KVKK disclosure and privacy text

1. Scope and data controller

This notice covers personal-data processing on lecturesift.com and LectureSift services. The controller’s current identity and contact details are published in the Distance Sales Agreement and Contact page; data-protection requests can be submitted through the Contact page.

Information and explicit consent are different from each other. Marketing or non-obligatory tracking activities that are not necessary for the establishment of the account and contract are not activated without separate and optional consent.

2. Categories of data processed

Card numbers, CVVs, and card passwords are not stored on LectureSift servers; these details are processed on the authorized payment provider’s secure screen during card payment.

3. Purposes and legal reasons

In transactions based on legitimate interest, balancing is made with user rights and freedoms. If the purpose changes, the new purpose is evaluated separately and re-clarification is made if necessary.

4. Collection method

Data is obtained electronically: directly from the user through registration, sign-in, account settings, file upload, payment, and support forms; automatically from application, hosting, and security systems during use; and, during payment, as limited payment-status information from a bank or authorized payment provider. Support or financial records obtained by non-automated means fall within applicable data-protection law when they form part of a filing system.

5. Buyer groups

Data may be transferred to the following recipient groups, limited to the purpose and to the extent necessary:

• Hosting and database providers: operation of the application and permanent account records.
• Frontend and deployment providers: serving web pages and network security.
• AI/processing providers: Producing transcripts and study outputs requested by the user.
• Email provider: authentication, password reset and delivery of service messages.
• Payment institution and banks: collection, return, fraud control and reconciliation.
• Competent public institutions and judicial authorities: Fulfilling proper, binding legal requests.
• Vocational counselors: only under obligation of confidentiality in auditing, legal, accounting or dispute processes.

Current core service providers are Render (backend, worker, database, and queue), Netlify (web delivery), Cloudflare R2 (private file storage), OpenAI (AI processing), Resend (transactional email), the authorized payment provider shown at checkout and relevant banks for card collections and refunds, and Google measurement or advertising services enabled with the user’s consent.

6. Transfer abroad

The servers of some infrastructure providers may be located outside Türkiye. International transfer; The decision on compliance with Article 9 of the KVKK and the secondary regulations in force must be based on appropriate safeguards, a standard contract or another transfer mechanism permitted by law. The relevant feature should not be made available to general use until the necessary transfer inventory and assurances are completed. For European Economic Area users, GDPR transfer rules are also taken into account to the extent applicable.

7. Storage and deletion

Exact periods are verified in the data retention and destruction inventory. Records that are legally required to be kept may be kept by restricting access only for this purpose, even if a deletion request is made.

8. Security measures

• Transport security with HTTPS and limitation of access with authentication.
• Storing passwords in one-way, salted and costly hashes instead of cleartext.
• Verification and password renewal records are temporary and disposable.
• Private keys are not written to the code repository or application logs.
• Closing account printouts from unauthorized access and checking usage rights on the server.
• Regular review of minimum entitlement, incident logging, backup and provider risks.

No internet system can guarantee absolute security. If a personal data breach is detected, applicable notification and response obligations apply.

9. Automatic processing and artificial intelligence

LectureSift automatically produces transcripts, summaries, quizzes and flashcards from uploaded course content. This process is not intended to make an automatic decision that alone determines the user's legal status or a similarly important right. Output may contain errors and should be verified with the original source for important decisions. The use of user content for model development/training purposes can only be considered if the provider settings, contracts and legal basis expressly allow this; The default product purpose is to produce the requested output.

10. Data subject rights

Within the scope of KVKK article 11; You have the right to learn whether the data is processed, to request information if it is processed, to learn the purpose of processing and whether it is used in accordance with the purpose, to know the domestic/international recipients, to request correction of incomplete or inaccurate data, to request deletion/destruction when the conditions are met, to request correction or deletion to be notified to the recipients, to object to the result exclusively against automatic analysis and to request compensation for damages due to unlawful processing. To the extent applicable, the rights of access, rectification, deletion, restriction, portability, objection and complaint to the supervisory authority under the GDPR are also considered.

11. Application method

your application from the contact form You can submit it with the subject “Privacy/KVKK request”. Your demand; It must include name-surname, account e-mail, desired transaction and response channel. Proportionate additional information may be requested to verify identity; No password, full card number or verification code is required. Applications are finalized free of charge in accordance with the period and procedure in the legislation; Additionally, if costs arise, only the authorized tariff will apply.

12. Children and changes

LectureSift is not intended for children under 13 years of age. If the age of consent to digital services is higher in the user's country, the relevant age and parent/guardian requirement applies. Significant changes to this text will be notified through an appropriate channel before they come into force; The update date and version number are changed.

13. Official sources

• KVKK - Obligation to inform
• Clarification Communiqué
• KVKK - Separation of information and explicit consent
• European Commission — GDPR obligations

This page provides general notice of LectureSift’s current data-processing activities; it is updated when data flows or service providers change.