Start free

Legal

KVKK Privacy Notice

For what purposes and on what legal grounds your personal data is processed when you use Todix, who it is shared with, and your rights under Article 11 of KVKK (Turkish Personal Data Protection Law).

Last updated: [Effective date — Odin → Settings → Legal information]Version: [Version — Odin → Settings → Legal information]

This is an English translation for convenience. The Turkish version prevails in case of any discrepancy.

Contents
  1. Data controller
  2. Who does this notice cover?
  3. Personal data processed
  4. Purposes of processing
  5. Legal grounds and method of collection
  6. Transfer of personal data
  7. Transfer abroad
  8. Retention period
  9. Your rights under Article 11 of KVKK
  10. How to apply
  11. Changes

This privacy notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”, the Turkish Personal Data Protection Law) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to explain how your personal data is processed when you use the Todix service (the “Service”).

Data controller

Your personal data is processed by [Company legal name — Odin → Settings → Legal information] (the “Company”) in its capacity as data controller. Information about the Company is set out below:

Company legal name
[Company legal name — Odin → Settings → Legal information]
Address
[Address — Odin → Settings → Legal information]
MERSIS number
[MERSIS number — Odin → Settings → Legal information]
Tax office
[Tax office — Odin → Settings → Legal information]
Tax number
[Tax number — Odin → Settings → Legal information]
KEP address
[KEP address — Odin → Settings → Legal information]
Email for KVKK requests
[Email for KVKK requests — Odin → Settings → Legal information]

Who does this notice cover?

  • users who sign up for the Service or create an account through an invitation,
  • people who are invited to workspaces,
  • people who submit a support request or contact us by email,
  • people who visit the Service’s website.

Tasks, messages and files added to workspaces may contain personal data of third parties. The users who add such content and the persons or organizations that manage the workspace are responsible for sharing that data lawfully. The Company processes such content solely for the purpose of providing the Service.

Personal data processed

Identity

Data
Full name.

Contact

Data
Email address.

Account and transactions

Data
A one-way hash of your password (the password itself is not stored), account creation and last sign-in times, workspace memberships, roles and permissions, notification preferences, time zone, records of your acceptance of the legal texts (version, date, channel).

Visual

Data
An optional profile photo.

Workspace content

Data
Tasks, descriptions, chat messages, voice messages and their transcripts, files, checklists, labels, projects, time entries and activity history.

Personal area (finance)

Data
Payment and income records, amounts, payee names, IBANs, descriptions, assets, budgets, savings goals, subscriptions, the name, issuing bank and last 4 digits of cards, transactions from imported bank statements (date, description, amount). The full card number, expiry date and security code are neither requested nor stored.

Transaction security

Data
IP address (kept briefly for rate limiting on sign-in, sign-up and password operations), session information, the browser identification in the notification subscription, transaction and audit logs.

Notification subscription

Data
The browser’s push notification endpoint and encryption keys, the device name.

Requests and support

Data
Support requests, correspondence, attached screenshots and files, technical information attached to the request (browser, screen size, page path, app version, recent error logs).

Use of artificial intelligence

Data
Which Todi features were used and when, the model used, the number of tokens, cost and duration. Request and response texts are not stored.

The Service is not designed for special categories of personal data (health, religion, biometric data, etc.). We ask that you do not add such data to tasks, messages or files.

Purposes of processing

  • creating your account, verifying your identity and managing your session,
  • providing the workspace, task, chat, file, project, report and automation features, and sending invitations,
  • sending in-app, push and email notifications,
  • keeping payment, income, asset and card records in the Personal area and sending reminders,
  • running the Todi artificial intelligence features when the user requests it,
  • responding to support requests,
  • ensuring information security and preventing unauthorized access and misuse,
  • ensuring the continuity of the Service, fixing errors and improving performance,
  • fulfilling obligations arising from legislation and responding to requests from competent authorities,
  • establishing, exercising and protecting rights in the event of a dispute.

Legal grounds and method of collection

Your personal data is collected electronically, partly by automated means, when you sign up for the Service and as you use it, through the sign-up form, the app screens, invitation links, the email-to-task feature and the technical information sent by your browser, and is processed on the following legal grounds under Article 5(2) of KVKK:

Establishment or performance of a contract (Art. 5(2)(c))

For which operations
Your account, workspaces, tasks, chat, files, the Personal area, notifications, support and the Todi operations you start.

