Privacy Notice
Version: 2026-10-21
This notice explains how personal data is processed in AviosXR CRM (the "Service"). It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR").
1. Who is responsible
- Account and usage data. AVİOS DANIŞMANLIK VE TİCARET ANONİM ŞİRKETİ, Kızılırmak Mah. Dumlupınar Blv. Nextlevel No: 3A İç Kapı No: 11, Çankaya, Ankara, Türkiye ("we") is the data controller for the data we need to run your account and the Service.
- Customer Data. For transcripts, customer records, analyses and other content an organisation puts into the Service, that organisation is the data controller and we are its data processor under the Data Processing Agreement. If you took part in a meeting whose transcript was uploaded, please contact the organisation that uploaded it; we will pass on requests we receive.
Contact for data protection matters: [email protected]. [PLACEHOLDER: EU representative under GDPR Art. 27, if required; data protection officer, if appointed; VERBIS registration number, if applicable.]
2. Data we process
| Category | Data | Source |
|---|---|---|
| Identity and contact | Full name, email address, email verification status | You, at sign-up |
| Credentials and security | Password (stored only as a one-way hash), session tokens, IP address and browser user agent of each session, rate-limit counters | You and your browser |
| Agreement records | Version and time of each agreement you accepted, with the IP address and user agent at that moment | You |
| Organisation and membership | Organisation name, your role, invitations you sent or received (invitee email, role, inviter), organisation background and goals text | You and other members |
| Transcripts | The original uploaded file (filename, size, checksum), the structured transcript with speaker names, speech and timestamps, and corrections with their author | You or other members of your organisation |
| Customers and analysis | Customer names, questionnaires, AI analysis drafts with evidence, reviewer edits and approvals with the reviewer's name | You, other members and the AI provider |
| Operational records | Processing status, notifications, retry and audit records naming the member who acted, email delivery receipts | The Service |
| Error reports | When something fails: the error message and stack trace, the page path without query parameters, browser user agent, request ID, and your user and organisation IDs. They contain no names, email addresses, form input or transcript content | Your browser and our servers |
Transcripts can contain personal data of meeting participants and other people mentioned in a meeting (for example names, job titles, company details and anything said). The Service does not need special categories of personal data and organisations should not upload them without a specific legal basis.
We use only a strictly necessary session cookie for sign-in and your browser's local storage for your theme preference. We do not use advertising or analytics cookies.
3. Purposes and legal bases
| Purpose | KVKK basis (Art. 5) | GDPR basis (Art. 6) |
|---|---|---|
| Creating and running your account, organisations, invitations and the features you use | Necessary for the establishment and performance of a contract (5/2-c) | Contract (6/1-b) |
| Sending verification, password-reset and invitation emails | Necessary for the performance of a contract (5/2-c) | Contract (6/1-b) |
| Detecting and fixing errors in the Service | Legitimate interest (5/2-f) | Legitimate interest (6/1-f) |
| Security, abuse prevention, rate limiting, backups and incident investigation | Legitimate interest (5/2-f); legal obligation (5/2-ç) | Legitimate interest (6/1-f); legal obligation (6/1-c) |
| Proving which agreements you accepted | Establishment, exercise or protection of a right (5/2-e) | Legitimate interest (6/1-f) |
| Processing Customer Data to provide the Service to your organisation | On the organisation's instructions as its data processor | On the organisation's instructions as its processor (Art. 28) |
| Complying with legal requests and obligations | Legal obligation (5/2-ç) | Legal obligation (6/1-c) |
We do not use your data or Customer Data for advertising, sell it, or use it to train AI models.
4. Recipients and international transfers
We share data only with the service providers we need to run the Service, under contracts that bind them to confidentiality and security:
| Provider | Role | Location |
|---|---|---|
| DigitalOcean, LLC | Application servers, PostgreSQL database and backups | Frankfurt, Germany |
| Cloudflare, Inc. | Network proxy, TLS and attack protection for traffic to the Service (including IP addresses and request content in transit); R2 storage of original and structured transcript files | Global network; R2 data stored in Western Europe |
| OpenAI, L.L.C. | AI analysis of transcript text when your organisation starts an analysis. Requests are sent with storage disabled; OpenAI may keep request data for up to 30 days for abuse monitoring and does not use API data for training | United States |
| Resend, Inc. | Delivery of transactional emails (recipient address and message content) | United States |
| Functional Software, Inc. (Sentry) | Error tracking: storing the error reports described in section 2 so we can find and fix failures. IP addresses are not stored | Frankfurt, Germany |
Our servers and file storage are in the European Union, which is abroad from the perspective of KVKK. OpenAI and Resend process data in the United States. Transfers abroad rely on the safeguards the law provides: for KVKK, the standard contracts published by the Personal Data Protection Authority (Art. 9) and, for GDPR, the European Commission's Standard Contractual Clauses or an adequacy decision (such as the EU-U.S. Data Privacy Framework for certified providers). [PLACEHOLDER: lawyer to confirm the transfer mechanism and Authority notification for each provider.]
We may also disclose data to courts and public authorities where the law requires it.
5. Retention
- Account data is kept while your account exists and deleted or anonymised within 30 days after you ask us to delete it at [email protected], except where the law requires longer storage.
- Agreement records are kept for the duration of the account plus 10 years, the general limitation period under Turkish law.
- Customer Data is kept until the organisation deletes it (members can permanently delete an analysis with its transcript files) or until the organisation's Owner asks us to close the organisation, then deleted within 30 days. There is no fixed retention period, because the organisation decides how long it needs its records.
- Email content is erased once a message is delivered or abandoned; delivery receipts are deleted after 40 days and provider webhook records after 30 days.
- Error reports are deleted automatically by Sentry at the end of its retention period. [PLACEHOLDER: confirm the retention period of the Sentry plan in use.]
- Database backups are taken daily and before each update of the Service, and are deleted automatically after 30 days, so deleted data disappears from backups within 30 days.
6. Your rights
Under KVKK Article 11 you may ask us whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; ask for correction of incomplete or inaccurate data; ask for its deletion or destruction; ask that third parties to whom it was transferred are notified of such correction or deletion; object to a result against you that arises solely from automated analysis; and claim compensation for damage caused by unlawful processing.
Under the GDPR you also have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority.
Send requests to [email protected] or in writing to Kızılırmak Mah. Dumlupınar Blv. Nextlevel No: 3A İç Kapı No: 11, Çankaya, Ankara, Türkiye. We answer within 30 days. You may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or, in the EU, to your local supervisory authority.
For personal data contained in Customer Data, please contact the organisation that uploaded it; it decides how to answer and we support it.
7. Security
Data is encrypted in transit. Passwords are hashed. Email payloads in our outbox are encrypted. Access to an organisation's data requires membership and the right role. Original transcript files are never modified.
8. Changes
When we change this notice materially, we update its date and ask you to acknowledge the new version the next time you use the Service.