Privacy and Personal Data Notice
Last updated: 2 November 2026 · Data controller: Lunify Yazılım ve Ticaret A.Ş. · Product: Lunify Vela
Under Turkey’s Personal Data Protection Law No. 6698 (KVKK), this notice explains how personal data is processed in Lunify Vela. It is the product-specific supplement to Lunify’s corporate KVKK notice.
1. Data controller
Lunify Yazılım ve Ticaret A.Ş. · Denizli / Türkiye · Contact: info@lunify.world
2. Data processed in Vela
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Identity and contact | Name, email, phone, company | Account, sign-in and support | Performance of contract |
| Client / lead records | Client name, phone, request and budget notes you enter | Providing the service as processor | Performance of contract |
| Listings and media | Listing details, address/location, photos and files uploaded to albums | Listing and album management | Performance of contract |
| Google Contacts / Calendar / Tasks | Contacts, events and tasks if you connect your Google account | Contacts, appointments and reminders | Your Google consent |
| WhatsApp messages | Incoming and outgoing text on the line you connect | Message assistance and CRM records | Your consent |
| Voice and dictation | Temporary processing of dictated audio for transcription | Voice commands and dictation | Your consent |
| Valuation queries | TKGM and comparable-query parameters and result records | Generating estimate information | Legitimate interest |
| Session and logs | Username, IP, session and action logs | Security and error tracking | Legal obligation; legitimate interest |
| Optional usage measurement | Account creation, first successful use and a pseudonymous browser token | Optional local product funnel | Consent, only after accepting all cookies |
3. Data about other people you enter
For client, supplier and employee data that you enter, you are the data controller and Lunify acts as processor only to provide the service on your instructions. Such data is not shared with other offices, sold or used to train AI models.
4. Recipients and international transfers
Hosting is provided by IONOS in a data centre in the United Kingdom (Vela VPS). When you use AI features, relevant prompt content is sent through an API to the selected model provider (only through OpenRouter, routed exclusively to endpoints with Zero Data Retention (ZDR) and data collection disabled. Google user data is never stored by AI providers, never used to train or improve AI models, and is used only to provide the feature you requested (Google API Services User Data Policy, Limited Use)). Google APIs, SMTP/Brevo and WhatsApp/Meta are used only for accounts you connect. Optional funnel measurement covers account creation and first successful use only; it runs only after you accept all cookies. Records stay on the Vela server in the United Kingdom for up to 90 days and contain a UTC timestamp, event name and an environment-specific HMAC pseudonym of a random browser ID; they do not contain raw browser IDs, prompts, message text, names, email addresses or IPs. No third-party analytics provider receives these events. Your data is stored on servers in the United Kingdom; under KVKK Article 9 this counts as a transfer of personal data abroad. We carry out such transfers only on a lawful basis: your explicit consent where it is required, or appropriate safeguards such as standard contractual clauses or a written undertaking where they apply.
5. Retention and deletion
- Data is kept while your account is active and deleted or anonymised within 90 days after closure.
- Security and access logs are kept for up to 12 months.
- Financial records are kept for 10 years where required by law.
- Optional funnel measurement records are retained for up to 90 days.
- Backups are overwritten in a cycle; deletion requests take effect in backups after that cycle.
- When you disconnect Google or WhatsApp, related access tokens are deleted from the application.
6. Your rights
You may ask whether your data is processed, request information and recipients, correct or delete data, restrict processing and seek compensation where applicable. Email info@lunify.world; requests are answered free of charge within 30 days.
Google user data and Limited Use
Vela requests only Google OpenID, Contacts, Calendar and Tasks scopes. It does not access Gmail inbox content or Google Drive files. Google data is used only for the user-facing feature you request, is not sold or used for advertising or AI/ML training, and is not transferred to other apps except as needed to provide that feature. You can disconnect access in Vela or at Google Account permissions.
7. Security
- Account data is isolated and queries are restricted to the signed-in user.
- Session cookies are HttpOnly, Secure and SameSite.
- Uploaded files are stored outside the web root and served after ownership checks.
- Traffic is protected with HTTPS/TLS and passwords are stored irreversibly.
- Backups, access logs, firewall and brute-force protection are used.
Security reports: guvenlik@lunify.world · security.txt