Privacy Notice (KVKK Disclosure)
Version 1.1 — Effective: 2 September 2026
This notice explains, as required by Article 10 of Turkish Law No. 6698 ("KVKK"), how your personal data is processed when you use Muznara. It is informational; you are not asked to consent to it.
1. Data Controller
Hasan Özkan Özkan Bilişim Sistemleri, İstiklal Mah. Mehmet Oğuz Bulvarı, İhsan Oğuz İş Merkezi, Kat 1 No: 119, Gazipaşa / Antalya, Türkiye E-mail (data protection requests): [email protected]
2. Data We Process and Why
| Category | Examples | Purpose |
|---|---|---|
| Identity | name, username | creating your account, addressing you |
| Contact | phone number and/or e-mail | sign-in verification (one-time codes), account notices |
| Device & installation | device make/model, OS and version, installation id, push address | running the service on your device, push notifications, session security |
| Usage content | your written and voice conversations with the assistant, the personal notes and memories it keeps for you | the core of the service: your personal AI assistant working for you |
| Images | photos you provide (camera/gallery only when you use them) | performing what you asked |
| Security records | app attestation results, request logs, IP address | protecting your account and the system against abuse |
| Consent records | date and document version of permissions you give or withdraw | legal obligation |
Location data is not processed; the app does not request location permission.
3. Legal Bases (KVKK Art. 5)
- Performance of the contract (5/2-c): your account and the AI assistant itself — AI analysis of your content is the essence of the service. We deliberately do not ask for consent for this: a consent you cannot refuse without losing the service would not be freely given.
- Legal obligation (5/2-ç): keeping consent records, answering lawful requests.
- Legitimate interest (5/2-f): security and abuse prevention (genuine-app attestation, rate limits).
- Explicit consent (5/1): only for commercial messages. The service works identically without it; withdraw any time in Settings → Permissions & Privacy.
4. Recipients and Cross-Border Transfer
Your data is shared, strictly for providing the service, with:
- Hosting: Oracle Cloud (abroad) — the infrastructure our systems run on.
- AI processing: content is sent to AI model providers (currently Google and OpenRouter; ElevenLabs for voice).
- Messages: Twilio (SMS) and Brevo (e-mail) for one-time codes; Google Firebase for push notifications and app attestation.
- Traffic protection: Cloudflare.
- Crash reports: technical records of app crashes (device model and stack trace; never linked to your identity, never carrying content) go to Sentry (EU region).
Some of these providers are abroad. The safeguard process under KVKK Art. 9 (Board standard contracts) is being carried out; in the target architecture all AI processing is consolidated under a single contracted provider. Your data is never given to any provider for advertising or their own purposes; our contractual baseline with AI providers is that your data is not used to train models.
5. How Data Is Collected
Through the mobile app: what you enter, and automatically as the service operates.
6. Retention
| Data | Period |
|---|---|
| Account, profile, content, device and session records | while your account exists; deleted immediately on in-app deletion |
| One-time codes | expire within minutes; send records exist for rate-limiting and are deleted with the account |
| Consent records | kept after deletion, attached to an identity-stripped stub, for the applicable limitation periods (proof of compliance) |
| Audit trail | de-identified, for security |
Account deletion is inside the app (Settings → Permissions & Privacy → Delete my account), verified by a fresh code, immediate and irreversible.
7. Your Rights (KVKK Art. 11)
You may learn whether your data is processed, request information, correction or deletion, know the third parties it is transferred to, object to processing, and claim damages. Your right to object to a result produced exclusively by automated analysis (Art. 11/g) is reserved — if you disagree with a conclusion the assistant reached about you, you can object.
Send requests to [email protected] (from the e-mail on your account) or in writing to the address above. Requests are answered free of charge within 30 days at the latest. You may also lodge a complaint with the Turkish Data Protection Board.