What is KVKK?
Law No. 6698 — Turkey's Personal Data Protection Law — is the Turkish equivalent of GDPR. As a Turkish-incorporated SaaS we comply with it for every user, regardless of nationality.
Plain-English summary
• Data controller: HEYPRO YAPIM LİMİTED ŞİRKETİ (operating as Pixel Office; Limited liability company (Limited Şirket); Riva Mah. Maraşal Mustafa Kemal Cad. Bl 05/50 No: 741 İç Kapı No: 2 Beykoz/İstanbul; tax office Beykoz Vergi Dairesi, VKN 4621020776). • What we process: account, usage, payment, technical data; in the mobile guest mode also IP address and device identifiers (device ID, App Attest key ID), to prevent abuse. • Special-category (sensitive) data: not requested — please keep health, religious, biometric, and similar data out of briefs and chats. • Why: to deliver the service and meet legal obligations. • Sub-processors: Clerk, Anthropic, Google, OpenAI, Fireworks AI, Perplexity AI, xAI, TypeSafe AI, Higgsfield, Voyage AI, Whop, Expo, Resend, Apple (Sign in with Apple, App Attest), Vercel, Railway, Neon, Upstash, Cloudflare R2, Sentry, PostHog, Langfuse Cloud; and, only when you use the related feature, ElevenLabs, Replicate, Brave Search, Browser Use, Stability AI, Hunter, E2B, SendGrid, Twilio and Meta Platforms (WhatsApp). • Retention: account data, chats, output, and documents until you delete them or your account (no plan-based limit). Invoices and payment transaction records are kept by Whop (Merchant of Record); records we must keep for accounting may be kept anonymised. Error logs: 30 days. A trial office used in the mobile app without signing up is deleted 90 days after its last use; when a trial office is opened, the device is verified with Apple (App Attest). • Product analytics (PostHog, EU servers): usage events are kept for up to 90 days and then deleted. Deleting your account does not delete these events separately; they are removed automatically when the retention period ends. • In offices that have other members, your email address may remain in the office's audit trail (e.g. who created a record, who performed an action, to whom a message was sent), based on the legitimate interest of the office's other members in keeping those records accurate and accountable (KVKK Art. 5/2-f). These records are deleted together with the office. • Authorised Pixel Office staff may view an office's conversation content, to the extent needed, for support, billing review, security incident review and product research. Every view is logged with who viewed it, when, in which office and for what purpose; the log does not contain the conversation text. These audit records are kept so that access stays accountable; the viewing staff member's email address remains in the record even if their staff account is deleted. • Your rights: access, correction, deletion, objection, data portability — write to contact@pixel-office.com for any of them.
See the Privacy Policy for a full English-language treatment of the same topics.