Under Law No. 6698

KVKK Disclosure Notice

1. Purpose and Scope

This Disclosure Notice has been prepared by Hareki LLC, acting as data controller, to inform you about the processing of your personal data in accordance with Law No. 6698 on the Protection of Personal Data ("KVKK").

This notice covers all natural persons who use or visit the Hareki Studio platform (hareki.com). In accordance with Article 10 of KVKK, you are being informed about the following matters regarding the processing of your personal data.

2. Identity of the Data Controller

Company Name: Hareki LLC

Place of Establishment: New Mexico, United States of America

Company Type: Limited Liability Company (LLC)

Field of Activity: AI-powered content creation platform (SaaS)

Platform: Hareki Studio — hareki.com

Contact Email: privacy@hareki.com

Hareki LLC is a company established under the laws of the State of New Mexico, USA, and fulfills its obligations under KVKK for its users in Turkey.

3. Personal Data Processed

The following categories of personal data are processed within the Hareki Studio platform:

a) Identity Information

First name, last name

b) Contact Information

Email address

c) Customer Transaction Information

Subscription information (plan type, start/end date)
Credit usage history
Payment records (processed through Stripe)
Invoice information

d) Transaction Security Information

IP address
Session information (session token)
Device information (browser type, operating system)
Log records (access time, actions performed)

e) Marketing Information

Brand name
Industry information
Profession information
Logo and visual brand elements
Brand voice and communication tone preferences

f) Generated Content Data

Social media content generated with AI
Content feedback data (like/dislike)
Revision history

4. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

Providing services through the Hareki Studio platform and improving service quality
Managing user account creation and account management processes
Providing AI-powered content creation services (brand voice analysis, content creation, personalization)
Processing payment and billing transactions
Subscription and credit system management
Providing customer support and responding to requests
Fulfilling legal obligations
Managing information security processes (detecting unauthorized access, fraud prevention)
Platform usage analytics and performance improvements
Personalizing user experience

5. Legal Basis for Processing Personal Data

Your personal data is processed under the following legal grounds specified in Article 5, Paragraph 2 of the KVKK:

(a) Expressly provided by law

Data required under Law No. 6563 on the Regulation of Electronic Commerce, Law No. 5651 on Internet and related legislation.

(b) Necessary for the establishment or performance of a contract

Establishment of service agreements, subscription management, provision of content creation services, and processing payment transactions.

Retention obligations under legal regulations, tax legislation, and audit processes.

(f) Necessary for the legitimate interests of the data controller

Ensuring platform security, improving service quality, usage analytics, and fraud prevention processes.

Explicit Consent

In cases not based on the above legal grounds, your personal data is processed only with your explicit consent. You have the right to withdraw your consent at any time.

6. Transfer of Personal Data

Your personal data is transferred under Articles 8 and 9 of the KVKK as follows:

Domestic Transfer

As Hareki LLC does not have a legal entity in Turkey, regular data transfer to domestic third parties is not carried out.

International Transfer (KVKK Article 9)

Due to the platform infrastructure, your personal data is transferred to the following international service providers:

Service Provider	Country	Transfer Purpose	Legal Basis
Vercel	USA / EU	Web hosting and CDN	Explicit consent + adequate protection commitment
Supabase	USA	Database and authentication	Explicit consent + adequate protection commitment
OpenRouter	USA	AI content generation	Explicit consent + adequate protection commitment
Stripe	USA	Payment processing	Contract performance + adequate protection commitment
Resend	USA	Email delivery	Explicit consent + adequate protection commitment

International transfers are carried out under Article 9 of KVKK with your explicit consent and/or a commitment letter regarding the existence of adequate protection in the relevant country. For servers in the EU region (Vercel EU), the standards of countries for which the Personal Data Protection Board has issued an adequate protection decision apply.

7. Methods of Collecting Personal Data

Your personal data is collected through the following methods:

Automatic Methods (Via Website)

Cookies and similar tracking technologies
Server log records
Device and browser information

Provided by User

Registration form (first name, last name, email)
Brand information entry (brand name, industry, logo upload)
Onboarding process (profession, brand voice preferences)
Content feedback
Support requests

Third-Party OAuth Providers

Only first name, last name, and email information is obtained from OAuth providers.

8. Rights of the Data Subject (KVKK Article 11)

Under Article 11 of the KVKK, as a personal data subject, you have the following rights:

(a) Learning whether your personal data is being processed,
(b) Requesting information about your processed personal data,
(c) Learning the purpose of processing your personal data and whether they are used in accordance with their purpose,
(ç) Knowing the third parties to whom your personal data has been transferred, domestically or abroad,
(d) Requesting correction of your personal data if it has been processed incompletely or inaccurately,
(e) Requesting the deletion or destruction of your personal data under the conditions set forth in Article 7 of the KVKK,
(f) Requesting that corrections and deletions under paragraphs (d) and (e) be notified to third parties to whom your personal data has been transferred,
(g) Objecting to a result against you arising from the analysis of processed data exclusively through automated systems,
(ğ) Requesting compensation for damages incurred due to unlawful processing of your personal data.

9. Application Methods

You may choose one of the following methods to exercise the rights stated above:

Email: privacy@hareki.com You can submit your application along with information identifying you.

Website: You can apply through the contact form on hareki.com.

Response Period: Your applications will be concluded free of charge as soon as possible and at the latest within 30 (thirty) days, depending on the nature of the request. If the process requires additional cost, the fee determined by the Personal Data Protection Board may be charged.

Right to Complain: If your application is rejected, the response is found insufficient, or no response is given within the specified period; you have the right to file a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and in any case within 60 days from the date of application.

10. Data Retention Periods

Your personal data is retained for the period required by the processing purposes and within the statute of limitations provided in the relevant legislation:

Data Category	Retention Period
Identity and Contact Information	As long as account is active + 30 days after account deletion
Customer Transaction Information	Contract period + 10 years (tax legislation)
Transaction Security Information	2 years (under Law No. 5651)
Marketing Information	As long as account is active + 30 days after account deletion
Generated Content Data	As long as account is active + 30 days after account deletion
Payment Records	10 years (Turkish Commercial Code No. 6102 and tax legislation)

Personal data whose retention period has expired is deleted, destroyed, or anonymized within the framework of periodic destruction processes.

11. Data Security Measures

Hareki LLC takes the necessary technical and administrative measures pursuant to Article 12 of the KVKK to ensure the security of your personal data:

Technical Measures

Data transmission with SSL/TLS encryption
Row Level Security (RLS) at the database level
Password hashing with the bcrypt algorithm
JWT-based session management and token verification
Protection against brute force attacks with API rate limiting
Regular security updates and dependency scans
Maintaining and monitoring access logs

Administrative Measures

Maintaining a data processing inventory
Informing employees about personal data security
Data protection agreements with third-party service providers
Establishing notification procedures in case of data breach
Acting in accordance with the principle of data minimization

12. Changes to the Disclosure Notice

This Disclosure Notice may be updated in line with legal regulations and changes in our data processing procedures. The current text will always be published at hareki.com.

In case of significant changes, a notification will be sent to your registered email address. Continuing to use the platform after the change means you accept the updated Disclosure Notice.

Last updated: March 12, 2026