SUPVISE
|
← Back to SUPVISE
SUPVISE LEGAL & TRUST

Privacy & KVKK Notice

Effective: 5 September 2026 — Version 2026-09-05.1

KVKK notice. This notice describes SUPVISE's own personal-data processing in connection with the website and service. It is intended to provide the information required under Article 10 of Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK), together with additional privacy information.

1. Data controller and scope

Unless another legal operator is identified in the service, the data controller for SUPVISE's own processing is Mustafa Çelen, operating under the SUPVISE brand (“SUPVISE”). Privacy enquiries may be sent to hello@supvise.com. Where a business customer includes personal data in an operational dataset, the customer's and SUPVISE's roles depend on the specific processing context and applicable law.

2. Operational customer data

SUPVISE does not require personal data for Inventory Health analysis. Raw XLSX/CSV files are transmitted to the service and processed in application memory for the requested analysis. Under the current zero-retention architecture, raw uploads, customer operational datasets and generated analysis results are not written to the SUPVISE server-side database. Same-device continuity may store an analysis result in the customer's own browser.

3. Categories of personal data we may process

Depending on how the service is used, SUPVISE may process: (a) business contact and support information voluntarily submitted to us; (b) terms/acceptance evidence such as acceptance identifier, language, version/hash and timestamp; (c) payment and entitlement references received in connection with Paddle checkout, without SUPVISE storing full payment-card credentials; and (d) limited technical/security information such as session/request identifiers, IP-derived request information where present in infrastructure logs, and security or abuse-prevention events. These records are kept separate from the customer operational dataset.

4. Purposes and KVKK legal grounds

Personal data is processed only for specified purposes and where an applicable processing condition exists. Depending on the activity, the principal KVKK Article 5(2) grounds are: processing necessary for the establishment or performance of a contract (Art. 5/2-c) for requested service access, support and purchase/entitlement administration; processing necessary for compliance with a legal obligation (Art. 5/2-ç) for records required by applicable law; processing necessary for the establishment, exercise or protection of a right (Art. 5/2-e) for acceptance evidence, disputes and legal claims; and processing necessary for SUPVISE's legitimate interests without harming fundamental rights and freedoms (Art. 5/2-f) for proportionate service security, abuse prevention and operational integrity. If a processing activity requires explicit consent under applicable law, that consent will be requested separately.

5. Collection method

Personal data may be collected electronically and wholly or partly by automated means when you use the website or service, contact us, accept service terms, complete or attempt a purchase, or when our infrastructure/payment providers generate records necessary to deliver and secure those functions.

6. Recipients and transfer purposes

Personal data may be disclosed, only to the extent necessary for the stated purpose, to hosting/infrastructure providers such as Hostinger; Paddle where checkout, payment, tax, fraud-prevention or Merchant of Record functions are used; communications/support providers where applicable; Google Analytics/Google Tag Manager when analytics consent is granted, for website and product-usage measurement; competent public authorities where legally required; and professional advisers where necessary to establish, exercise or protect legal rights. Paddle may also process certain checkout/payment information in its own role under its applicable notices and terms.

7. International transfers

Where a recipient or processing location is outside Türkiye and the activity constitutes an international transfer under KVKK, SUPVISE will use an applicable transfer route and safeguard permitted by Article 9 of KVKK and the relevant secondary legislation. This notice does not by itself create or replace any transfer instrument that the law requires to be executed separately.

8. Data minimization, retention and deletion

Do not upload unnecessary personal or special-category personal data, passwords, payment-card data, health information or government identifiers. Operational inventory datasets and analysis results are not retained in the SUPVISE server-side database. Separate personal-data/evidence records are retained only for a period justified by the processing purpose, limitation periods and applicable legal obligations, after which they are deleted, destroyed or anonymized as required.

9. Security

SUPVISE applies technical and administrative measures proportionate to the service and risk, including HTTPS, security headers, access controls, upload validation, payment-webhook verification and data minimization. No internet service can guarantee absolute security.

10. Rights under KVKK

Subject to the conditions and exceptions of applicable law, data subjects may exercise the rights set out in Article 11 of KVKK, including learning whether personal data is processed; requesting information about processing; learning the purpose of processing and whether data is used accordingly; knowing third parties to whom data is transferred domestically or abroad; requesting correction of incomplete or inaccurate data; requesting deletion or destruction where the legal conditions are met; requesting notification of correction/deletion actions to relevant recipients; objecting to a result arising against the person through analysis exclusively by automated systems; and claiming compensation where damage is suffered due to unlawful processing.

11. Applications and contact

Questions and requests concerning SUPVISE's own processing may be sent initially to hello@supvise.com. Formal KVKK applications must satisfy the identity-verification, content and delivery requirements applicable under KVKK and the relevant application procedures. Requests concerning personal data for which a business customer is the data controller should generally be directed to that customer.

12. Changes

This notice may be updated when the product, providers, legal operator or applicable rules change. The version and effective date above identify the current text.