KVKK notice

1. Data controller

Ayhan Kemaloğlu (an individual, trading as “ALKE” and “Agenticly”) · Harman Sk. 39/1, 34153 Bakırköy, Istanbul, Türkiye · Tax ID: 5440121415 (Hasan Tahsin Tax Office) · Email: contact@agenticly.live · VERBIS: exempt from registration under Personal Data Protection Board decision 2025/1572 (fewer than 50 employees and an annual balance sheet under 100 million TL; the main activity is not the processing of special categories of data); reviewed every year

2. Personal data processed

• Identity: name / how you want to be addressed; your year of birth if you give it (only to apply the rules for people under 18).
• Contact: email address; if you are under 18, the email address of the parent or guardian you name and when they confirmed.
• Customer transaction / account: Google account ID (sub), language, time zone, country/city, preferences, AI permissions, session records.
• Education (optional): state or private school / university, grade, your school’s name and the curriculum outline found in a document you add (the document is read on your device and not stored).
• Transaction security: Argon2 hash of the App Lock PIN (and of an older password until Google is linked; then deleted), Google re-sign-in confirmations (account ID and sign-in time, not kept beyond the security log), session data, device ID, browser/OS type, IP address (short-term, for rate limits and security), security event logs.
• Location: saved places (encrypted) and your current location - on request or, if your browser already allows it, when Today opens (compared on your device only, never sent to us).
• User content: notes, tasks (with the steps and planned time blocks you accepted in the checklist and, if you add one, who a task is for - a client, a case or a family member), timetable (with your shift rotation, if you add one), recurring lists (names, items and this day’s, week’s or shift’s ticks), the life packs you picked, exams, flashcards and quiz questions (including those AI wrote from a lesson recording or from the notes and documents you add on the lesson screen), the number of cards you rated on each of the last 400 days (a number per day, no card text), your quiz mistakes notebook (the question, the right answer, the answer you gave cut short, how sure you said you were and the mix-up label you chose) and how sure you said you were on each quiz answer, check-ins (with the name you give for the person you interacted with most, kept only while a check-in mentions them; for lessons also check-in/check-out times, minutes present, lessons added afterwards with “I was there” and when, and whether you were at school or went home that day), reminders and your reminder and calm-notification settings (off by default; if you turn them on, leave-time, planned-block, close-the-day, exam-topic and weekly-reset notifications - at most 3 a day, none in quiet hours, task names only if you allow them), uploaded files; homework and exams added from Google Classroom (and the ids, not the content, of the Classroom emails already handled); your school type (state / private, optional) and your own curriculum (including the list of subjects, units and topics sorted on your device from your school’s curriculum document - the document itself is not sent to us); your AI chats (including which AI wrote each answer); optionally, voice recordings you upload to your account.
• Saved links: the web addresses you save to “Read later” (up to 500) with title, site, read mark and the summary you asked for, and a copy of the readable text of a page you opened for a summary (at most 60 KB, deleted after 7 days). A link stays until you delete it or your account.
• Meeting content (optional): the text of meetings you choose to record - which includes what the other participants say (third parties) - with its summary, decisions and to-dos, how many minutes it was planned and, where the voices could be told apart, how many seconds each side spoke and which side was speaking in each short stretch. Also figures about the sound and pace of the room (loudness, background level, the share of the time someone spoke, words per minute and filler words), counted on your device from the microphone signal of everyone it hears - other participants too, and people on a call that come out of your speakers - and saved in the note as numbers only, with no recording and no text. From the text and these figures Agenticly works out on your device, when you open the report, strengths and advice about the meeting and, only where your voice print marked which lines were yours, communication notes about your own part; these are not stored (only coaching text from your own AI is kept in the note, if you add it). These notes are communication insight about your own part; they are not a psychological, medical or HR assessment of you or of anyone. No mood, health or character is inferred about anyone: the other people are one group (“Others”) and nothing is worked out about them one by one. The audio only on your device, and only if you keep it. A presentation or workbook made from a meeting is built on your device when you tap and is not kept by us; it holds what everyone said, so what happens to it after you download it is up to you. If you connected your own AI, its AI Chat can read your notes when you ask it to, meeting notes included. Meeting mode is offered in every app mode, School included: if you are under 18, use it only with the knowledge of a parent or guardian. The other participants are data subjects of this processing; Agenticly never claims their consent and tells you to inform them. [lawyer: whether this is personal use or makes us a controller or processor for the participants’ data; the rules on recording conversations (Turkish Penal Code arts. 132-134; KVKK) and on special-category data that may be spoken in a meeting; whether the sound figures counted from the voices of all participants, and communication notes about a person, are special-category data or profiling, and whether rules on inferring emotions at work or in education could apply; whether users under 18 may use Meeting mode, and what parental consent is needed for recording other people (classmates, teachers); whether communication notes about a person kept in the account are profile data; whether a presentation or workbook that holds what everyone said and leaves the device when you download it needs its own notice; whether the notes-analysis yes given when you connect your own AI covers analysing meetings that contain other people’s words, and whether AI Chat reading meeting notes needs its own notice]
