Privacy Notice (KVKK)

Last updated: 10 October 2026

This privacy notice is issued by U2 AI Studio Teknoloji Anonim Şirketi as data controller under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains which personal data we process through the teknogirisim.ai landing page and the app.teknogirisim.ai application platform, for what purposes and on what legal grounds, how long we keep it and how you can exercise your rights. It applies together with the Privacy Policy and the Cookie Policy. The Turkish version prevails.

1. Identity of the Data Controller

Your personal data is processed by U2 AI Studio Teknoloji Anonim Şirketi ("U2 AI Studio") as data controller.

This notice covers the teknogirisim.ai and app.teknogirisim.ai domains.

2. Personal Data We Process

• Identity: first and last name; your Turkish identity number if you sign in with e-Devlet.
• Contact: email address, mobile phone number.
• Account and transaction security: an irreversible hash of your password (the password itself is not stored), authenticator app key, one-time code records, session records, the permanent identifier of your Google or Apple account if you sign in with it, IP address, time of action, browser information and tamper-evident audit records.
• Company and representation: the trade name, tax number, MERSİS number, founding date, activity codes, shareholding and SME details of the company you represent, and the signature circular or power of attorney showing your authority.
• Application content: your form answers, the documents you upload (founder presentation, acceptance letters, financial statements, R&D documents) and the text extracted from them.
• Evaluation and decision: eligibility check results, AI-assisted evaluation outputs, the Decision Passport, your appeals and the notifications sent to you.

Special categories of personal data. Please do not include special categories of data (health, biometric or genetic data, criminal records, religion, philosophical or political beliefs, union membership) in your application or documents. We do not request or use such data; if it reaches us inside a document, it is not processed for any purpose and is removed at the first opportunity.

3. How We Collect Personal Data

• The registration, sign-in, second-factor, company and application forms and document upload fields on app.teknogirisim.ai.
• If you choose to, sign-in with e-Devlet (through the Ministry sign-in system), Google or Apple: these providers verify your identity and pass us only what sign-in requires.
• Server, session and security records created automatically while the site and platform are served.
• Correspondence you send us for a data protection request or support.

The teknogirisim.ai landing page has no forms and sets no cookie of its own; see the Cookie Policy.

4. Purposes of Processing

• Creating your account and verifying your identity and session.
• Receiving, pre-checking, checking against the regulatory conditions and evaluating your applications.
• Notifying you of the decision with its reasons and evidence; receiving and deciding your appeals.
• Assuring evaluation quality: later review of a sample of decisions by authorised people and monitoring for system drift.
• Keeping applications, decisions and correspondence as evidence in case of a dispute.
• Meeting our obligations under data protection and other legislation.
• Securing the platform and the infrastructure serving it; protection against unauthorised access, bots and abuse.

We do not use your data for ad targeting or any other purpose, and we do not sell or rent it.

5. Legal Grounds

Your personal data is processed under the conditions in KVKK Art. 5/2 that do not require explicit consent:

We do not rely on explicit consent. The checkbox on our registration form confirms that you have read this notice; it is not a declaration of consent, and leaving it unticked or withdrawing it does not change the legal ground on which your data is processed. The general principles of KVKK Art. 4 apply to every processing activity. No commercial electronic messages are sent through the platform.

6. Transfers, Including Abroad

• Our hosting, content delivery and security provider (Cloudflare) and our server infrastructure provider (Amazon Web Services; servers in Frankfurt, Germany).
• The email (Mailgun; EU region) and SMS (NetGSM; Türkiye) providers that deliver verification codes and notifications.
• Identity providers depending on your chosen sign-in method (e-Devlet through the Ministry sign-in system, Google, Apple); only the sign-in request is passed to them.
• AI service providers used to evaluate documents (Anthropic, OpenAI), subject to the pilot restriction below.
• Professional advisers bound by confidentiality (accountants and legal counsel).
• Competent public authorities and courts where the law requires.

AI providers and the pilot restriction. During the pilot, only data from applications marked as synthetic (test) is sent to AI services abroad. Real application data is not transferred to these services; the platform technically blocks such transfers for applications not marked as synthetic and for content containing a Turkish identity number.

Some providers are established outside Türkiye. Transfers abroad are made under KVKK Art. 9: on the basis of an adequacy decision of the Personal Data Protection Board where one exists; otherwise on one of the appropriate safeguards in Art. 9/3 (usually the Board's standard contract, notified to the Board within five business days of signature); failing these, only in the occasional cases listed in Art. 9/6. Fonts on the landing page are served by Google Fonts; your IP address and browser information may be processed by Google, which may involve a transfer to the United States.

7. Retention Periods

At the end of the period, data is erased, destroyed or anonymised under KVKK Art. 7 and the related Regulation; the periodic destruction interval does not exceed six months.

8. Security and Automated Decisions

We apply technical and organisational measures under KVKK Art. 12: encryption in transit (TLS), encrypted storage of Turkish identity numbers and authenticator keys, irreversible password hashing, mandatory two-step verification, least-privilege access control and a tamper-evident (hash-chained) audit log. No measure makes a system risk-free; we claim no certification or accreditation for this platform.

Automated decisions. Applications may be decided by an eligibility check and an AI-assisted evaluation based on your documents. Within the meaning of KVKK Art. 11/1-g this means a result about you produced by analysing your data exclusively through automated systems. We do this with the following safeguards: the reasons for every decision and the document quotations it relies on are shown to you in the Decision Passport; applications the system is unsure about, or on which the evaluators disagree, go to an expert; a sample of decisions is reviewed later by authorised people; you can appeal a negative decision within 15 business days of notification, and the appeal is decided by people who did not make the first decision. You may also exercise your right to object under Art. 11/1-g through the channels in section 10.

9. Your Rights under KVKK Art. 11

• to learn whether your personal data is processed (Art. 11/1-a);
• to request information if it is processed (b);
• to learn the purpose of processing and whether it is used accordingly (c);
• to know the third parties to whom it is transferred in Türkiye or abroad (ç);
• to request correction of incomplete or inaccurate data (d);
• to request erasure or destruction under the conditions of Art. 7 (e);
• to request that corrections, erasures or destructions be notified to recipients (f);
• to object to a result against you arising from analysis exclusively by automated systems (g);
• to claim compensation for damage caused by unlawful processing (ğ).

10. How to Apply

You can submit requests through the channels in Art. 5 of the Communiqué on the Procedures and Principles of Applications to the Data Controller:

• In writing: Ahi Evran OSB Mah. Erkunt Cad. No: 3 İç Kapı No: 41, 06935 Sincan / Ankara, Türkiye (in person with ID or through a notary).
• Registered electronic mail (KEP): [email protected]
• With a secure electronic or mobile signature to [email protected].
• From the email address you previously notified to us and that is registered in our system, to [email protected].

Requests are answered free of charge as soon as possible and within thirty days at the latest; if the action requires an additional cost, the fee in the Board's tariff may be charged (KVKK Art. 13). If your request is rejected, you find the answer insufficient or it is not answered in time, you may complain to the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of the request (KVKK Art. 14). Questions about this notice: [email protected]