KVKK Information Notice

Last updated: March 9, 2026

This notice is prepared under Turkish Personal Data Protection Law No. 6698 (KVKK), Article 10, to inform users about data processing activities carried out by VelNotes.

1. Data Controller

Data Controller: VelNotes
Contact: support@velnotes.com
Website: https://velnotes.com/

2. Collection Methods

Personal data may be collected electronically through app usage, website forms, account operations, subscription verification, and cloud workflows.

3. Personal Data Categories

Identity/contact data (name, email, optional phone, UID), usage/transaction data (notebook operations, backup activity), and device/security data (device IDs, FCM token, App Check, request timestamps, IP address, user-agent, security logs) may be processed. In notebook sharing/collaboration flows, invitation metadata (sender/recipient email, role, optional access duration, invitation status), shared-access lists, and plan-based access-limit status may also be processed. For website analytics, country/region distribution may be measured using country code inferred from request headers (with Accept-Language fallback when needed). To preserve the selected website language (Turkish or English), the page may read a language value from the URL and, where preference cookies are allowed, a local on-device preference record; no separate server-side language profile is created. For support requests, operational ticket-status fields (for example open/in-progress/resolved) may also be processed. Where voice features are used, user-approved transcription output may be processed as notebook content. Google Drive backups may include limited ownership metadata (for example Google account email) for restore-safety checks. Pages captured through camera/document-scanner flows, images imported from the photo library, and image/video exports saved to the photo library at the user's request may also be processed as related content data. Device-local biometric lock checks using Face ID / Touch ID or device passcode fallback are handled on the device; VelNotes does not access, store, or transmit biometric template data to its servers.

4. Plan-Based Cloud Processing Notice

On free tier, notebook data is processed local-first and Firebase cloud sync/automatic cloud backup is not provided. Free users may keep up to 3 personal notebooks they create and up to 3 separate shared notebooks they accept. On Premium/Ultra tiers, notebook metadata and content assets may be processed in Firestore/Storage for cloud features. Google Drive backup remains manual and user-initiated on both tiers.

5. Processing Purposes

Data is processed for service delivery, account management, notebook editing/sync, subscription validation, security and anti-abuse controls, notification delivery operations, user support, and legal compliance.

6. Legal Bases

Processing may rely on legal bases including contractual necessity, legal obligations, protection/exercise of rights, legitimate interests, and explicit consent when required.

7. Data Transfers and Sub-processors

Data may be transferred to infrastructure/service providers such as Apple, Google/Firebase, and Google Drive depending on user action and technical workflow. In the current production scope, no external AI/LLM provider is used for content processing or voice transcription. International transfer may occur.

Sub-processors: Google LLC (Firebase: Auth, Firestore, Storage, Functions, FCM, App Check — USA, under Google Cloud DPA); Google LLC (Google Drive API — USA, subject to user's Google account terms); Apple Inc. (Apple Sign-In, StoreKit 2, Speech.framework — USA, under Apple Developer Program License Agreement).

International transfer safeguards: Transfers are safeguarded under KVKK Article 9 through explicit consent or adequate protection conditions, and under GDPR Article 46 through EU Standard Contractual Clauses (SCCs).

8. Voice Recording Storage Notice

When voice recording starts, an app-local temporary audio file may be created (velnotes_recording_*.m4a). The file is used for recording/transcription workflow continuity and may be removed by cleanup flows or when a new recording replaces it. If the user exports the file, retention is governed by the selected destination. Voice transcription flow runs with on-device speech recognition provided by the operating system when supported; on unsupported devices this feature cannot be used. Transcription output is generated automatically on a best-effort basis and accuracy is not guaranteed. In the default flow, raw voice files are not uploaded to Firestore/Storage databases.

9. Retention

Data is retained for the period necessary for processing purposes and legal requirements. Account deletion triggers backend cleanup flows for cloud data. Content moved to trash is retained for up to 30 days unless permanently deleted earlier by the user; after that period, automatic cleanup flows remove it permanently. Security and anti-abuse logs (including IP address and user-agent) may be retained for limited periods under legitimate-interest and legal-obligation grounds. For support and contact requests, records are removed after resolution once there is no ongoing operational need. In case of delivery or processing failures, records may be retained temporarily for retry handling. Free-tier local notebook data may be lost on uninstall/device-loss unless a backup exists. Google Drive backups remain under the user's Google account control.

10. Rights Under KVKK Article 11

You may request access, correction, deletion, objection, and other rights recognized under KVKK. You can also manage notification permissions through operating system settings. Requests may be submitted to support@velnotes.com with sufficient identity verification details.

11. Data Breach Notification Procedure

In the event of a personal data breach, notification will be made to the relevant Data Protection Authority within 72 hours in accordance with KVKK Article 12/5 and GDPR Article 33. If the breach poses a high risk to users' rights, affected users will be notified by email within a reasonable timeframe. Contact: support@velnotes.com

12. Cookie Note

velnotes.com uses strictly necessary storage and consent-based optional categories. Website analytics may include visited-page and country/region distribution measurements via country code inferred from request headers, without requesting browser geolocation access. See Cookie Policy for details.