KVKK Information Notice
Last updated: 4 November 2026
This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. For EU/EEA users it also serves as our GDPR Article 13 information. It sits beside our Privacy Policy, which explains the same processing in more detail.
1. Data controller
The data controller is Valerois, the provider of valerois.com, nova.valerois.com and Valerois Studio Nova. Identity, address and contact details are on the Legal notice page. Contact for data requests: [email protected].
2. Personal data, purposes and legal grounds
| Data | Purpose | Legal ground (KVKK Art. 5) |
|---|---|---|
| E-mail address, password hash (or the e-mail given by Google), verification codes | Opening and securing your account, signing you in | Necessary for the performance of a contract (5/2-c) |
| Plan and subscription status, order reference | Providing the plan you chose, handling payment results and cancellations | Performance of a contract (5/2-c); legal obligations (5/2-ç) |
| Messages and files you send to Nova | Producing the answer you asked for; passed to the AI model provider that generates it | Performance of a contract (5/2-c) |
| Cloud copy of chats and preferences (optional) | Showing your chats on your other devices | Performance of a contract (5/2-c); you can turn it off or delete it |
| Usage counters, IP address, security and error logs | Applying plan limits, preventing abuse, fixing faults, security | Legitimate interest (5/2-f); legal obligations (5/2-ç) |
| Messages you write to support | Answering you and keeping a record of the request | Legitimate interest (5/2-f); establishing and defending rights (5/2-e) |
We do not ask for special categories of personal data (health, religion, biometrics and so on). Please do not put them, or passwords and secrets, into a chat. We do not use Nova’s answers to make decisions about you with legal or similarly significant effect.
3. Method of collection
Data is collected automatically through the website, the web app and the desktop app, from you directly (forms, e-mail) and, if you choose “Continue with Google”, from Google (your e-mail address only).
4. Who receives your data, and transfers abroad
- Dodo Payments (Merchant of Record): payments, taxes, receipts, as an independent controller.
- AI model providers: the content of the messages needed to produce an answer.
- Hosting and e-mail providers: running our servers and sending verification e-mails.
- Google: only if you use Google sign-in.
- Public authorities: where the law requires it.
Some of these providers are outside Türkiye. Transfers abroad rely on Article 9 of the KVKK (adequacy decision, appropriate safeguards such as standard contract clauses, or, where no other mechanism applies, your explicit consent for that transfer) and, for the EEA, GDPR Chapter V. We do not sell your data.
5. Retention
We keep account data and the cloud copy while your account exists, usage counters as long as needed to run the plans, and security logs for a limited time. After you ask us to delete your account we delete your data, except what the law requires us to keep.
6. Your rights (KVKK Article 11)
You can ask us to: learn whether your data is processed; ask for information about it; learn its purpose and whether it is used accordingly; know the third parties it is shared with in Türkiye or abroad; have incomplete or wrong data corrected; have it erased or destroyed; have those actions notified to the people we shared the data with; object to a result against you produced by exclusively automated analysis; and claim compensation for loss caused by unlawful processing.
Write to [email protected] from the e-mail address of your account, saying which right you use. We answer free of charge within 30 days; if the request needs extra cost, the Board’s tariff may apply. If you are not satisfied you may complain to the Personal Data Protection Board (kvkk.gov.tr) within 30 days of our answer, and in any case within 60 days of your request. EU/EEA users may complain to their national authority.
7. AI transparency
Nova is an artificial intelligence system. You are talking to software, not a person. Its answers can be wrong or out of date: check what matters.