KVKK Privacy Notice
Last updated: 20 October 2026
Version: 2026-10-20
This notice explains how we process your personal data. It is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It is information only; it does not depend on your agreement. Processing that requires explicit consent is set out in a separate document, the Explicit Consent Text. This English text is a translation; if the two differ, the Turkish text prevails.
1. Data controller
| Legal name | Müşavir Teknoloji ve Yazılım Anonim Şirketi ("Müşavir") |
|---|---|
| Address | Maslak Mah. AOS 55. Sk. 42 Maslak B Blok Sitesi No: 4 İç Kapı No: 542, Sarıyer / İstanbul, Türkiye |
| MERSİS no | 0627131249900001 |
| Trade registry | İstanbul Ticaret Sicili Müdürlüğü, 340171-5 |
| Personal data requests | [email protected] |
| General contact | [email protected], +90 212 909 10 61 |
| Web | musavir.co |
Müşavir is established in Türkiye, so it has no separate representative.
2. Who this notice covers
This notice covers the people for whom Müşavir is the data controller:
- users who open a Müşavir account or are invited to a company workspace,
- natural persons and company officers who are party to a subscription contract,
- visitors of musavir.co,
- people who contact us by email, phone or a support request.
What it does not cover: if you are a customer, employee, candidate or supplier of a company that uses Müşavir, and your data was entered into the application by that company, the data controller is that company. For that data Müşavir is only a data processor acting on the company's instructions. The company is responsible for informing you and is the addressee of your requests. The same applies if a quote link, a reconciliation letter, a form or a message reached you through Müşavir.
This also covers the automated AI tasks a company switches on. In the nightly lead update, for example, the conversations in the messaging account the company connected (internal private notes included) and the lead's name, stage and AI profile are sent to the AI provider; custom fields and conversation notes are not sent. For this processing the company is the controller and Müşavir is the processor. Details are on the Data Processing page.
KVKK protects natural persons only. Information about legal entities (company name, tax number) is not personal data; information about sole proprietors and company officers is.
3. What we process, why, and on what legal basis
| Purpose | Data processed | Legal basis |
|---|---|---|
| Creating your account, authentication and authorisation | First name, last name, email address, phone number, password hash, the company you belong to, role and module permissions | Formation and performance of a contract (KVKK Art. 5/2-c) |
| Sign-in with Google (if you choose it) | Name, email address and profile picture received from Google. We do not receive your Google password and do not request access to Gmail, Drive or contacts | Formation and performance of a contract (Art. 5/2-c) |
| Phone verification by SMS (optional, +90 numbers only) and phone sign-in | Mobile number, one-time code, verification time | Performance of a contract (Art. 5/2-c) and our legitimate interest in account security (Art. 5/2-f) |
| When a payment is taken, collecting the fee and issuing an invoice: when you buy AI credits and once paid subscriptions are opened (subscription billing is currently closed) | Billing name, address, Turkish ID or tax number, payment amount and date, iyzico customer and subscription reference codes, last four digits of the card. We never hold the full card number | Performance of a contract (Art. 5/2-c); legal obligation to issue and keep invoices (Art. 5/2-ç) |
| Proving that the contract was formed and that you were informed | Records relating to the pre-contract information form, the distance sales agreement, the terms of use and this notice: date, text version, name or company name, email, tax identity, IP address, browser information | Expressly provided for by law (Art. 5/2-a) and establishment, exercise or protection of a right (Art. 5/2-e) |
| Security of the service, abuse prevention, fault diagnosis | IP address, browser and device information, session records, pages visited, error records, user ID | Legitimate interest (Art. 5/2-f) |
| Transaction security records (audit trail) | Who changed what and when for high-impact operations; IP address and browser information | Legitimate interest (Art. 5/2-f) |
| Answering support requests | Correspondence, attachments you send, contact details | Performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f) |
| Responding to contact and demo requests you send by email or phone | Name, email, phone, company name, your message | Directly related to the formation of a contract (Art. 5/2-c) or our legitimate interest in answering your request (Art. 5/2-f) |
| Mandatory account notices (sign-in code, security, invoice, contract changes) | Email address, phone number, notice content | Performance of a contract (Art. 5/2-c) and legal obligation (Art. 5/2-ç) |
| Promotional messages (only if you separately opted in) | Name, email address, phone number, channel preferences, your opt-in and opt-out records | Your commercial electronic message consent under Article 6 of Law No. 6563; KVKK Art. 5/1. Legal obligation (Art. 5/2-ç) for keeping opt-in and opt-out records and, where the legislation requires it, reporting them to the Message Management System (İYS) |
| Responding to requests from competent authorities and courts; accounting and tax duties | The data the request or duty requires | Legal obligation (Art. 5/2-ç) |
| E-invoice recipient check | Names and tax identity numbers in the Revenue Administration's public register of e-invoice users (personal data where the taxpayer is a sole proprietor) | Legal obligation (Art. 5/2-ç) and data made public by the data subject (Art. 5/2-d) |
| AI chat (only if the company owner has switched AI on and approved it, and you have given your own consent) | The message you type into the chat screen, the history of the same conversation and the AI agent's instructions. The chat has no access to panel records | Your explicit consent (Art. 5/1). See section 6 for the transfer abroad and section 8 for details |
We do not ask you for special categories of personal data (health, religion, trade union membership, biometric data and the like) for your own account and do not process them for these purposes.
