Privacy notice (GDPR & KVKK)

Last updated: September 30, 2026

Draft. This page is being finalized and may change before launch. The Turkish version is the reference text.

This notice explains how Vocalun processes personal data. The data controller is Mehmet Yıldızlı (Vocalun). It is prepared under Turkey’s Personal Data Protection Law No. 6698 (KVKK) and, for users and visitors in the European Economic Area and the UK, the General Data Protection Regulation (GDPR).

Data we collect from website owners

• Your email address: to sign you in to the dashboard and send account notifications.
• Your website address and the text of your site’s public pages: so the assistant can learn your site.
• Payment details: processed only by Paddle; your card details never reach us.

Data we collect from your site’s visitors

• Voice: when a visitor starts a conversation, their audio is streamed in real time to Google’s Gemini service during the conversation. Vocalun does not store voice recordings.
• Notes: if the visitor agrees, their name, contact details and message are stored so they can be passed on to the site owner.
• Usage records: conversation start time and duration, the site address and, to prevent abuse, the IP address.
• The visitor’s name and interests are kept only in the visitor’s own browser so the assistant can remember them, and are deleted when they say “forget me”.

Legal bases (GDPR)

• Performance of a contract: running your account and the service you signed up for.
• Consent: visitor notes are stored only after the visitor agrees.
• Legitimate interests: usage and IP records for billing, security and abuse prevention.
• Legal obligation: records we must keep under tax and other applicable law.

As a website owner, you act as the controller for your visitors’ data and Vocalun processes it on your behalf. You are responsible for informing your visitors, for example in your own privacy notice.

International transfers

Data is processed through Supabase (Frankfurt, Germany data center), Google (Gemini voice service) and Paddle (payments). Some of these providers are located outside Turkey and the EEA. Transfers are made only as far as needed to provide the service, based on your explicit consent under KVKK and, for GDPR, on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Retention

Account data is kept while your account is open, visitor notes until you delete them or close your account, and usage records for 24 months.

Your rights

Under Article 11 of KVKK and the GDPR, you have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent, you can withdraw it at any time. You may also lodge a complaint with a supervisory authority (in Turkey, the KVKK Authority; in the EU, your local data protection authority).

To make a request: mhyildizli@gmail.com