• Voice print (optional, biometric - special-category data): a short list of numbers describing how your voice sounds, made on your device by a built-in method that runs there and needs no download, from about 25 seconds of you reading a text, and kept only on your device. The method is approximate. It is not sent to us or to anyone, and Meeting mode uses it on your device to mark which parts of a meeting sound like you: the other people’s voices are compared with it in memory and forgotten, and the note keeps only which lines were yours, how many seconds each side spoke and, for the charts, which side was speaking in each short stretch. The marks are a hint and can take other people for you and you for others. You can make, test and delete the print on a meeting’s Start screen and in Settings → On-device AI → Your voice; the voice test opens the microphone for a few seconds, only when you tap it, and stores nothing. Basis: your explicit consent (KVKK art. 6(2)), given on a screen with an unticked box and recorded on your device with its time and the version of the text; you can withdraw it at any time by deleting the print (one tap), which also happens when you sign out or delete your account. If you are under 18, make a voice print only with the knowledge of a parent or guardian. [lawyer: whether on-device-only processing makes us a controller of the print; the Board’s requirements for special-category data and the adequate-measures decision; whether a print made by a built-in approximate method, and the comparison of the other participants’ voices with it in memory, count as biometric processing of those people; whether users under 18 can give this consent themselves or need a parent’s or guardian’s]
• Data processed by your own AI (only if you connect one): an email/text you ask to analyse (mail is otherwise read by our own rules on your device; an email goes to AI only when you press “Ask AI”), your questions, the question you ask on “Search the web and answer” (and https links you paste), the title, note, due date and length of the one task you ask to break into steps in the checklist (only when you tap), the live text draft of a recording (only to your own AI, if you connected one and chose it for transcripts, and never the recording itself), the text of a meeting (lines marked You and Others; only to your own AI, if you connected one, and never the audio; live tips and the summary go on their own, “what to say” (with the goal you typed) and coaching notes (your own lines in full, the others’ lines cut short and the counted sound and pace figures) only when you tap), the lesson part of a lesson recording’s note with its course name, and the text of the notes and documents you add on the lesson screen when you press “Make cards and questions” (to make flashcards and quiz questions; the photos and files themselves are never sent), the names of a course’s topics and of a coming exam’s topics (only to help tell what belongs to a lesson), the text of PDFs and of photos of notes you import (read on your device first), the text of a timetable that our rules cannot read (only after you tap “Let my own AI read the text”, after removing names, ID numbers, phone numbers, e-mail addresses and links), Classroom notification emails and your homework list if you turned that on, and the day's facts for the morning brief and reports (which feature sends what: Privacy policy - AI). The text sent is not stored for AI; results (transcripts, analyses) may be stored with your content. Recordings, photos and scanned pages are read only on your device and are never sent to us or to any AI. Without your own AI, nothing is sent to any AI.
• Your own AI (optional): if you connect your own Claude or ChatGPT, which one, when you allowed it and on which version of the permission screen, the paired computer’s name, the pairing time and the CLI versions it reported, and a hash of its token (a one-time pairing code or link is kept in memory for 10 minutes); the AI jobs (the same content as above, only ever as text - for voice notes the live text draft, never the recording) are passed to the bridge on your computer and are not kept. In AI Chat, which of your own AIs wrote each answer is stored with the chat.
• Subscription (only where plans are sold): your plan, the subscription status and dates, test or live mode, and Lemon Squeezy’s ids for the subscription, customer, first order and product; fingerprints of the payment notifications already handled. No card or bank details: Lemon Squeezy, the merchant of record, collects and keeps payment and billing data itself.
• Usage data: how often an app feature was used per day (event names, not content) and the task name, time and token count of your recent AI requests.
• AI feedback and answer preferences: your 👍/👎 on AI answers with optional reasons and a short note (a reference to the answer, never its text), and the answer preferences you add or accept; used only to show your AI quality summary, to suggest preferences and to shape your own AI answers - never to train an AI model (encrypted, deletable in Settings → AI preferences).
• Daily briefs: the daily brief presentation is made and kept only on your device (browser storage, 30 days); it is not sent to or stored on our server.
• Work style: weekly observed tendencies computed from your activity (encrypted, can be reset). The answers and scores of the work-style test (personality test) are kept only on your device; they are not sent to or stored on our server. For an AI request only derived preferences (e.g. short vs detailed answers) are processed, transiently, and not stored.
• Shared with people you invite (optional): for a study / work buddy, whether you ticked “done today”, how many days you ticked this week, your weekly goal and a daily cheer; for a shared list, the items members type (and a task only when you tap “Share to” for it) with the display names of who added or ticked them; the display name the other people see. Invite codes are kept as one-way hashes for at most 24 hours. The weekly summary for a parent or teacher is made on your device and not kept by us. [lawyer: whether a user under 18 may link with an adult or join a list with adults, and what parental consent is needed]