4. How we collect data
Your data is collected electronically, by fully or partly automatic means, through:
- the information you enter on the sign-up, sign-in and profile screens,
- Google, if you choose to sign in with Google,
- the name and email or phone entered by the company administrator who invites you to a workspace,
- the reference codes and last four card digits returned by iyzico when you make a payment,
- session, transaction and error records created while you use the site and the application, and strictly necessary cookies,
- what you send us by email, phone and support requests,
- what you type into the AI chat (if the feature is switched on for your company).
This notice also applies where your data reaches us from a source other than you (Google, or the company that invited you).
5. Who we share your data with, and why
We do not sell your data and do not share it with third parties for advertising. We share it only with the recipients below, for the stated purpose and only as far as that purpose requires:
| Recipient | Country | Purpose of transfer | Data transferred |
|---|---|---|---|
| Hetzner | Germany | Server, storage and backup hosting. We manage the servers ourselves | All account, payment and technical data |
| Cloudflare | Headquartered in the USA, global edge network | DNS, content delivery, attack protection; bot detection on forms in the application (Cloudflare Turnstile) | IP address, request information, traffic in transit; browser and device signals on forms that use Turnstile |
| Mailgun | USA | Sending transactional email such as sign-in codes and notifications | Name, email address, email content |
| NETGSM | Türkiye | One-time code and reminder SMS | Phone number, message content |
| iyzico Ödeme Hizmetleri A.Ş. | Türkiye | Card collection of the fee when you make a payment (AI credits; the subscription fee once paid subscriptions are opened). iyzico processes card data under its own responsibility, as a separate data controller, as a payment institution licensed under Law No. 6493 | Name or company name, email, mobile phone, Turkish ID or tax number, billing address, IP address |
| Headquartered in the USA | Authentication, only if you choose to sign in with Google. Google learns that you signed in to Müşavir | Technical information about the sign-in request | |
| E-document integrator and the Revenue Administration (GİB) | Türkiye | Once paid subscriptions are opened, transmitting the invoices issued to you as e-invoices or e-archive invoices (legal obligation, Art. 5/2-ç). No invoice is issued this way at present; this notice will be updated before it starts | Billing name, Turkish ID or tax number, address, amount |
| Message Management System (İYS) | Türkiye | Your commercial electronic message opt-ins and opt-outs are recorded in our system; where the legislation requires it, we report them to İYS (Law No. 6563) | Email address or phone number, consent status, date, source |
| Our accountant and legal advisers | Türkiye | Meeting accounting and tax duties, handling legal proceedings | Invoice and payment records and, where needed, records relevant to a dispute |
| Competent public authorities and courts | Türkiye | Answering requests for information and documents based on law | The data the request requires |
| OpenRouter, Inc. (AI model routing gateway) and the model provider it forwards requests to, Anthropic (Claude models) | USA; the request may be processed on Anthropic's own infrastructure or on the cloud infrastructure serving the model (Amazon Bedrock, Google Vertex AI), whose processing region may also be outside the USA | Only if the company owner has switched AI on and approved it and you have given explicit consent, producing an answer in the AI chat. We have no direct contract with model providers (such as Anthropic); OpenRouter forwards the request | The message you type into the chat screen, the conversation history and the AI agent's instructions (the chat has no access to panel records) |
| EVREN AI platform (operated by SSB) | Türkiye | Not active at present. Once switched on, producing the AI answer with open-source models hosted in Türkiye; data does not leave the country | The message you type into the chat screen, the conversation history and the AI agent's instructions |
Requests to OpenRouter are sent so that they are routed only to endpoints with data retention disabled (zero data retention) where offered and that do not use the data for model training. The models in use today are Claude Sonnet 5.5, Claude Haiku 4.5 and Claude Haiku 5.5. The current provider list and details are on the Subprocessors page.
6. Transfers abroad
Your data is kept on servers that we manage in Hetzner's data center in Germany. The Personal Data Protection Board has issued no adequacy decision covering these transfers. Sending data from Türkiye to Germany, and to the recipients shown above as located in the USA, is therefore a transfer abroad under KVKK Article 9.
We do not base the hosting, email and network security transfers on your explicit consent. To provide the appropriate safeguards under KVKK Article 9/4 (the standard contract published by the Board) for these transfers, a process is carried out with the recipients; the current status is provided on request. The transfer in the AI chat is also a recurring transfer for as long as you use the chat; the same process is carried out for that recipient too. In addition, the chat does not open for you and nothing you type is sent unless you give explicit consent (Explicit Consent Text).
The data transferred is limited to the purposes in section 5. NETGSM, iyzico, EVREN, the e-document integrator, the Revenue Administration and İYS are in Türkiye; transfers to them are not transfers abroad.
