KVKK Notice

Law No. 6698 on the Protection of Personal Data (KVKK), Art. 10 · Last updated: 2 October 2026

This is the English version of Yaziio's Turkish KVKK information notice (KVKK Aydınlatma Metni). It is written for people whose personal data is processed through Yaziio (people who comment on or message an Instagram account, and account owners who use Yaziio). Yaziio is in development: the processing described below will apply once the service goes live; today only notifications from Meta (raw event records) are received.

1. Data controller

Tolga Vuranel. Contact: [email protected]

2. Personal data to be processed (once the service is live)

Identity/contact: Instagram username and the user ID assigned by Instagram (IGSID); profile name where available,
Customer transaction/communication: comment and message content, timestamps, button-tap information, replies given, conversation state and tags,
Transaction security: the account owner's access token (to be stored encrypted), access and error logs.

3. Purposes of processing (once the service is live)

Replying to comments and messages, routing messages by topic, showing conversation history to the account owner, handling course/event/product requests, ensuring the security and continuity of the service and preventing abuse.

4. Legal basis

Your personal data is processed under KVKK Art. 5/2 on the grounds that (c) it is directly related to the establishment or performance of a contract (replying at your request), (f) it is necessary for the legitimate interests of the data controller, provided it does not harm your fundamental rights and freedoms, and (ç) it is necessary to comply with a legal obligation. For processing that requires explicit consent, your consent will be requested separately.

5. Transfers

Once the service is live, your data may be transferred to Meta Platforms (Instagram) to receive and send messages (today we only receive notifications from Meta), to Anthropic to generate replies and classify messages (planned; no data is transferred to Anthropic today) and to infrastructure providers so the service runs securely. Anthropic's servers may be located abroad (United States); this transfer will be made under KVKK Art. 9, with the safeguards required by the legislation.

6. Method of collection

Once the service is live, data will be collected automatically through Instagram's official application programming interface (API), within the authorization the account owner gives Yaziio. Today only the notifications Meta sends to our webhook address are received.

7. Retention period

The default target is 180 days: conversation and comment content will be kept for 180 days and then deleted, destroyed or anonymised. Automatic deletion/anonymisation will be added when the application goes live; today there is no automatic deletion and deletion requests are handled by email. Where a legal retention obligation exists, data is kept for the relevant period.

8. Your rights under KVKK Art. 11

To learn whether your personal data is processed,
To request information if it has been processed,
To learn the purpose of processing and whether it is used in line with that purpose,
To know the third parties to whom it is transferred in Türkiye or abroad,
To request correction if it is incomplete or inaccurate,
To request deletion or destruction under KVKK Art. 7 and to request that this be notified to third parties to whom the data was transferred,
To object to a result against you arising from the analysis of processed data exclusively by automated systems,
To claim compensation if you suffer damage because of unlawful processing.

9. How to apply

You can send your requests to [email protected], stating your Instagram username and your request. Depending on its nature, your request is concluded within 30 days at the latest. If you are not satisfied with the outcome, your right to complain to the Personal Data Protection Board is reserved. For deletion, see the Data Deletion page.