Legal obligation (Art. 5(2)(ç))

For which operations
Obligations arising from legislation to retain data, to provide information and to notify competent authorities.

Establishment, exercise or protection of a right (Art. 5(2)(e))

For which operations
Audit logs and records of acceptance of the legal texts.

Legitimate interest (Art. 5(2)(f))

For which operations
Information security, rate limiting, error logs and improving the Service, provided that this does not harm your fundamental rights and freedoms.

Transfer of personal data

Your personal data may be transferred to the following recipients, limited to the purposes above:

  • Other members of the workspace: your name, profile photo and your content in the workspace, to the extent allowed by the workspace’s role and permission settings.
  • Our service providers: for hosting, database, file storage, email delivery, push notification delivery and (only when you use them) artificial intelligence operations. Details are in the next section.
  • Competent public institutions and organizations: where they are legally authorized, limited to their requests.
  • Legal advisers and auditors: to the extent necessary, where a right needs to be protected.

Your personal data is not used for advertising and is not sold to third parties.

Transfer abroad

The Service’s infrastructure runs on servers located abroad. Your personal data is therefore transferred to the following service providers within the scope of Article 9 of KVKK:

Supabase Inc.

Purpose
Database, authentication, real-time updates
Server location
Germany (Frankfurt, EU)

Vercel Inc.

Purpose
Hosting the application, processing requests and server logs
Server location
Germany (Frankfurt, EU); static files through a global content delivery network

DigitalOcean, LLC

Purpose
Storing files, images and audio recordings
Server location
Germany (Frankfurt, EU)

OpenRouter, Inc.

Purpose
Only when you use Todi features: forwarding the request to the selected artificial intelligence model
Server location
USA; the country of the model provider that processes the request

Browser notification services (Google, Apple, Mozilla, Microsoft)

Purpose
Delivering push notifications to your device (encrypted)
Server location
Depending on the service of the browser you use

These transfers are carried out in accordance with the conditions laid down in Article 9 of KVKK, by providing appropriate safeguards, in particular standard contracts concluded with the providers.

Emails are delivered through the Company’s email delivery infrastructure; if the email-to-task feature is turned on, incoming emails reach the Service through the email service used for that purpose.

Retention period

Your personal data is retained for as long as the purpose of processing requires and, in any case, for as long as your account remains open. Some records are deleted automatically sooner; the periods are listed on the Privacy policy page. When the period expires, the data is deleted, destroyed or anonymized.

Your rights under Article 11 of KVKK

By applying to the data controller, you have the right to:

  • learn whether your personal data is being processed,
  • request information about the processing if your data has been processed,
  • learn the purpose of the processing and whether your data is used in accordance with that purpose,
  • know the third parties in Türkiye or abroad to whom your data has been transferred,
  • request the correction of your data if it has been processed incompletely or inaccurately,
  • request the deletion or destruction of your data within the framework of the conditions in Article 7 of KVKK,
  • request that the correction, deletion or destruction be notified to the third parties to whom your data has been transferred,
  • object to a result to your detriment arising from the analysis of your data exclusively through automated systems,
  • claim compensation for the damage if you suffer damage as a result of the unlawful processing of your data.

These are your rights under Article 11 of KVKK.

How to apply

To exercise your rights, you may submit your application, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

  • from the email address registered with the Service, to [Email for KVKK requests — Odin → Settings → Legal information],
  • by registered electronic mail (KEP), to [KEP address — Odin → Settings → Legal information],
  • with a secure electronic signature or a mobile signature, to [Email for KVKK requests — Odin → Settings → Legal information],
  • or by a petition bearing your wet signature, to [Address — Odin → Settings → Legal information].

Your application must clearly state your full name, your contact details and your request; we may ask for additional information to verify your identity. Applications are concluded free of charge within thirty days at the latest; if the process requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected, if you find the answer insufficient or if no answer is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of KVKK.

Changes

This notice may be updated. The version in force is [Version — Odin → Settings → Legal information], effective from [Effective date — Odin → Settings → Legal information]. We will inform you within the app of any significant changes and, where necessary, ask for your approval again.

Back to top