This English version is provided for convenience. In case of any discrepancy, the Turkish version prevails.
1. Data controller
Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by our company, acting as data controller, whose details are given below.
Data controller: Nora Finansal Yazılımlar A.Ş.
Address: Şehit İlknur Keleş Sk. No:2 Kozyatağı, İstanbul, Türkiye
Central Registration System (MERSİS) No: 06311925104000001
Email: info@noratech.com.tr
2. Personal data we process and its sources
| Data category | Examples | How it is collected |
|---|---|---|
| Identity | First and last name | Demo request form, account sign-up |
| Contact | Email address, phone number (optional) | Demo request form, account and report recipient settings |
| Customer transaction | Organisation name, brand or person to be monitored, plan, subscription and billing details, support correspondence | Form, account dashboard, email |
| Transaction security | Username, password hash (the password itself is never stored), encrypted AI API keys, IP address, session and access logs | Automatically, while you use your account |
| Service content | Monitoring profiles, keywords, agenda briefs, generated reports | Account dashboard |
| Publicly available publications | Names and information of people who may appear in the news and publications scanned | Scanning public sources for the topics defined by the customer |
Your personal data is collected electronically through the channels above, partly by automated means.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5/2) |
|---|---|
| Assessing your demo request and contacting you | Directly related to the conclusion of a contract (c) |
| Creating your account, providing the service, running monitoring and reporting, emailing reports | Performance of a contract (c) |
| Subscription, billing and accounting | Expressly provided by law and legal obligation (a, ç) |
| Ensuring information security, preventing misuse, keeping access logs | Legal obligation (ç) and legitimate interest (f) |
| Improving the service, answering support requests | Legitimate interest (f) |
| Establishing, exercising or defending a right in case of a dispute | Establishment, exercise or protection of a right (e) |
Commercial electronic messages (campaigns, newsletters, etc.) are sent only if you give separate consent under Law No. 6563. You can withdraw this consent at any time.
4. People mentioned in public publications
Yankı only scans content that has been published publicly, for the brands, people and topics defined by customers. Data relating to people named in this content is processed on the customer's instruction and solely for media monitoring and reporting. The customer who decides which people and topics are monitored is responsible for its own data controller obligations for this data; for this processing our company acts as a data processor on the customer's behalf.
5. Transfers of personal data
Your personal data may be transferred, limited to the purposes above and in line with KVKK Articles 8 and 9, to the following recipient groups:
- Hosting and infrastructure providers: The website is hosted on Vercel Inc. (USA) infrastructure; when you visit it, technical connection data such as your IP address is processed by this provider. The fonts used on the site are loaded from Google Fonts (Google LLC, USA).
- Email delivery provider: Turkticaret.net, for delivering reports and notifications.
- Payment service provider: iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), for subscription payments. Your card details are not stored by our company.
- Authorised public authorities: Where required to comply with legal obligations.
Analyses run with your own AI key (BYOK)
News analysis is performed by the AI provider you configure on your account (e.g. Anthropic, OpenAI, Google) using your own API key and account. Content sent for this analysis is processed under your contract with that provider and its data policies. You decide which provider is used.
Transfers abroad rely on the appropriate safeguards set out in KVKK Article 9 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (e.g. standard contracts published by the Personal Data Protection Board).
6. Retention
Your personal data is kept for as long as the processing purpose requires and for the periods set by law; once this period ends it is erased, destroyed or anonymised. In particular:
- Account and service data: during the subscription and for 12 months after the subscription ends or the account is closed,
- Scanned publication content and generated reports: for 6 months from their creation,
- Invoices and accounting records: for 10 years under the Tax Procedure Law and the Turkish Commercial Code,
- Demo requests that do not lead to a contract: for 6 months from the request date.
7. Your rights under KVKK Article 11
By applying to our company, you have the right to:
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used in line with that purpose,
- Know the third parties in Türkiye or abroad to whom it is transferred,
- Request correction if it is incomplete or inaccurate,
- Request erasure or destruction under the conditions in KVKK Article 7,
- Request that third parties to whom data was transferred be notified of actions taken under (e) and (f),
- Object to a result against you arising exclusively from analysis by automated systems,
- Claim compensation for damages caused by unlawful processing.
8. How to apply
You can submit requests regarding your rights, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the address above together with information that identifies you, via registered electronic mail (KEP), with a secure electronic or mobile signature, or from the email address registered with us to info@noratech.com.tr.
Your request will be concluded free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged.