GDPR Data Protection Notice

This Notice has been prepared to inform you about the personal data processed by the ToRun AI platform ("ToRun", the "Platform") pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "KVKK" or the "Law") and the "Communiqué on the Principles and Procedures to Be Followed in Fulfilling the Obligation to Inform".

ToRun is a platform that provides AI services such as chat, image/video/music/audio generation, workflows, and an in-app assistant. The Platform is operated by TORUN TEKNOLOJİ ANONİM ŞİRKETİ (the "Company"), a joint-stock company established in Türkiye.

Note: This document is prepared to meet the KVKK duty to inform for data subjects resident in Türkiye. For users outside Türkiye and for general data-processing principles, the separately applicable Privacy Policy (GDPR) governs, and this Notice is complementary to that policy.

---

1. Identity of the Data Controller

In its capacity as the "data controller" defined in Article 3 of the KVKK, your personal data is processed by TORUN TEKNOLOJİ ANONİM ŞİRKETİ, which operates the ToRun platform.

Information	Detail
Data controller	TORUN TEKNOLOJİ ANONİM ŞİRKETİ (Torun Teknoloji A.Ş.)
Registered office	Selimpaşa Mah. 1010. Sk. No: 10/1 İç Kapı No: 1, Silivri / İstanbul, Türkiye
Trade registry	İstanbul Ticaret Sicili Müdürlüğü, No. 1165311
MERSİS number	0857078305100001
Tax office / tax identification number	Silivri Vergi Dairesi, 8570783051
Platform / website	torun.ai — api.torun.ai
Application e-mail address	[email protected]
Nature of activity	Provision of AI-based online services

The Company was registered with the İstanbul Trade Registry Office on 19 October 2026. Its obligation to register with the Data Controllers' Registry (VERBİS) is assessed against the exemption criteria set by the Personal Data Protection Board (annual number of employees, annual balance-sheet total, and whether processing special categories of personal data is its main field of activity). As of the date of this Notice, no VERBİS registration has been made in the Company's name; should a registration obligation arise, the registration will be made within the period prescribed by the legislation (see Section 9).

---

2. Personal Data Processed (Data Categories)

Within the scope of your use of ToRun, the following categories of personal data may be processed:

2.1. Identity and Account Data

• Username
• E-mail address
• Password — not stored in plain text; kept only in an irreversibly hashed form

2.2. External Authentication (Social Sign-in) Data

If you choose to create your account / sign in with an external provider:

• Authentication information shared by the relevant provider regarding your Google, Microsoft and/or Apple account (e.g. unique user identifier, e-mail address, name, profile information — to the extent permitted by the provider)

2.3. Profile Data

• Profile settings, preferences and any profile information you optionally provide

2.4. Transaction Security and Usage Records (Logs)

• Sign-in/sign-out records, service usage/transaction logs
• Technical records kept for security and account-security purposes

2.5. Device and Analytics Data

• Device/browser information and technical analytics data
• Analytics data is processed on our own infrastructure (self-hosted); it is not transferred to third-party advertising/analytics networks and is not used for profiling directly associated with your identity. Device verification for the mobile app's trial without an account is carried out through Apple and Google services (see 2.8)
• Crash reports from the mobile app (error message, technical error trace, screen name, app and operating-system versions), sent when the app crashes while you are signed in and kept with your user ID in server logs for at most 30 days

2.6. User-Generated Content

• The prompts and commands you enter into the Platform
• The image, video, audio and text content produced through the Platform
• Content within your workflows and in-app assistant interactions

2.7. Payment and Subscription Data

• Subscription plan, transaction/invoice information and payment status
• Runs balance - your prepaid usage-credit (Runs) balance and its transaction history (top-ups, consumption, refund reversals)
• Important: Payments on the website are collected through Dodo Payments, which acts as the "Merchant of Record"; purchases in the mobile app are collected by Apple (App Store) or Google (Google Play). Credit/debit card numbers, CVV and similar sensitive payment-instrument information are not held, stored, or viewable by ToRun. This data is processed directly by the relevant payment service provider.

