Kulis — Information Notice on the Protection of Personal Data
Under KVKK art. 10 · Version 0.1 (draft) · Effective: [[YURURLUK_TARIHI]]
This text is for information only. It is not tied to a consent checkbox and is never presented nested with an explicit-consent text on the same screen (Turkish Data Protection Board Principle Decision no. 2026/347 of 18.02.2026). The sign-up screen only links to this notice. Faithful translation of aydinlatma.tr.md. Turkish law governs; the Turkish text prevails.Data controller: [[VERI_SORUMLUSU_UNVAN]] · [[ADRES]] · MERSIS: [[MERSIS]] · E-mail: [[ILETISIM_EPOSTA]] · KEP: [[KEP]]
What data we process
- Identity and contact: your e-mail address, your workspace (venue) name.
- Account security: the irreversible hash of your password, session and sign-in records, IP address.
- Connected platform accounts: YouTube, Instagram, Facebook, TikTok, Telegram account ID, display name, profile image, granted scopes and encrypted access tokens.
- Content data: videos and images you upload (which may contain the image/voice of performers and audience), transcripts, AI prompts and generated files.
- Operational records: publishing attempts, error messages, queue records.
Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5) |
|---|---|
| Creating your account, authenticating you, providing the service | 5/2-c — conclusion and performance of a contract |
| Publishing to the accounts you connected, with your approval | 5/2-c |
| Adapting content to platform rules; generating text, images, transcripts | 5/2-c |
| Processing the image and voice of third parties in show recordings | 5/2-f — legitimate interest (with a written balancing test) |
| Security, abuse prevention, troubleshooting | 5/2-f — legitimate interest |
| Statutory bookkeeping, record-keeping and notification duties | 5/2-ç — legal obligation |
Who it is transferred to
To the platforms you select for publication (YouTube, Instagram, Facebook, TikTok, Telegram) and to the infrastructure providers running the service: Supabase, Cloudflare, Vercel, Hetzner, Anthropic, ElevenLabs, OpenAI, Deepgram, fal.ai, Telegram. Full list with country and purpose: https://kulis.ai/subprocessors. Some of these providers are outside Türkiye; transfers are made on the basis of standard contracts under KVKK art. 9, notified to the Authority within 5 business days of signature. Transfers to competent public authorities may also occur where legislation requires it.
How we collect it
Directly from you (sign-up form, in-app actions, files you upload, the Telegram bot) and through the authorization (OAuth) flows of the platforms you connect — electronically and by partly automated means.
Your rights
Under KVKK art. 11 you may: learn whether your data is processed, request information, learn whether it is used for its purpose, know the third parties it is transferred to, request correction, erasure or destruction, request that these actions be notified to third parties, object to an adverse result produced by automated analysis, and claim compensation for damage.
Applications: [[ILETISIM_EPOSTA]] or [[KEP]]. We conclude requests within 30 days at the latest. Details: https://kulis.ai/privacy · Deletion steps: https://kulis.ai/data-deletion