KVKK Privacy Notice

1. Data controller

Under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Nodesty LLC (8 The Green, Suite 21610, Dover, DE 19901, United States) as data controller, as described in this notice.

This notice covers data processed through nodesty.com, the customer panel, the API and our support channels. For data that customers host on servers they rent from us, Nodesty is the data processor. The customer is the controller of that data and the relationship is governed by the Data Processing Agreement.

2. Personal data we process

• Identity: first and last name and, where needed, identity document details.
• Contact: email address, phone number and address.
• Customer transactions: orders, invoices, service records, support requests and correspondence.
• Financial: billing details, payment status and bank transfer details. Card details are processed by Stripe and are not stored on our servers.
• Security: IP address, login and session records, browser and device information, security and system logs.
• Account verification: for accounts asked for extra verification under TrustAssessment, an image of an identity document and a liveness (selfie) check collected through Didit or Stripe Identity, if you start the verification.
• Student verification: school, student email address and student document submitted with an Education Pack application.
• Site usage: session recordings kept on our own servers for troubleshooting and support (pages visited, clicks and form interactions).
• Marketing and measurement: data processed through Google Analytics and the Meta Conversions API, only if you choose "Accept all".
• Linked accounts: if you link a Discord or Google account, its account ID, username and email address.

3. Purposes

• Creating and managing your account.
• Taking orders, provisioning services, billing and collecting payments.
• Technical support and customer communication.
• Preventing fraud and abuse, and verifying accounts.
• Information security, DDoS protection and system logging.
• Measuring service quality, and finding and fixing errors.
• Assessing Education Pack eligibility.
• Meeting tax, accounting and other legal obligations, and responding to requests from authorities.
• Measuring ad campaigns, if you have given explicit consent.

4. Legal grounds

Your personal data is processed on the following legal grounds listed in Articles 5 and 6 of the KVKK:

• Establishing or performing a contract (Article 5/2-c): account, order, service, billing and support processes.
• Complying with a legal obligation (Article 5/2-ç): invoice and accounting records, requests from authorities.
• Establishing, exercising or defending a right (Article 5/2-e): dispute, chargeback and abuse records.
• Legitimate interest (Article 5/2-f): information security, fraud prevention, service improvement and session recordings.
• Explicit consent (Articles 5/1 and 6): analytics and advertising cookies, the transfer to Meta, and identity verification involving biometric data.

5. How we collect data

Your personal data is collected electronically, by automated or partly automated means, through our website, the customer panel, the API, our support channels (including Discord), email, cookies and server logs.

6. Transfers

Your personal data is transferred only for the purposes above to the suppliers that provide us with payment, infrastructure, DDoS protection, email, identity verification, AI-assisted analysis, analytics and advertising services. The current list is on the Sub-processors page. Where required by law, it may also be shared with competent public authorities and courts.

Nodesty LLC is based in the United States. Our servers are located in Germany, the Netherlands and the United States, so your data is transferred abroad. Transfers abroad rely on standard contracts and other appropriate safeguards provided for in Article 9 of the KVKK.

7. Retention

• Account and customer data: while your account is open and, after it is closed, for at least 1 and at most 2 years as set out in the Terms of Service.
• Invoice and accounting records: for the period required by applicable law.
• Education Pack documents: stored encrypted and deleted within 30 days after the review is complete.
• Ad click ID (_fbc cookie): 90 days.
• Data whose retention period has ended is deleted, destroyed or anonymized.

8. Your rights

Under Article 11 of the KVKK, you can apply to the data controller to:

• Find out whether your personal data is processed.
• Request information about it if it is processed.
• Find out the purpose of processing and whether data is used accordingly.
• Know the third parties in Turkey or abroad to which it is transferred.
• Request correction if it is incomplete or inaccurate.
• Request deletion or destruction under the conditions in Article 7 of the KVKK.
• Request that corrections, deletions and destructions be notified to the third parties the data was transferred to.
• Object to an outcome against you that results from analysis exclusively by automated systems.
• Claim compensation if you suffer damage because of unlawful processing.

9. How to apply

You can send your request to privacy@nodesty.com from the email address on your account or with information that lets us verify your identity. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, your request is concluded free of charge within 30 days at the latest.

If your request is rejected, you find the answer insufficient or no answer is given in time, you can file a complaint with the Turkish Personal Data Protection Board.