Privacy · KVKK

Privacy and Personal Data Protection Notice

Last updated: 2 November 2026 · Data controller: Lunify Yazılım ve Ticaret A.Ş. · App: Lunify Aura (catalogue and quotation app)

Under Turkey’s Personal Data Protection Law No. 6698 (“KVKK”), Lunify Yazılım ve Ticaret A.Ş. (“Lunify”) processes your personal data in the Lunify Aura app as described below. This notice is an app-specific annex to Lunify’s corporate KVKK notice; where they differ, the app-specific statements on this page prevail.

1. Identity of the data controller

Lunify Yazılım ve Ticaret A.Ş. · Denizli / Türkiye · Contact: luna@lunify.world

2. Personal data processed in this app

Data category	Examples	Purpose	Legal basis (KVKK art. 5)
Identity and contact	Name, e-mail, company	Account, sign-in, support	Performance of a contract
Catalogue data	Product, price, image and brand details	Catalogue management	Performance of a contract
Quotation and customer records	Details of the people/companies you quote to, quotation PDF contents	Producing quotations (as data processor)	Performance of a contract
Session and logs	IP, session and activity logs	Security, error tracking	Legal obligation; legitimate interest

3. Third-party data you upload

For the customer, supplier and employee data you enter into Lunify Aura, you are the data controller; Lunify processes this data only to provide the service and on your instructions, as a data processor. This data is not shared with other customers, not sold and not used to train AI models.

4. Parties data is transferred to

Hosting: IONOS data centre in the United Kingdom (a transfer abroad; see the KVKK art. 9 statement below).
Artificial intelligence: AURA’s current active configuration sends AI prompts to OpenRouter’s standard global API endpoint; the underlying model/provider and the processing location may vary per request. OpenRouter’s EU/US regional endpoints are not used. Requests are sent only through OpenRouter, routed exclusively to endpoints with Zero Data Retention (ZDR) and data collection disabled. Google user data is never stored by AI providers, never used to train or improve AI models, and is used only to provide the feature you requested (Google API Services User Data Policy, Limited Use). A direct DeepSeek API configuration is not active at present; if it were enabled, API processing would go to an endpoint in China. Before entering personal or confidential data into the AI, the legal basis for this transfer and the required safeguards must be verified separately.
E-mail and Google integrations: Google/Gmail API, SMTP and Brevo, only when you use the relevant feature. For WhatsApp, the QR session runs through your own WhatsApp account; WhatsApp/Meta’s platform terms and their own privacy/personal-data practices apply. Meta is not listed in this table as a sub-processor of AURA.
Competent public authorities: where there is a legal obligation.

Sub-processors and data location (current list):

Sub-processor	Service	Data location
IONOS	Server hosting (application and database)	United Kingdom
Google LLC / Google Ireland	Only the Gmail, Calendar, Tasks, Drive and Contacts access you connect, and Sign in with Google	EU / US (appropriate safeguards)
OpenRouter and the selected underlying models/providers	AI prompt content	Standard global endpoint; underlying provider and location may vary per request; not an EU/US regional endpoint
SMTP/e-mail infrastructure (Brevo and the Lunify mail server)	Notification and verification e-mails	EU

The primary server location for app data is the United Kingdom (IONOS data centre); however, integrations you connect and AI features may cause data to be processed outside this location. Business customers can write to luna@lunify.world for a data processing agreement (DPA).

Yurt dışına aktarım (KVKK m.9): Uygulama verileriniz, IONOS’un Birleşik Krallık’taki veri merkezinde bulunan sunucularda saklanır. Bu durum, KVKK’nın 9. maddesi kapsamında kişisel verilerin yurt dışına aktarılması sayılır. Bu aktarımı KVKK m.9’da öngörülen uygun güvencelere (örneğin Kişisel Verileri Koruma Kurulu’nun ilan ettiği standart sözleşmeye) veya bu güvencelerin bulunmadığı hâllerde açık rızanıza dayandırırız. Açık rızanızı dilediğiniz zaman geri alabilirsiniz; bu durumda hizmeti sunmaya devam edemeyebiliriz. Sorularınız için: luna@lunify.world.

Transfer abroad (KVKK art. 9): Your app data is stored on servers in IONOS’s data centre in the United Kingdom. Under Article 9 of Turkey’s Personal Data Protection Law (KVKK), this counts as a transfer of personal data abroad. We base this transfer on the appropriate safeguards provided for in Article 9 (for example, the standard contract published by the Turkish Personal Data Protection Authority) or, where such safeguards are not available, on your explicit consent. You can withdraw your consent at any time; in that case we may not be able to keep providing the service. Questions: luna@lunify.world.

Because OpenRouter’s standard global endpoint is used, prompts and content passed to underlying providers may be processed outside Turkey. This statement alone does not mean that a transfer mechanism under KVKK art. 9 is in place. For AI transfers containing personal data, the applicable legal mechanism and the required safeguards must be completed for each specific transfer; until this is verified, do not add personal/confidential data to AI prompts. Your rights and DPA requests: luna@lunify.world.

