Privacy Notice (KVKK)

This notice is provided by Beyaz Tahta ("Beyaz Tahta"), as data controller, under the Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform you about how your personal data is processed.

1. Personal data we process

• Identity and contact: name, email address.
• Account and security: password (irreversibly hashed), IP address, session and login records, browser information.
• Content: notes, shapes, images and files you add to boards.
• Preferences: language, time zone, theme, notification and communication preferences.
• Customer transactions: subscription and billing details (card details are never stored by Beyaz Tahta; they are processed by the payment provider).

2. Purposes and legal bases

• Creating your account and providing the service — performance of a contract (KVKK Art. 5/2-c).
• Information security, abuse prevention, record keeping — legal obligation and legitimate interest (Art. 5/2-ç, f).
• Billing and accounting — legal obligation (Art. 5/2-ç).
• Responding to requests and complaints — legitimate interest (Art. 5/2-f).
• Commercial electronic messages — only with your explicit consent (Art. 5/1).

3. Transfers

Your data may be shared with providers we use for hosting, email delivery and payments, and with authorised public authorities, to the extent necessary. Your data is stored on our servers in Türkiye. However:

• Web traffic is routed through Cloudflare (content delivery network) for security and performance.
• When you use AI features, the relevant board content is sent to OpenAI solely for that operation.

These constitute cross-border transfers under KVKK Art. 9 and are carried out with the safeguards required by law.

4. Collection method

Personal data is collected electronically through forms, cookies and your use of the website and application.

5. Your rights

Under KVKK Art. 11 you have the right to learn whether your data is processed, request information, learn the purpose of processing, know the third parties to whom it is transferred, request correction, deletion or destruction, object, and claim compensation for damages.

6. Contact

You can send your requests to [email protected] or in writing to —. Requests are concluded free of charge within 30 days at the latest.