Turkish dataprotection notice.

Data controller

Your personal data is processed by Orkio as data controller: [Şirket unvanı ve adresi].

Orkio runs the website at orkio.si, the app at app.orkio.si, the panel at hub.orkio.si, and the boxes you rent through them (private Linux servers where AI coding agents run).

What personal data we process

• Identity and contact: your name and email address, and your Google account ID if you sign in with Google. We store only a hash of your password, never the password itself.
• Customer transactions: your plan, subscription status, payment and invoice records, the boxes and teams you belong to, and what you send us through the contact form. Card details go to our payment provider Polar and never reach us.
• Transaction security: IP addresses, session data, sign-in records, box status and error logs.

The files on your box (code, projects, agent conversations) are your content. We host them for you; we don't process them for our own purposes, look at them, or use them to train models. If you put your own or other people's personal data in those files, the decisions about that data are yours.

How we collect it

Electronically: from the forms you fill in when you sign up and use the service (website, app, panel, contact form), from Google if you choose to sign in with it, from Polar when you pay, and from the logs our servers keep automatically while running the service.

Why we process it

• To open your account, verify your sign-in, and set up and run your box;
• to run your subscription, payments, invoices and refunds;
• to answer support requests and contact form messages;
• to tell you about significant changes to the service, billing or terms;
• to keep the service secure, prevent abuse and fix errors;
• to meet tax, accounting and other legal obligations and answer requests from competent authorities.

We don't sell your data or use it for advertising.

Legal grounds

We rely on these grounds in Article 5(2) of the KVKK:

• (c) Entering into or performing a contract: the data needed for your account, box, subscription, payments and support.
• (ç) Legal obligation: invoices, accounting records and information we must give to authorities.
• (f) Legitimate interest, provided it doesn't harm your fundamental rights and freedoms: security logs, abuse prevention and improving the service.

Who we transfer it to

• Our hosting provider: the website, the panel and the boxes run on servers in the European Union (Germany).
• Polar (polar.sh, USA): as our merchant of record it handles payment, invoices and tax, and processes your name, email address, payment and invoice details.
• Resend (resend.com, USA): our email delivery service; it processes your name and email address to deliver account emails and contact form messages.
• Google (USA): only if you choose "Continue with Google", to verify your sign-in.
• Competent public authorities: only where the law requires it.

Model providers you connect (Anthropic, OpenAI and others) are a separate case: on your instructions, agents on your box send your prompts and the code they work on directly to that provider, under your own account and the provider's terms. We don't initiate that transfer; you decide which providers to connect.

Transfers abroad

Our servers are outside Turkey, in the European Union (Germany), so using the service transfers your personal data abroad. Polar, Resend and Google are based in the USA. We make these transfers under the conditions of Article 9 of the KVKK:

• on an adequacy decision for the destination country, where there is one;
• otherwise with appropriate safeguards, in particular the standard contracts published by the Personal Data Protection Board (notified to the Board after signing);
• where neither is possible and the transfer is incidental, under one of the exceptions in Article 9(6), for example where the transfer is necessary to perform our contract with you, or with your explicit consent.

If a transfer needs your explicit consent, we ask for it separately and in advance; refusing doesn't stop you using the rest of the service.

How long we keep it

• Account data: as long as your account is open. Ask us to delete it and we do within 30 days.
• Files on your box: until 30 days after the subscription ends; then the box and everything on it are deleted.
• Database backups: 14 days.
• Invoice and accounting records: as long as tax law requires.
• Security logs: [log saklama süresi], or longer where the law requires.

When a period ends we delete, destroy or anonymise the data.

Your rights

Under Article 11 of the KVKK you can apply to us to:

1. alearn whether your personal data is processed,
2. brequest information about it if it is,
3. clearn the purpose of processing and whether it is used accordingly,
4. çknow the third parties in Turkey or abroad it is transferred to,
5. dhave it corrected if it is incomplete or inaccurate,
6. ehave it erased or destroyed under the conditions in Article 7,
7. fhave the actions under (d) and (e) notified to the third parties it was transferred to,
8. gobject to an outcome against you that results from analysis solely by automated systems,
9. ğclaim compensation if you suffer damage because your data was processed unlawfully.

How to apply

Send your request through the contact form (orkio.si/contact) using the email address registered with us. Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, you can also apply in writing to [Şirket unvanı ve adresi] or through our registered email (KEP) address ([KEP adresi]).

Include your full name, your Turkish ID number if you are a Turkish citizen (otherwise your nationality and passport or ID number), your address or email address for our reply, and a clear description of your request. We may ask for more information to confirm your identity.

We answer within 30 days at the latest, free of charge as a rule. If the request involves a separate cost, we may charge the fee in the Board's tariff. If you find our answer insufficient or don't get one in time, you can complain to the Personal Data Protection Board under Article 14 of the KVKK.

Cookies

We use only what signing in needs: a session cookie on hub.orkio.si and your session in the app's local storage. No tracking, analytics or advertising cookies. Because these are strictly necessary for the service, we don't ask for separate consent.

Changes

When we update this notice we publish the new version here and change its date. We also tell you about significant changes by email. See our privacy policy as well.