KVKK Disclosure Notice

This text has been prepared under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, to inform persons who use the blink artifacts service (the “Service”) or who view an Artifact shared on the Service. A broader explanation is in the Privacy Policy.

1. Data controller and representative

Data controller

BlinkBros Technology Ltd. (a company registered in the Dubai International Financial Centre (DIFC)) · DIFC Commercial Licence No: CL11924 (DIFCA registration no. 11924) · UAE Corporate Tax TRN: 105243278600001

Address

Innovation Hub, IH-00-01-01-OF-01, Floor 1, Dubai International Financial Centre, Dubai, United Arab Emirates

Email

support@blinkbrosai.com

Data controller’s representative in Turkey

Information on the data controller’s representative is to be added to this text once the appointment is completed.

Data Controllers’ Registry (VERBİS)

VERBİS registration details are to be added to this text once the registration is completed.

The data controller is not established in Turkey. Under the Regulation on the Data Controllers’ Registry, data controllers not established in Turkey register with the Registry through a data controller’s representative who is either a legal entity established in Turkey or a natural person who is a citizen of the Republic of Turkey. The representative is also authorized to forward your applications to the data controller and to deliver the responses to you.

2. Personal data processed

• Identity: optional display name.
• Contact: email address; email addresses of people invited to an Artifact.
• Customer transaction: Stripe customer ID, subscription status, whether the trial right has been used, the time of the approvals given before subscribing and the version of the approved text. Card details do not reach the data controller; they are received by Stripe.
• Transaction security: hashes of one-time sign-in codes and API tokens, session information, IP address, request time and browser information, hash of the IP address of the person submitting an abuse report.
• User content: Artifacts, uploaded files, comments, questions asked to the Agent and their versions; sharing roles and link settings.
• View information: name, last view time and view count of the signed-in viewer.
• Requests and complaints: the reason for abuse reports and applications you submit to the data controller.

3. Purposes of processing and legal bases

Opening an account, sign-in, providing the Service, publishing, sharing and collaboratively editing Artifacts, delivering comments and questions, sending transactional emails

Processing being directly related to the establishment or performance of a contract (KVKK art. 5/2-c)

Starting, running and ending the subscription; recording pre-contractual information and contract approvals and sending the contract by email

Establishment or performance of a contract (art. 5/2-c); compliance with legal obligations arising from consumer and tax legislation (art. 5/2-ç); establishment, exercise or protection of a right (art. 5/2-e)

Showing the Artifact Owner the view information of signed-in viewers

Performance of a contract (art. 5/2-c) and the legitimate interests of the data controller, provided that your fundamental rights and freedoms are not harmed (art. 5/2-f)

Bot protection, rate limiting, infrastructure logs and information security

Legitimate interests of the data controller (art. 5/2-f); legal obligation with respect to data security obligations (art. 5/2-ç, art. 12)

Reviewing abuse reports, removing content and retaining evidence

Establishment, exercise or protection of a right (art. 5/2-e) and legitimate interests (art. 5/2-f)

Responding to applications and fulfilling requests of competent authorities

Being expressly provided for by law and legal obligation (art. 5/2-a and ç)

No special categories of personal data (KVKK art. 6) are collected. There is no processing based on explicit consent.

4. Method of collection

Personal data is collected electronically, partly by automated means, through the Service’s web interface, requests made by your Agent over MCP, email invitations and the Stripe payment page. Connection and security data is collected automatically through essential cookies and infrastructure logs.

5. Recipient groups to whom data is transferred

• Service providers: Cloudflare (hosting: Workers, D1, R2, Durable Objects; Turnstile; infrastructure logs), Stripe (payment and subscription), Resend (transactional emails). The purpose of the transfer is to provide the Service, collect payment and deliver emails.
• Other users: people with access to the Artifacts you share see the content, the comments and your name according to their role; the Artifact Owner sees the view information of signed-in viewers.
• The Artifact Owner’s AI Agent: a question you ask the Agent in an Artifact is forwarded to the Artifact Owner’s own Agent. The AI provider to which the Agent sends the question and content is chosen by the Artifact Owner; this processing is outside the Service.
• Organizations making enterprise integrations: if you use the Service through an organization’s product, that organization.
• Competent public authorities and institutions: only when legally required and upon request.

6. Transfer abroad

The data controller is established in the United Arab Emirates (DIFC). When you use the Service from Turkey, your personal data is transferred to the data controller in the United Arab Emirates and from there to Cloudflare, Stripe and Resend, whose infrastructure is outside Turkey, principally in the United States and the European Union.

Under KVKK art. 9, where one of the processing conditions above exists, these transfers may be made by signing a standard contract and notifying the Turkish Personal Data Protection Authority within five business days of signing. Information on the basis of the transfer is to be added to this text once that process is completed.

7. Roles in enterprise integrations

An organization may connect the Service to its own product and create Artifacts on behalf of its own users. With respect to these users’ data, the relevant organization may be the data controller and BlinkBros Technology Ltd. may be the data processor acting on the organization’s behalf. In that case you should direct your applications first to the relevant organization; the exact roles of the parties are determined by the contract with the organization.

8. Retention periods

Personal data is retained for the period necessary for the purpose for which it is processed (KVKK art. 4/2-d, art. 7). Sign-in codes are valid for 10 minutes; the session cookie lasts 30 days. If you delete your account, your sessions, API tokens and subscription are closed immediately; your account and deleted Artifacts are permanently deleted after 30 days. Database backups are kept for up to 30 days. Abuse reports are retained as evidence. Comments you write on other people’s Artifacts and content you add may remain in that Artifact; your name may continue to appear there as text. Details are in the Privacy Policy.

9. Your rights

Under KVKK art. 11, by applying to the data controller you have the right to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether it is used in accordance with that purpose,
• know the third parties to whom it is transferred in Turkey or abroad,
• request correction if it is incomplete or inaccurately processed,
• request erasure or destruction within the conditions set out in KVKK art. 7,
• request that correction, erasure and destruction be notified to the third parties to whom the data has been transferred,
• object to the occurrence of a result against you through analysis of the processed data exclusively by automated systems,
• claim compensation for the damage if you suffer damage due to unlawful processing.

10. How to apply

You can submit your application by one of the following means, in accordance with article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller:

• by emailing support@blinkbrosai.com from the email address registered with the Service,
• in writing to the address of the data controller’s representative in Turkey (representative details are to be added to this text once the appointment is completed),
• in writing to the address of the data controller: Innovation Hub, IH-00-01-01-OF-01, Floor 1, Dubai International Financial Centre, Dubai, United Arab Emirates.

Your application must include your first name and surname, your signature for written applications, your Turkish Republic ID number if you are a citizen of the Republic of Turkey (your nationality and passport or ID number if you are a foreigner), your address for notification, your email address and telephone number if any, and the subject of your request.

Your application is concluded free of charge as soon as possible and at the latest within 30 days, depending on the nature of the request (KVKK art. 13). If the process requires an additional cost, a fee may be charged according to the tariff set by the Board. If your application is rejected, you find the response insufficient, or no response is given in time, you can lodge a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and in any case within 60 days from the date of application (KVKK art. 14).