5. Use of Google user data (Limited Use)

LUNIFY AURA's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. When you connect your Google account, AURA accesses it only for the features you request:

Gmail (read-only): reads messages in your inbox to show them in the app and match them with your customer conversations; it does not modify or delete your messages.
Calendar: writes the appointments and reminders you create in AURA to your primary calendar and updates them when you change them.
Tasks: syncs your to-dos in AURA with your Google Tasks list.
Contacts: used to match numbers coming from WhatsApp with names, to import people from your address book into your AURA contact list and, with your approval, to add a contact from AURA to your Google contacts.
Drive: saves your quotation PDFs and documents to Drive when you ask, and reads the files you reference.

This data is not used for advertising, is not sold to third parties, is not used to train AI models and is not read by humans (except with your explicit consent, for security purposes or where required by law). You can remove the connection at any time from the Google screen in the app or from the “Third-party apps with account access” section of your Google Account; when you remove it, the stored access and refresh tokens are deleted.

6. Retention and deletion periods

Data is kept while your account is active and is deleted or anonymised within 90 days at the latest after the account is closed.
System security and access logs are kept for 12 months at most.
Financial records are kept for 10 years as required by law.
Daily backups are overwritten on a rolling basis; your deletion request takes effect in the backups once the backup cycle has completed.
When you disconnect a Google/WhatsApp account, the related access tokens are deleted from the app.
Sign-in attempt records are deleted after 30 days, closed-session records after 30 days and Luna (AI) chat history after 180 days.
The audit log (who changed what and when) is kept for 10 years and cannot be deleted, as it serves as financial and legal evidence.
This schedule runs automatically: a nightly job deletes expired records. If you request account deletion from the Security screen, your record is deleted after 30 days (you can cancel within this period).
You can download your data as JSON at any time from Security → Your data (data portability).

7. Your rights (KVKK art. 11) and how to apply

You have the right to learn whether your personal data is processed, to request information, to know the parties it is transferred to, to request correction, deletion or destruction, and to request restriction of processing and compensation for damage.

How to apply: write to luna@lunify.world with the subject “KVKK Request”. Your application is answered free of charge within 30 days at the latest. You can request an export or deletion of your data at the same address with the subject “Data Deletion Request”.

8. Security measures

An isolated data space for each account; queries are limited to the identity of the session owner.
Server-side validated sessions; session cookies are flagged HttpOnly, Secure and SameSite.
Uploaded files are served from outside the web root / a closed directory, only after an ownership check.
All traffic is encrypted with HTTPS/TLS (HTTP → HTTPS redirect, HSTS); passwords are stored irreversibly.
Encryption: TLS 1.2/1.3 in transit; passwords are stored irreversibly with bcrypt; Google access tokens and provider keys are encrypted in the database with the application key; backups are encrypted with AES-256.
Backups: automatic nightly backup (database + uploaded files), integrity test after each backup, 14-day retention, alert to the administrator on failure. Targets: RPO 24 hours, RTO 4 hours (tested restore time ~15 minutes).
Two-step verification (2FA/TOTP) and backup codes; active session list, remote sign-out and an e-mail alert on sign-in from a new device.
Role-based authorisation (User / Administrator / Company administrator), second-person approval for quotations above the amount limit; authorisation checks are enforced server-side.
Immutable audit log: changes to quotations, stock, customers, users and settings are recorded with who/when/from which value to which value; records are append-only (a separate, append-only database user) and their integrity can be verified with a hash chain.
File uploads: the type is verified from the file content (the declared type is not trusted), content outside the allow list and executable/SVG content is rejected, size is limited to 25 MB and every file passes a malware scan.
Daily automatic backups, access logs, firewall and brute-force protection (fail2ban; lock-out after 8 failed attempts in 15 minutes on the sign-in form).

An independent penetration test is planned; this section will be updated once it is completed.

8.1. Incident (breach) management and notification

When we become aware of a personal data breach, we contain the incident as soon as possible, determine its scope and record it.
Under KVKK, the Personal Data Protection Board is notified as soon as possible and within 72 hours at the latest; in cases within the scope of the GDPR, the relevant supervisory authority is notified within the same period.
Affected data subjects and business customers are notified within the shortest reasonable time, with an explanation of the type of data affected, the possible consequences and the measures taken.
Breach notification and security contact: luna@lunify.world and /.well-known/security.txt.

9. Reporting a security vulnerability

If you have found a security vulnerability, please use the contact channel at /.well-known/security.txt.

10. Cookies

The app only uses session and preference cookies; no advertising/tracking cookies are used. Details: Cookie Policy.

11. Changes

This notice may be updated; the current version is always published on this page.

This English version is provided for convenience; in case of any discrepancy, the Turkish version prevails.