KVKK Disclosure

1. Data Controller and Contact

For personal data of data subjects in Türkiye, the data controller (veri sorumlusu) under KVKK is CAMPUS ARC TEKNOLOJİ LİMİTED ŞİRKETİ.

The ARCY AI product is operated by our group company Campus Arc, Inc. in the United States, which is the counterparty to an Operator's subscription. For KVKK purposes in Türkiye, the controller is the company named above.

2. Scope

This disclosure covers personal data of Operators using ARCY AI and their authorized staff, End Users of products where arcy.js is installed, our own employees and job applicants, visitors to arcyai.com, supplier contacts, and business partners.

3. Categories of Personal Data

• Identity: name, surname, and similar account holder details.
• Contact: email address, telephone number, and similar details.
• Transaction security: IP address, session information, account details, logs, and security records.
• Customer transactions: support requests, contact form records, and transaction history.
• Financial: invoicing and payment records. Payment runs through Clerk Billing with Stripe behind it.
• Marketing: cookie records and site usage preferences.
• Personnel: information relating to our own employees and job applicants.
• Legal: records of legal processes and official correspondence.

End User data collected through arcy.js is application data belonging to the Operator's product, in four kinds: behavioral signals, identity attributes the Operator chooses to send, an anonymous visitor identifier stored in the browser, and autocapture data. Values likely to be personal are masked before leaving the browser. Conversations, images attached to a message, and the pages and documents an Operator provides for training are also processed. See the Privacy Policy for detail.

4. Purposes of Processing

Personal data is processed to deliver and improve the ARCY AI platform, manage accounts and authentication, answer End User questions and run the flows an Operator has built, produce insights for Operators, run information security and access management, manage customer relationships and handle requests and complaints, carry out finance and accounting, run marketing and site analysis, pursue legal matters, comply with law, respond to authorized public authorities, and run human resources processes.

5. Collection Method and Legal Grounds

Data is collected through arcyai.com, the ARCY dashboard, arcy.js, our contact form, support processes, and contractual relationships, by automated, partly automated, and non-automated means.

Processing relies on the grounds in Articles 5 and 6 of KVKK: necessity for the establishment or performance of a contract, compliance with a legal obligation, necessity for the establishment, exercise, or protection of a right, legitimate interest where it does not harm fundamental rights and freedoms, and explicit consent where required.

6. Transfers

Personal data may be transferred, to the extent the purposes require, to the subprocessors below and to authorized public authorities.

7. Transfers Abroad

Core infrastructure, including AI processing, is hosted in Amazon Web Services regions in the European Union. Personal data is nevertheless transferred abroad through our group company Campus Arc, Inc. and through US-based subprocessors including Clerk, Stripe, Resend, and Google.

Such transfers are carried out under Article 9 of KVKK on the basis of appropriate safeguards, standard contracts, or explicit consent where required.

8. Special Categories of Personal Data

As a rule we do not process special categories of personal data in connection with the ARCY AI platform. Where processing becomes unavoidable in a specific process, for example information a job applicant shares themselves, the additional safeguards required by KVKK and the Board's decisions are applied.

9. Cookies and Similar Technologies

arcyai.com and the ARCY dashboard use strictly necessary cookies and similar technologies. For analytics or marketing technologies, preference and consent mechanisms are applied as the law requires. See our Cookie Policy, including what arcy.js stores on an Operator's own site.

10. Retention and Erasure

Personal data is retained for as long as the law requires or the purpose of processing needs. For application data the periods are as follows.

Deletion requests are completed within 30 days of reaching us. An Operator may request deletion of their application data, and an End User's erasure request can be passed to us through their Operator. Data whose retention period has ended is deleted, destroyed, or anonymized as the law requires.

11. Security Measures

We apply the technical and administrative measures required to prevent unlawful processing of and access to personal data and to keep it safe, including network and application security, access logging and authorization controls, encryption of data held in the cloud, and contractual control of subprocessors. See our Security page for technical detail.

12. Rights of the Data Subject

Under Article 11 of KVKK, data subjects have the right to learn whether their personal data is processed, to request information if it has been, to learn the purpose of processing and whether the data is used in line with that purpose, to know the third parties to whom it has been transferred at home or abroad, to request correction of incomplete or incorrect data, to request deletion or destruction under the conditions KVKK sets, to request that these actions be notified to third parties the data was transferred to, to object to an adverse outcome arising from analysis solely by automated systems, and to claim compensation for damage suffered through unlawful processing.

13. How to Apply

Data subjects may submit KVKK requests to us in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications are concluded as soon as possible and within 30 days at the latest.

For general questions, use our contact page.

14. Updates

We reserve the right to review and update this disclosure at any time in line with changes in law, decisions of the Board, our own processes, or updates to our VERBİS registration.