KVKK Disclosure Notice

This Disclosure Notice is prepared under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the related Communiqué. For details on how data is protected, please also see the Privacy Policy.

1. Identity of the Data Controller

The data controller under KVKK is the natural person whose contact details appear below:

2. Personal Data Processed

• Identity and contact data: Name, username, e-mail address. When you purchase a subscription you also enter, in the form at the payment step, your full name, mobile phone number, Turkish national ID number (T.C. Kimlik No), and billing address (and a delivery address if you additionally provide one); this information is processed and stored by me for issuing the invoice and starting the subscription with the payment institution.
• Customer transaction data: Purchase record, amount and currency, payment reference, Premium start and end dates. Your card details are never seen, processed, or stored by me, they are handled solely by the payment institution.
• Education/usage data: Exams you generate, your results, progress statistics, chat messages, and any files or text you submit to the platform.
• Transaction security data: IP address, session token, device/browser information, server logs, last-seen time.

3. Transparency About AI and Retrieval-Augmented Generation (RAG)

Mayza uses retrieval-augmented generation (RAG) to produce exam questions and chat answers. For your personal data, this means:

• Chat messages and exam generation requests you submit are sent to AI model providers located outside Türkiye so that a response can be generated.
• Documents you upload or that are added to the system are split into chunks and converted into vector representations (embeddings), which are stored in the database alongside the corresponding text.
• When you ask a question, your question is also converted into a vector, the most relevant text chunks are retrieved, and they are sent to the AI model as context.
• For this reason I strongly recommend that you do not enter sensitive or special-category personal data into the chat or exam fields. Anything entered there is processed and may be transmitted to the model provider.
• AI-generated content can be wrong and should be verified against official sources.

AI outputs are not used to make automated decisions producing legal effects concerning you or similarly significantly affecting you.

4. Purposes of Processing

• Creating your account, authentication, and session management
• Granting the Premium access you purchased, tracking its term, and keeping the purchase record
• Concluding the subscription agreement, issuing invoices, and transmitting the identity and address details needed to start the subscription to the payment institution
• AI-assisted exam generation, chat responses, and calculating progress statistics
• Responding to support requests and feedback
• Securing the service and preventing abuse
• Meeting legal obligations, in particular commercial and financial record-keeping

5. Legal Grounds

• Conclusion or performance of a contract (Art. 5/2-c): Account operations, providing Premium access, subscription and purchase records, and transmitting your billing and delivery details to the payment institution to start the subscription.
• Compliance with a legal obligation (Art. 5/2-ç): Issuing invoices and retaining financial and commercial records (including the Turkish national ID number and billing address).
• Legitimate interests (Art. 5/2-f): Security, abuse prevention, service improvement.
• Explicit consent (Art. 5/1): Waitlist sign-up and marketing messages.

6. Method of Collection

Your personal data is collected electronically through registration forms, the platform interface, the billing-details form you complete at the subscription purchase step, transaction notifications sent to me by the payment institution in respect of the payment process, and automatic system records.

7. Transfers, Including Abroad

Your data is not sold. To the extent necessary to provide the service, it is transferred to the following categories of recipients:

• Payment institution: iyzico, to take and verify payment and to start the subscription. For this purpose your full name, e-mail, mobile phone number, Turkish national ID number, and billing/delivery address are transferred to iyzico. iyzico is established in Türkiye; this is not a transfer abroad.
• AI model providers: To generate exam and chat content (outside Türkiye).
• Hosting, database, and storage providers: For servers, databases, and file storage (may be outside Türkiye).
• E-mail delivery providers: To send account and purchase notifications.
• Competent public authorities: Only upon lawful request.

Transfers abroad are made in accordance with the conditions set out in Article 9 of the KVKK and only to the extent necessary to provide the service.

8. Retention Period

Account and usage data is retained for as long as your account is active. Purchase and payment records are retained for ten (10) years under applicable financial legislation; the subscription's billing and identity details (full name, mobile phone number, Turkish national ID number, billing and delivery address) are retained for the same period as part of those records. If you request deletion of your account, your data is deleted or anonymised within a reasonable time, subject to legal retention obligations.

9. Your Rights Under Article 11 of the KVKK

By applying to the data controller you have the right to: learn whether your personal data is processed; request information if it has been; learn the purpose of processing; know the third parties to whom it is transferred in Türkiye or abroad; request correction if it is incomplete or inaccurate; request erasure or destruction; request that these actions be notified to third parties to whom the data was transferred; object to a result arising against you from analysis carried out exclusively by automated systems; and claim compensation for damage suffered due to unlawful processing.

You may submit your application to the e-mail address or postal address below, in accordance with the Communiqué on Application Procedures to the Data Controller. Your request will be answered within 30 days at the latest.

10. Applying to the Data Controller