KVKK Disclosure Statement

This statement is prepared under article 10 of Turkish Personal Data Protection Law no. 6698 ("KVKK") to explain how your personal data is processed when you use the platform at eflatun.ai.

1. Categories of Personal Data

As data controller we process the following categories:

• Identity and contact: email address, display name, profile picture if any.
• Customer transaction: Gems balance, spending and refund records, purchase history.
• Transaction security: IP address, session logs, device and browser information.
• User content: the prompts you write, the files you upload and the outputs produced.

2. Purposes of Processing

Your data is processed for the following purposes:

• Creating your membership record and maintaining your session.
• Running the AI generations you request and storing them in your library.
• Calculating your Gems balance correctly, invoicing and refunds.
• Preventing abuse, fraud and security breaches.
• Detecting and fixing errors and performance problems.
• Meeting legal obligations and responding to lawful authority requests.

3. Legal Bases (KVKK art. 5)

Not every purpose rests on the same legal basis; the bases are:

• Performance of a contract (art. 5/2-c): account creation, generation, balance tracking.
• Legal obligation (art. 5/2-ç): retention of invoice and tax records.
• Legitimate interest (art. 5/2-f): security, abuse prevention, error monitoring.
• Explicit consent (art. 5/1 and art. 9): international transfers, optional measurement cookies, and featuring your works in Explore.

4. Transfers and International Transfer

Your personal data is transferred to the processors listed by name on the Privacy Policy page so that the service can be delivered. Because their servers are outside Türkiye, the transfer relies on your explicit consent under KVKK art. 9.

Data may also be transferred to competent public authorities upon a lawful request, limited to the scope of that request.

5. Your Rights (KVKK art. 11)

As a data subject you have the right to:

• Learn whether your personal data is processed and, if so, request information.
• Learn the purpose of processing and whether it is used accordingly.
• Know the third parties to whom it is transferred, at home or abroad.
• Request correction if it is incomplete or inaccurate.
• Request erasure or destruction within the conditions set by the law.
• Request that correction and erasure be notified to third parties it was transferred to.
• Object to a result against you arising solely from automated analysis.
• Claim compensation for damage caused by unlawful processing.