletmeciliği Limited Şirketi, established in Türkiye. Contact: halisemre@gmail.com.
Data we process
Account data: email address, language, login sessions (device, IP address), Telegram user id.
Content data: your conversations with the assistant, notes, reminders and uploaded files. These are stored encrypted with a key unique to you.
Usage and billing data: plan, period, model and token counts, payment status. Card details are never stored.
Audit log: content-free records of actions in your account (for example “reminder created”).
Purposes and legal bases
Performance of the contract (GDPR art. 6(1)(b); KVKK art. 5/2-c): running the assistant, memory, reminders, files.
Legal obligation (art. 6(1)(c); KVKK art. 5/2-ç): keeping invoice and payment records.
Legitimate interest (art. 6(1)(f); KVKK art. 5/2-f): security, abuse prevention, service quality.
Optional features such as web search run only when you ask for them.
Transfers and processors
Your data is shared with the following providers only as far as needed to run the service:
- Hetzner Online GmbH (Germany/Finland): servers and object storage; your data at rest stays inside the EU.
- AI model: replies are produced by a language model running on hardware under the operator's control in Türkiye. Your messages and files are not sent to any third-party AI provider.
- Tailscale Inc. (USA): brokers the encrypted connection between our server and the model hardware; transit only, end-to-end encrypted, Tailscale cannot see the content.
- Search engines (DuckDuckGo, Brave, Mojeek, Qwant): when you ask for a web search, only the search query is sent through our own server, without your identity and stripped of personal details; your chat history and files are not sent.
- iyzico Ödeme Hizmetleri A.Ş.: payments; your card details never reach First You servers. Name, surname, phone, address and Turkish ID number are passed to iyzico for invoicing and are not stored by First You.
- Brevo (Sendinblue SAS, France): email delivery (login links, notices).
- Telegram FZ-LLC: messaging channel; Telegram’s own privacy terms apply.
During the test period your messages are not transferred to any AI provider abroad. Transfers abroad happen only for hosting (Germany/Finland), email delivery (France), connection brokering (Tailscale) and the identity-free queries sent to search engines; these transfers rely on the explicit consent you give when you start using the service.
Retention
Data is kept while your subscription lasts. 30 days after it ends, your content and your encryption key are permanently deleted, unless a storage plan extends this.
7 days after an account deletion request all your data is deleted and your key destroyed. Invoice records are kept for the statutory period.
Your rights
You have the rights of access, rectification, erasure, objection and portability (GDPR arts. 15–21; KVKK art. 11).
Use “Download my data” in the dashboard for a full export and “Delete my account” to start erasure. For other requests write to halisemre@gmail.com; we answer within 30 days.
Security
Each customer’s data is encrypted with its own key and processed in its own isolated environment. Every action is audited. No system is perfectly secure; in case of a breach you will be notified within the statutory period.