KVKK Privacy Notice

Kullya is the brand of a sole proprietorship registered in the name of Emre Işık. For the purposes of Law No. 6698 on the Protection of Personal Data ("KVKK" or the "Law"), the data controller is Emre Işık ("Kullya").

• Address: Hacıkaymak Mah. Zuhuri Mehmet Sk. 1.2. Girişler No: 7 İç Kapı No: 10, Selçuklu / Konya
• Tax office and number: Meram Vergi Dairesi Müdürlüğü / 4660984788
• Email: info@kullya.com
• Phone: 0543 212 21 20

This notice covers people who visit the kullya.com corporate website, sign up for the Kullya panel, purchase services from Kullya, or contact us through the contact form, by email or by phone. For data relating to visitors of customer websites built with Kullya, see the "Data on customer websites" section.

Depending on the nature of your relationship with us, only the necessary items from the following data categories are processed:

• Identity: first name, last name; for customers requesting an invoice as an individual, the Turkish national identification number.
• Contact: email address, phone number, billing and correspondence address.
• Customer transactions: order, subscription, renewal and refund records; support requests and correspondence; details of purchased plans, domain names, templates and credits.
• Finance: billing details, tax office and tax number, payment amount and status, only the last four digits of the card and the card type. The full card number and security code never reach Kullya; they are processed by the payment institution.
• Transaction security: username, password hash (the password itself is not stored), for social sign-in the provider name and your account identifier at the provider, session and login records, IP address, browser information, two-factor authentication records.
• Legal transactions: contract and consent records (version of the accepted text, time of acceptance and IP address), correspondence with public authorities.
• Marketing: commercial electronic message preferences, only if you have given consent.
• User content: the websites, pages and images you create in the panel and the prompts you enter into AI features. You decide this content; whether to include personal data in it is your decision.

Your personal data is processed in line with the general principles in Article 4 of the Law and according to the following pairing of purposes and legal grounds:

• Opening your membership account, providing the panel service, managing orders and subscriptions, invoicing, and sending reminder and renewal notifications: necessity for the establishment and performance of a contract (Art. 5(2)(c)).
• Issuing invoices, keeping accounting records, retaining distance contract and consent records, and responding to requests from competent authorities: compliance with a legal obligation (Art. 5(2)(ç)).
• Retaining traffic information as required by Law No. 5651: express provision by law and compliance with a legal obligation (Art. 5(2)(a), (ç)).
• Ensuring account and system security, preventing abuse and fraud, and monitoring the operation of the service: the legitimate interest of the data controller, provided that it does not harm your fundamental rights and freedoms (Art. 5(2)(f)).
• Establishing, exercising and protecting rights in the event of a dispute: establishment, exercise or protection of a right (Art. 5(2)(e)).
• Responding to requests received through the contact form or by email: necessity for establishing the relationship initiated by your request, and legitimate interest (Art. 5(2)(c), (f)).
• Sending commercial electronic messages (campaigns, announcements, newsletters): your explicit consent and your approval under Law No. 6563 (Art. 5(1)).
• Transmitting the content you enter into AI features to artificial intelligence providers abroad: the condition described below in the "Transfers abroad" section.

Processing based on explicit consent is not carried out unless you give that consent; not giving consent does not prevent your membership or purchases.

Your personal data is collected electronically, by fully or partly automated means, through membership, order, billing information and contact forms, system records generated while you use the panel, email and phone correspondence, transaction results returned by the payment institution and, when you choose to sign in with Google, GitHub, Facebook or Apple, the account identifier, name and email address these providers share with your approval.

