KVKK disclosure

Data controller

The data controller for nodWrite is Nodworks, the operator of nodwrite.com. This disclosure is the notice under Article 10 of Law No. 6698 on the Protection of Personal Data.

Applications and questions: info@nodwrite.com. Ask there for the registered address.

Personal data we process

Identity and contact: email, optional first and last name, and the name and Google subject identifier if you use Google Sign-In.

Account security: password hash, session, membership status, signup path, language, theme, and short-lived IP counters used for rate limits.

Customer content: prompts, documents, chat, attachments you add as material, uploaded images, and feedback.

Transaction, when checkout is open: plan, amount, currency, order status, and İyzico references. Card numbers are collected by İyzico, not by nodWrite.

Optional technical data: push endpoint and keys, and an encrypted provider token or API key if you connect one.

Purposes

Opening and running the account, sending verification and service mail, generating and storing documents, applying quotas, exporting a PDF on request, and sending a notification you enabled.

Taking payment and keeping the commercial record when a plan is for sale.

Securing the service, enforcing limits, and reviewing documents you hid from your library in order to assess generation quality.

Legal bases

Contract, Article 5(2)(c): the account, generation, editing, quotas, and the document you asked for. This is necessary to perform the service.

Legal obligation, Article 5(2)(ç): accounting records, once a payment exists.

Legitimate interest, Article 5(2)(f): security, rate limits, and quality review of hidden documents. You can object, as described under your rights.

Explicit consent, Article 5(1), only for optional features: browser notifications, a Google Cloud connection, and your own API key. The service does not depend on them. There is no consent checkbox that pretends to cover the whole service. Marketing mail is not sent.

Transfers

Hostinger processes service email. The servers that host the product store the account and the documents. İyzico processes payment when checkout is open. Your browser vendor delivers a push notification you enabled.

Prompts, documents, and chat are sent to the model provider for the account, which may be DeepSeek, Google, or both. Google also processes Sign-In and, if you connect it, Google Cloud. Those providers may process the data outside Turkey.

The transfer is made so we can perform the service you asked for. We do not claim a Board adequacy decision or a signed standard contract that is not in place. You can ask us, at info@nodwrite.com, to stop using a given provider for your account. Generation then depends on a provider that remains available.

We do not transfer personal data for sale or for advertising.

How we collect it

From you, when you sign up, write a prompt, upload, give feedback, turn on notifications, or pay. From Google, when you choose Google Sign-In or connect Google Cloud. From İyzico, as the payment result. From the browser, as the session, the language cookie, and the push subscription. Automatically, as short-lived rate-limit counters.

Your rights under Article 11

You may ask to learn whether your personal data is processed, to request information if it is, to learn the purpose and whether it is used for that purpose, and to know the third parties it is transferred to in the country or abroad.

You may ask for correction if it is incomplete or wrong, for deletion or destruction under the conditions in Article 7, and for us to notify third parties of that correction or deletion. You may object to a result against you reached solely by automated analysis. You may claim compensation if you are damaged by unlawful processing.

Hiding a document in the product is not an Article 7 deletion. Deletion is requested by email.

How to apply

Send the request in Turkish or English to info@nodwrite.com from the email on the account, and say which right you are using. We may ask for information needed to confirm the address. We answer within 30 days. If the Communiqué on application procedures requires a written form for a specific request, we will tell you.

An ordinary request has no fee. If the law allows a fee because the request is excessive, we will say so before charging it.

Apply to us first. If we do not answer within 30 days, or the answer is not enough, you can complain to the Personal Data Protection Board.