7. Retention periods
| Data | Period |
|---|---|
| Account data | While your account is open. After the account is closed it is deleted from live systems within 30 days and from backups within the following 30 days (our backup retention target is 30 days) |
| Business data you enter into the application (we act as processor) | Exportable for 30 days after the subscription ends; then deleted from live systems and removed from backups within at most 30 more days |
| Payment and billing data | 10 years under the Tax Procedure Law and the Turkish Commercial Code |
| Contract acceptance records (pre-contract information form, distance sales agreement) | As evidence for the general limitation period, 10 years from the end of the contract. Kept even if your account is deleted; only the link to the user account is removed |
| Terms of use and privacy notice records | 10 years from account closure |
| Records of giving and withdrawing explicit consent | For as long as the consent is valid; after the consent is withdrawn or the account is closed, at most 10 years, to prove the consent |
| Commercial electronic message opt-in and opt-out records | 3 years from the date the consent ceases to be valid (Regulation on Commercial Communication and Commercial Electronic Messages, Art. 13/2) |
| Technical logs for security and fault diagnosis | 90 days |
| Transaction security records (audit trail) | 24 months |
| Support request attachments | Attachments that pass the virus scan are deleted 2 years after the request is closed; files that cannot be scanned or stay in quarantine are deleted after 7 days. An infected file is deleted immediately; only a masked file name, the file hash and the detected virus name are kept |
| Contact and demo requests you send by email or phone | 2 years unless a contract follows |
| AI chats | Until you delete them; otherwise deleted automatically 12 months after the last message |
Data whose period has ended is deleted, destroyed or anonymised. Records still under a statutory retention duty are kept with restricted access for that period.
8. Processing based on explicit consent or a separate opt-in
- AI chat: AI features work per company: the company owner switches them on and approves them; without the owner's approval no data is sent to a model. The chat works by sending the message you type, the history of the same conversation and the AI agent's instructions to a language model; it has no access to your panel records. The only route in use today is Anthropic's Claude models through OpenRouter (USA), and this route is a transfer abroad. EVREN, hosted in Türkiye, is not active at present. The chat does not start for you unless you separately give explicit consent in the dialog shown at first use (Explicit Consent Text). Refusing consent does not stop you from using the rest of Müşavir.
- Promotional messages: based only on the Commercial Electronic Message Consent you give in a separate box at sign-up or later under Profile > Communication permissions. This opt-in is not a condition of membership and is never combined with the explicit consent text. You can switch off each channel (email, SMS, calls) separately.
We do not base any other processing on your explicit consent; your account, your subscription and the other features do not depend on any explicit consent.
9. Your rights
Under KVKK Article 11 you may apply to Müşavir and:
- (a) learn whether your personal data is processed,
- (b) request information about it if it is processed,
- (c) learn the purpose of processing and whether it is used for that purpose,
- (ç) know the third parties in Türkiye or abroad to whom it is transferred,
- (d) request correction if it is incomplete or inaccurate,
- (e) request deletion or destruction under the conditions of KVKK Article 7,
- (f) request that actions under (d) and (e) be notified to the third parties to whom the data was transferred,
- (g) object to a result against you that arises from analysis of the data exclusively by automated systems,
- (ğ) claim compensation if you suffer damage because of unlawful processing.
You can withdraw your explicit consent and your commercial electronic message consent at any time without giving a reason. Withdrawal does not make processing carried out before that date unlawful.
If you are in the European Union and the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, objection and data portability, and the right to lodge a complaint with your local supervisory authority.
10. How to apply
You can apply in line with the Communiqué on the Procedures and Principles of Application to the Data Controller by one of these routes:
- Email: by writing to [email protected] from the email address registered on your account,
- Post or in person: by a signed written petition to "Müşavir Teknoloji ve Yazılım A.Ş., Maslak Mah. AOS 55. Sk. 42 Maslak B Blok Sitesi No: 4 İç Kapı No: 542, Sarıyer / İstanbul, Türkiye",
- Secure electronic signature or mobile signature: by sending the signed application to [email protected].
The application must include your first and last name, your Turkish ID number (for foreign nationals: nationality and passport or ID number), your address for notifications, your email address and phone number if any, and the subject of your request; a written application must be signed. We may ask for additional information to confirm that the applicant is you.
We conclude your application as soon as possible and within 30 days at the latest, free of charge. If the answer is given in writing, the first 10 pages are free; beyond that, and where the answer is given on a recording medium, the fee in the tariff set by the Board may be charged. We reply in writing or electronically.
If your data was entered by a company that uses Müşavir, you need to apply to that company as the data controller. We forward such applications that reach us to the company concerned and help it fulfil them.
11. Complaint to the Board
If your application is rejected, you find the answer insufficient, or you receive no answer within 30 days, you may complain to the Personal Data Protection Board under KVKK Article 14 within 30 days of learning our answer and in any event within 60 days of the date of your application. You cannot complain to the Board without first applying to us. The Authority's website: kvkk.gov.tr.
12. Changes
We update this notice when our processing activities change. Each version carries a date. When a change is material we tell you in the application or by email, and at your next sign-in to the panel we show you the new text and what changed.
Related documents: Privacy Policy, Explicit Consent Text, Cookie Policy, Subprocessors, Data Processing.