The contents and access tokens of Gmail, Calendar, Classroom, Drive and Microsoft accounts are not processed by us; they are processed only on your device, under your control. What you write in “Empty your head” (worries, ideas, notes) is kept only on your device and is not processed by us. Check-ins (how your day went, energy, focus, stress and a note) can say something about your health, so they are kept only with your explicit consent: asked once, on a screen of its own, before your first check-in, and withdrawable in Settings → Intelligence (then nothing new is kept until you agree again). We recommend not entering other special categories of data there. The words you write in them go to an AI only in the cases the privacy notice lists (AI Chat when you ask about how you felt; the morning brief when your own AI is connected and AI for personal features is on) and never when you switched Check-ins off under Settings → Intelligence → “What Intelligence may use”. [Special-category assessment to be made with a lawyer]

3. Purposes

• Creating your account, authentication, session management;
• Applying the rules for people under 18: a parent’s or guardian’s confirmation by email before sharing with other people or connecting an own AI (Personal Data Protection Board decisions 2020/622 and 2023/134);
• Providing the service: the daily page, school, reminders, the morning brief, sync across devices;
• Writing notes, a summary, decisions and to-dos from a meeting you choose to record, optional tips and ideas of what to say while it runs and, afterwards, charts, strengths, advice, notes on how you came across, a presentation and a workbook, on your device or - if you connect it - with your own AI (what to say and coaching notes only when you tap);
• Weather, routes and location-based features;
• If you turn it on, adding the plan blocks you accept to a separate “Agenticly” calendar in your own Google account, from your device (details);
• Running the AI features you allowed (when you ask, or automatically for features you switched on - for example writing a voice note’s transcript with your own AI after you stop recording, or making flashcards and quiz questions from a lesson recording once your own AI has structured it);
• Selling and managing the Formal and Professional plans and giving your account the plan you paid for;
• Improving the app with feature-use counters;
• Information security, preventing abuse and attacks (rate limits, App Lock);
• Showing the people you invited (study buddy, shared list) only what you chose to share with them;
• Answering requests and complaints; meeting legal obligations.

4. Legal bases and collection method

Data is collected through sign-up and sign-in forms, Google/Microsoft sign-in (OpenID Connect), what you enter in the app, and automatically from your device (browser, cookie, local storage). Legal bases:

• KVKK Art. 5(2)(c): establishing and performing the contract (account, providing the service);
• Art. 5(2)(ç): compliance with legal obligations (e.g. Law No. 5651, official requests);
• Art. 5(2)(e): establishing, exercising or protecting a right;
• Art. 5(2)(f): legitimate interest (security, rate limits, fraud prevention);
• Art. 5(1) - explicit consent: processing personal content with your own AI (per feature; for “Search the web and answer”, the separate “Web search” yes; for your own AI, the yes you give in Settings → Your own AI on a screen that lists what is sent and the permissions it also covers, and, for a voice note’s transcript, your choice of “Your connected AI” in Settings → Notes & Voice), the daily check-ins (special-category data under Art. 6: the separate yes before your first check-in) and, where needed, transfers abroad.