Your personal data may be transferred to the following groups of recipients, only to the extent necessary for the purposes above and in accordance with Articles 8 and 9 of the Law:

• Payment institution: the licensed payment institution PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., for collecting card payments. Card details are processed directly on this institution's secure payment page.
• Hosting and infrastructure: the data center service provider in Türkiye where Kullya's servers are located.
• Email delivery: the email infrastructure provider that delivers account, order and security emails (Amazon Web Services).
• Domain name registration: when you purchase a domain name, the contact details required for registration are sent to the domain name registrar and the relevant domain name registry.
• Artificial intelligence providers: only when you use AI features, the prompt you enter and the necessary content (see "Transfers abroad").
• Financial advisors, lawyers and auditors: for accounting and legal obligations, under a duty of confidentiality.
• Competent public institutions and organizations and judicial authorities: upon requests they are legally authorized to make.

Kullya does not sell or rent your personal data and does not share it with third parties for advertising purposes.

Kullya's servers and databases are located in Türkiye. Transfers abroad take place only for the following two services:

• AI features: in AI Studio, AI website creation and similar features, the prompt you enter and the content that needs to be processed are sent to OpenAI, Anthropic, Google, DeepSeek, Z.ai or Cloudflare Workers AI depending on the selected model. These providers' servers may be located in the USA, the European Union, Singapore or the People's Republic of China. This transfer is based on the explicit consent you give when you first use the feature, after being informed of the possible risks in accordance with paragraph six of Article 9 of the Law. If you do not give consent, AI features will not work; the rest of the panel is not affected.
• System emails: account verification, password reset, order and renewal notifications are delivered through the Amazon Web Services email service; for this delivery, your email address and the content of the message pass through servers abroad. This transfer is carried out as an incidental transfer that is necessary for the performance of a contract (Art. 9(6)(b)).

We recommend that you do not include special categories of personal data or sensitive personal data, such as your Turkish national identification number, health information or card details, in your AI prompts.

Personal data is retained for as long as required by the purpose of processing and for the minimum periods set out in legislation; when the period expires, it is deleted, destroyed or anonymized:

• Membership and account data (name, email, phone, sign-in details): for the duration of membership; if you delete your account, it is deleted or anonymised at the end of the 30-day undo period.
• Records kept after the account is deleted (invoice, order, contract and declaration records): for the legal periods below, in a form that cannot be linked to your identity.
• Invoice and accounting records: 10 years (Tax Procedure Law, Turkish Commercial Code).
• Distance contract, pre-contractual information and consent records: at least 3 years (Regulation on Distance Contracts, Art. 20).
• Law No. 5651 traffic records: 1 year.
• Visit statistics records: 12 weeks, with the IP address truncated.
• Contact form requests: 2 years after the request is resolved.
• Commercial message consent and opt-out records: 3 years after consent is withdrawn.
• AI prompts: for the duration of the transaction record kept to provide the service and measure usage; the providers' own retention periods are subject to the providers' policies.

Our customers who build websites with Kullya are themselves the data controllers for the data they collect from visitors to their own websites (contact forms, memberships, orders, email lists). Kullya processes this data only on the customer's instructions, as a data processor, in order to provide the service.

If you are a visitor to a Kullya website, you should first direct any request concerning your data to the owner of that website. If you cannot reach the website owner, you can write to us; we will forward your request to the relevant customer.

By applying to the data controller, you may request to:

• learn whether your personal data is processed and, if so, request information about it,
• learn the purpose of processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom the data is transferred,
• request correction if the data is incomplete or inaccurate,
• request deletion or destruction of the data under the conditions in Article 7 of the Law,
• request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
• object to an outcome against you that arises from analysis exclusively by automated systems,
• claim compensation if you suffer damage because of unlawful processing.

In accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can submit your application in writing to Hacıkaymak Mah. Zuhuri Mehmet Sk. 1.2. Girişler No: 7 İç Kapı No: 10, Selçuklu / Konya, or to info@kullya.com from the email address you previously provided to Kullya and that is registered in our system. The information your application must contain is listed on the KVKK Application Form page.

Your application will be concluded free of charge within 30 days at the latest. If the process requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, if you find the response insufficient, or if no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in any case, within 60 days of the application date.

This notice is updated when our processing activities or the legislation change. The current version is always on this page. Last updated: November 4, 2026.