Data protection notice (KVKK)

Data protection notice (KVKK)

Under Article 10 of Turkey's Law No. 6698 on the Protection of Personal Data ("KVKK"), you are informed about how your personal data is processed within the Candemkey app and keyboard (provided by Candemsoft). This notice is provided to comply with Turkish law and applies regardless of which language you're reading it in.

1. Data controller

Candemsoft, [address], [email address].

2. Categories of personal data processed

• Identity and contact: the unique identifier from your sign-in provider (Apple/Google), your email address, display name if any, language preference.
• Account/transaction security: a hash (not the token itself) of your session refresh token, device label, session duration.
• Personalization and memory: your keyboard/AI settings; short notes you add to Memory yourself, or (if enabled) that the AI derives.
• Usage/transaction data: the type, count, duration, and outcome (success/failure) of AI actions — never the content of those actions.
• Declaration data: your "I am over 18" declaration (not verified).

Note: text, words, keystrokes you type, and your personal dictionary stay on your device and are not processed by us (exception: text you send by tapping the AI button, see section 3).

3. Purposes of processing

Providing membership and account management; delivering AI-assisted writing features (including processing your text only when you tap the button); syncing your settings across your devices; ensuring service security and preventing abuse; resolving technical issues; fulfilling legal obligations.

4. Legal grounds for processing (KVKK Art. 5)

Processing is directly related to the establishment or performance of a contract (to manage your account and provide the service), the controller's legitimate interest (service security, abuse prevention), and explicit provisions of law. Transferring your AI request to our provider abroad relies on your explicit consent (given when you send a request by tapping the AI button).

5. Parties your data may be transferred to and the purpose

• Apple / Google: only during sign-in, for identity verification.
• Our AI provider (OpenAI, located abroad): only when you tap the AI button, to respond to your request.
• Our hosting provider: to provide the technical infrastructure of the service.

Beyond this, your data is not shared with or sold to third parties for marketing or other commercial purposes.

6. Method and legal basis of data collection

Your data is collected directly from you electronically, through automated and partially automated means (e.g. when you save a setting or tap the AI button), while you use the app and keyboard; it is processed on the legal grounds above.

7. Your rights (KVKK Art. 11)

To learn whether your personal data is being processed; to request information if it is; to learn the purpose of processing and whether it's used accordingly; to know the third parties to whom it's transferred domestically or abroad; to request correction if processed incompletely or incorrectly; to request deletion/destruction under the conditions set out in KVKK; to request that corrections/deletions be notified to parties your data was transferred to; to object to an outcome that is to your detriment arising solely from automated analysis; to request compensation for damages arising from unlawful processing.

8. How to apply

You can reach us at [email address] to exercise the rights above. You can also export your data directly and delete your account from within the app (Account tab).