KVKK Disclosure Notice

About this document

This Disclosure Notice is required by the Turkish Personal Data Protection Law (Law No. 6698, "KVKK") for Turkish residents. If you are not a Turkish resident, our Privacy Policy (hifly.app/privacy) is the primary document for you; it covers your rights under the GDPR (EU/UK) and equivalent local laws. KVKK rights are largely equivalent to GDPR rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

1. Identity of the Data Controller

Under KVKK, the data controller for personal data processed via Hifly (hifly.app) is:

Bulut Studio (operating under the Hifly brand) hifly.app Contact: support@hifly.app

This Notice is prepared in line with KVKK Article 10 and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, to inform the User about Hifly's processing of personal data as a data controller.

2. Purposes of Processing

Hifly processes personal data for the following purposes:

2.1. Delivering the Hifly service, creating and managing user accounts.

2.2. Concluding and performing the service agreement (generation, revision, extension flows).

2.3. Plan and subscription management, charging, and invoicing.

2.4. Handling user requests, complaints, and feedback.

2.5. Measuring, improving service quality, and developing new features (using anonymized data).

2.6. Ensuring information security, preventing fraud and abuse.

2.7. Fulfilling legal obligations (tax, recordkeeping, providing information to authorities upon request).

2.8. Sending electronic communications for informational or promotional purposes when the User gives explicit consent.

3. Categories of Personal Data Processed

Important: Card numbers, expiration dates, and CVC codes are never stored on Bulut Studio servers; that data is processed directly by our PCI-DSS-compliant payment service provider.

4. Methods and Legal Bases of Collection

4.1. Personal data is collected by automated or partially automated means in electronic form when the User creates an account on hifly.app, uses the service, makes payments, and contacts Bulut Studio.

4.2. Legal bases under KVKK:

5. To Whom and For What Purpose Data May Be Transferred

5.1. The User's personal data is transferred to the following third parties to the extent technically required to provide the Hifly service. These third parties use the data only as data processors acting on behalf of Bulut Studio; they have no authority to act as data controllers on their own account.

5.2. Cross-border data transfer: A substantial portion of the processors listed above process data outside Turkey. Under KVKK Article 9, this is considered a "cross-border transfer" and is performed under the User's explicit consent given at registration. Providing the service is not technically possible without this consent.

5.3. Authorities: Personal data may be transferred to competent authorities and institutions upon legal investigation or court order.

5.4. No marketing transfers: The User's personal data is never sold or transferred to third parties for advertising, marketing, or sales purposes.

6. Data Subject Rights under KVKK Article 11

Under KVKK Article 11, the User has the right to apply to Hifly to:

a) Learn whether personal data is processed,

b) Request information if personal data has been processed,

c) Learn the purpose of processing and whether the data is used in accordance with that purpose,

ç) Know the third parties to whom personal data is transferred domestically or abroad,

d) Request correction of personal data that is incomplete or processed inaccurately,

e) Request deletion or destruction of personal data within the conditions of KVKK Article 7,

f) Request that operations under (d) and (e) be notified to third parties to whom the data has been transferred,

g) Object to results arising against the person from analysis of processed data exclusively through automated systems,

ğ) Request indemnification for losses arising from unlawful processing of personal data.

7. How to Submit a Request

7.1. The User may submit a KVKK Article 11 request in line with the Communiqué on the Procedures and Principles for Applications to the Data Controller by one of the following methods:

• By email: to support@hifly.app, with information allowing identity verification.

7.2. The request should include:

• Full name
• Email address registered to your account
• The right requested and a detailed description
• An electronic address for service of notice

7.3. Hifly resolves requests free of charge within 30 days at the latest, depending on the nature of the request. Acceptance, partial acceptance, or rejection is communicated to the User in writing or electronically with reasons.

7.4. If the User's request is rejected, the response is found insufficient, or no response is received within the required period, the User may file a complaint with the Personal Data Protection Board within 30 days from learning the response and in any case within 60 days from the application date:

• Personal Data Protection Authority
• https://kvkk.gov.tr

8. Data Security

Hifly takes appropriate technical and administrative measures to prevent unlawful processing or access to personal data and to ensure data preservation. For detailed security measures, see Privacy Policy Section 11 (hifly.app/privacy).

9. Updates to this Notice

This Notice may be revised periodically to reflect changes in law or in the service. Material changes are communicated to the User's registered email address at least 30 days in advance. The current version is always available at hifly.app/kvkk.

Contact

• Email: support@hifly.app
• Operator: Bulut Studio (Hifly), hifly.app · Lemon Squeezy, Inc. (Merchant of Record)
• Brand: Bulut Studio