5. Transfers (domestic and abroad)

Limited to the purposes above, your data may be transferred to: our hosting and database provider (Render, Frankfurt, EU), our network and security provider (Cloudflare), Google (sign-in, maps/weather services), Microsoft (optional sign-in), Google, Microsoft, Mozilla and Apple as the push services that deliver your encrypted reminder and calm notifications to Chrome and Android, Edge and Windows, Firefox and Safari (they see the encrypted message, your push address and when it was sent), our email delivery provider (Resend), Lemon Squeezy as the merchant of record for paid plans (your account id and confirmed email, for the checkout and the subscription), weather, map and route providers that receive coordinates or search text without your identity (Open-Meteo, MET Norway, TomTom, OpenStreetMap-based services), market, news and pharmacy-on-duty providers that receive the ticker text you type, your watchlist symbols, the country edition and city you chose, or a province and district without your identity (Yahoo Finance, Twelve Data, CoinGecko, Google News, CollectAPI, NosyAPI) and authorised public bodies.

If you connect your own AI (Settings → Your own AI), we pass each AI job - as text only, never as a recording or an image - only to the Agenticly bridge on your own computer; from there it goes, on your instruction, to Anthropic (Claude) or OpenAI (ChatGPT, servers in the US), which process it under your own account with them. For “Search the web and answer”, your own AI’s program on your computer also sends your search to the search service it uses. If you choose the local model (Qwen through Ollama), the AI work runs on your own computer and no text is transferred to anyone; your computer only downloads the model files once from ollama.com (Ollama, US), which sees your IP address and the model name. Agenticly has no other AI provider: without your own AI, nothing is sent to any AI. You can disconnect at any time.

These providers' servers may be abroad (US, EU and other countries). Transfers abroad are made under Article 9 of KVKK on the basis of [standard contracts notified to the Board / appropriate safeguards / explicit consent - to be set with a lawyer]. If you turn on browser transcripts (off by default, asked once on your first recording; in Meeting mode this covers every voice the microphone hears, other participants’ too), in Chrome and Edge the browser itself sends the recording to its maker's speech service (Google or Microsoft) to turn it into text; Agenticly does not send the audio and only receives the text (details). The microphone button and the Listen button in AI Chat work the same way when you press them: the microphone audio goes to that speech service, and the text of an answer only when your browser reads it with an online voice (details). If your own AI is connected and you chose “Your connected AI” for transcripts, that text is also passed to it, via the bridge, to be written out as a clean transcript. If you turn on plan blocks in Google Calendar, your browser sends the blocks you accept (the task title or “Planned block”, the start and end, a link to Agenticly) straight to Google, into a separate “Agenticly” calendar in your own Google account; Agenticly’s server does not take part (details).

If you link with a study buddy or join a shared list, the data in section 2 under “Shared with people you invite” is made available to the other Agenticly users you chose, by your own action (an invite code you passed on or entered). It stays on our servers and goes nowhere else; unlinking or leaving ends it. We do not transfer the weekly summary for a parent or teacher: you copy it or send it from your own mail app.

6. Retention

Data is kept for as long as the purpose requires and for the limitation periods in the relevant legislation, then deleted, destroyed or anonymised. Details: Privacy policy - Retention.

7. Your rights under Article 11 of KVKK

By applying to the data controller, you can:

1. learn whether your personal data is processed,
2. request information about it if so,
3. learn the purpose of processing and whether it is used accordingly,
4. know the third parties in Türkiye or abroad to whom it is transferred,
5. request correction if it is incomplete or inaccurate,
6. request deletion or destruction under the conditions of Article 7,
7. request that the actions in (e) and (f) be notified to the third parties it was transferred to,
8. object to a result against you arising exclusively from automated analysis,
9. claim compensation for damage caused by unlawful processing.

8. How to apply

Send your request in Turkish, with information that identifies you, from the email address registered to your account to contact@agenticly.live, or as a signed letter to Harman Sk. 39/1, 34153 Bakırköy, Istanbul, Türkiye (Communiqué on the Procedures and Principles of Application to the Data Controller). We answer free of charge within 30 days at the latest; if the action has an additional cost, the fee in the Board's tariff may be charged. If you are not satisfied, you can complain to the Personal Data Protection Board.

You can see, export and delete most of your data directly in the app: Settings → Account & Security.