Privacy Policy
Обновлено: 2026-10-08
Version 2f5bfe937272
Документ опубликован на английском языке. Действующей является английская версия.
Who is responsible
HUBLİNKLY AI YAZILIM VE TEKNOLOJİ LİMİTED ŞİRKETİ, Istanbul, Türkiye, is the data controller for information about visitors to our website and people who hold a Clavix 360° account. Contact: info@clavix360.app. The registered postal address is Vadistanbul Park, 7C Blok, No: 7D/15, Ayazağa Mah., Kemerburgaz Cad., Sarıyer / İstanbul, Türkiye.
For data your company enters into the platform about its own customers, employees or suppliers, your company is the controller and we act as processor. That relationship is governed by the Data Processing Addendum.
What we collect
When you visit the site. Our server’s access log records your IP address, the page requested, the time, the response status and size, your browser and device type, and the referring site. It is kept for 14 days and then removed by log rotation.
If — and only if — you consent to analytics, Google Analytics 4 additionally records the pages you view and an approximate location derived from your IP address, on Google’s infrastructure in the United States. Nothing optional runs before you choose: the tag is not requested from our pages at all until your consent is recorded, so there is no stage at which it is loaded and asked not to measure. You can withdraw at any time from the “Manage preferences” link in the footer of any page. The Cookie Policy names every cookie and storage key individually, with its lifetime.
When you register or request a demo. Name, business email, phone, company name, country, industry, and what you tell us about your needs.
When you use the platform. Login times, IP address, actions taken in the application, and the content you create. Where your plan includes the Clock application, this includes clock-in and clock-out records and, if your company enables it, location at the moment of clocking.
When you pay. Billing name, company details, tax identifiers, and the transaction record. Subscriptions are paid by bank transfer, so we never receive a card number — not because a processor handles it for us, but because no card payment is accepted at all. If that changes, this paragraph and the Sub-processor List change with it.
When you use the Academy. Course progress, assessment results, and the certificate record that supports QR verification.
Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the service you subscribed to | Performance of a contract |
| Billing, invoicing, tax records | Legal obligation |
| Security, fraud prevention, abuse monitoring | Legitimate interest |
| Product improvement and aggregate analytics | Legitimate interest |
| Marketing email about our own products | Consent, withdrawable at any time |
| Responding to your enquiries | Legitimate interest / pre-contractual steps |
We do not sell personal data. We do not use your platform content to train AI models for other customers.
Automated processing and AI
The platform includes AI-assisted features, including offer drafting and reporting insights. The model provider, its processing region, whether it retains content and whether that content is excluded from its training are to be confirmed, and this section will be completed once the provider and its terms are confirmed. These features assist your staff; they do not make decisions with legal effect about any individual.
Where your data is held
The application and the database are hosted in Frankfurt, Germany (eu-central-1), within the European Union. Transactional email (Resend), the AI-assisted features (Anthropic), sign-in with Google and — where you have consented — website analytics (Google Analytics 4) are provided from the United States, and the encrypted off-site copy of our nightly database backup is held by Cloudflare. Every one of these is named, with its purpose and its country, on the Sub-processor List.
Where data is transferred outside Türkiye, the mechanism we rely on under KVKK Article 9 is to be confirmed.
How long we keep it
| Data | Retention |
|---|---|
| Account and platform content | Duration of subscription + 30 days |
| Invoices and tax records | 10 years, per Turkish tax law |
| Website analytics | 14 months |
| Server access logs | 14 days |
| Demo sign-up (name and email) | A demo session is read-only and expires 72 hours after first sign-in. The sign-up record is kept after that and is deleted on request — see Your rights below. |
| Support correspondence | 24 months |
| Certificate records | Retained indefinitely — required for QR verification |
How we protect it
Encryption in transit and at rest, access control and role separation, each customer in an isolated workspace, regular backups, and monitoring. No system is perfectly secure; we tell affected customers and the authority about a breach within the timeframes the law requires.
Your rights
Under KVKK Article 11 you may ask whether we process your data, what we hold, why, who we share it with; ask for correction or deletion; object to processing; and seek compensation for unlawful processing. Write to info@clavix360.app, or to our KEP address (hublinkly@hs01.kep.tr). We respond within 30 days, free of charge in ordinary cases.
If you are in the EU or UK, equivalent rights apply under GDPR, including portability and the right to complain to your supervisory authority.
Children
The service is for business use. We do not knowingly collect data from anyone under 18.
Changes
We post changes here and notify account holders of material changes by email.