KVKK Transparency Notice

1. Data Controller

PrimaSpec ("we", "us", or "our") is the data controller responsible for your personal data under the Turkish Personal Data Protection Law No. 6698 ("KVKK").

Contact: [email protected]

2. Personal Data Processed

We process the following categories of personal data:

• Identity data: Name, email address
• Technical data: IP address, browser type, device information
• Usage data: Pages visited, feature usage patterns, navigation data
• Project content: Project descriptions, conversation messages, generated specifications
• Google profile data: Basic profile information if you sign in via Google (name, email, profile picture)
• Payment information: Transaction records processed via Coda Payments (we do not store credit card numbers)

3. Processing Purposes

Your personal data is processed for the following purposes:

• Service provision: Operating and maintaining the PrimaSpec platform, including account management and authentication
• AI-powered specification generation: Processing your project descriptions and conversation messages through AI models to generate technical architecture specifications
• Payment processing: Managing credit purchases and transaction records
• Billing: Maintaining billing records and usage history for accounting and tax compliance
• Communication: Sending transactional communications about your account (receipts, security alerts, service notifications)
• Security: Detecting, preventing, and addressing fraud, abuse, and security issues

4. Data Transfers

Your personal data may be transferred to the following recipients:

• Anthropic (USA): Your project descriptions and conversation messages are sent to Anthropic for AI-powered specification generation. Anthropic does not use your data for model training.
• Coda Payments: Payment and billing data is processed by Coda Payments for transaction handling, invoicing, and fraud prevention.
• Hosting and infrastructure providers: Data is stored and processed on cloud infrastructure to operate the Service.

These transfers involve cross-border data transfers to countries outside of Turkey. Appropriate safeguards, including Standard Contractual Clauses (SCCs), are in place to ensure an adequate level of data protection in accordance with KVKK requirements.

5. Legal Basis for Processing

We process your personal data on the following legal bases under KVKK:

• Explicit consent (Article 5(1)): For processing activities that require your explicit consent, including cross-border data transfers to AI providers and optional analytics
• Contractual necessity (Article 5(2)(c)): Processing that is necessary for the performance of the contract between you and PrimaSpec, including account management, service delivery, and payment processing
• Legal obligation (Article 5(2)(ç)): Processing required to comply with legal obligations, including tax and accounting record-keeping requirements under Turkish law

6. Retention Periods

We retain your personal data for the following periods:

7. Your Rights Under KVKK Article 11

As a data subject, you have the following rights under Article 11 of KVKK:

• Learn whether your personal data is being processed
• Request information about the processing if your data has been processed
• Learn the purpose of processing and whether data is used in accordance with its purpose
• Know the third parties to whom your personal data has been transferred, domestically or abroad
• Request correction of your personal data if it is incomplete or inaccurate
• Request deletion or destruction of your personal data under the conditions set forth in Article 7
• Request notification of corrections, deletions, or destruction to third parties to whom your data has been transferred
• Object to any result that is to your detriment arising from the analysis of your processed data exclusively through automated systems
• Claim compensation for damages arising from the unlawful processing of your personal data

You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) at kvkk.gov.tr if you believe your rights have been violated.

8. Contact

To exercise any of your rights or for questions about this notice, contact us at [email protected].

For the separate explicit consent document required under KVKK Board Decision 2018/90, please see our KVKK Explicit Consent page.

9. Related Policies

This transparency notice should be read together with our Privacy Policy, which provides additional detail on how we handle personal data across all jurisdictions.