2.8. Trial Without an Account (Mobile App)

You can try the ToRun mobile app for a limited time without creating an account (the "guest trial"). During the trial we do not ask for your name, e-mail address or phone number. To provide the trial, to stop it from being started again and again on the same device, and to prevent abuse, we process the following:

• Device verification - the app asks Apple (App Attest, DeviceCheck) or Google (Play Integrity) to confirm that the device and the app are genuine, and our server checks the result with them. We do not store the verification tokens. Apple keeps two values per device for us on its own servers ("a trial was given", "an account was created on this device").
• Device identifier - on iOS, a random identifier that the app creates and keeps on the device; on Android, the app-specific device identifier (ANDROID_ID). Only a one-way hash of it leaves the device, and we store it only after hashing it again with a secret key (a keyed hash). On iOS we also store a keyed hash of the App Attest key identifier.
• Network - a keyed hash of the network prefix of your IP address, never the full address, for the trial's daily limits.
• Trial record - how much of the trial is left, its status and, if a trial was refused, the reason.
• What you try - the message you type, your voice conversation, the photo you choose and the name you give for a song are sent to the AI provider that produces the result and to our content-moderation provider (Section 5.1). Your photo is used only to make the image and is not stored. A voice conversation is not recorded and its transcript is not stored. Your latest messages are kept for up to 24 hours after your last message, so that the next answer has context; they are not saved as a conversation. What the trial produces (a song, an image) is kept for 24 hours and then deleted.

Retention. Trial records are deleted automatically 90 days after the trial was given, and device records 90 days after the device was last used for the trial. If you create an account from the trial, the link between the account and the device is kept for 365 days, so that a second account created on the same device does not receive the welcome gift again. The billing record of what the trial used is kept for 5 years, as accounting law requires; it identifies the trial, not you, and carries the keyed hash of the network prefix, which is removed if you delete your trial data.

If you create an account. What you made during the trial moves into your account's Library and is kept as part of your account from then on; the device record is linked to your account.

Legal basis. The legitimate interest of the data controller in keeping the service secure and preventing abuse of a free trial (KVKK Art. 5/2-f), and the establishment and performance of a contract for the trial you asked for (Art. 5/2-c). Sending data to Apple's and Google's verification services and to AI providers is a transfer abroad, subject to Section 5.

Deleting your trial data. You can delete your trial data at any time in the app, without an account: on the welcome screen, open "Your trial data" and choose "Delete my trial data". The device is verified the same way as for the trial itself, so nobody else can delete your trial data or learn anything about it. Afterwards we keep only a note that this device has used its trial (nothing else, for at most 90 days) and, for one day, that a trial was used on your network, so that the trial cannot simply be started again. If you created an account, deleting the account also deletes the trial records linked to it. The two values Apple keeps for a device are not linked to you; we do not reset them, because resetting them would allow a new trial on that device.

ToRun does not request or process special categories of personal data (KVKK Art.6 — health, religion, biometric data, etc.) within its routine operation. You are advised not to share such data through prompts/content.

---

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

1. Account creation and management — completing the registration, authenticating you and managing your account
2. Provision of the service — providing AI services including chat, image/video/music/audio generation, workflows and the in-app assistant
3. Billing and subscription management — carrying out payment, subscription, renewal and refund processes
4. Security and fraud prevention — ensuring account security and detecting/preventing abuse, misuse and fraud
5. Fulfilment of legal obligations — meeting retention, notification and authority-response obligations arising from legislation
6. Support and communication — handling requests, complaints and support inquiries, and communicating with you about the service
7. Improvement of the service — improving the quality, stability and user experience of the service (through identity-independent technical measurement)
8. Optional / marketing activities — sending informational and promotional messages only where you have given explicit consent

---

4. Legal Grounds for Processing (KVKK Art.5 / Art.6)

Your personal data is processed on the basis of the following legal grounds set out in Article 5 of the KVKK:

Legal ground (Art.5)	Example of processing to which it applies
Necessity for the establishment or performance of a contract (Art.5/2-c)	Account creation, provision of the service, subscription and billing
Fulfilment of a legal obligation (Art.5/2-ç)	Statutory retention, tax/financial legislation and responses to authority requests
Legitimate interest of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject (Art.5/2-f)	Security, fraud prevention, service improvement, identity-independent analytics
Data made public by the data subject / establishment and protection of a right (Art.5/2-d, e)	Keeping records necessary to protect rights in the event of a dispute
Explicit consent (Art.5/1)	Non-mandatory marketing messages and optional processing activities

• Explicit consent is not additionally sought for mandatory processing (based on performance of a contract, legal obligation and legitimate interest).
• Marketing and optional processing rely solely on your explicit consent; you may withdraw this consent at any time.
• Special categories of personal data (Art.6) are not routinely processed; should such processing be required, the additional conditions prescribed by the Law (explicit consent or a statutory exception) are observed.

---

5. Transfer of Personal Data and Transfer Abroad (KVKK Art.8 / Art.9)

In order to provide the service, your personal data is transferred to the service providers listed below, limited to the relevant purpose. As the majority of ToRun's infrastructure and service providers are located abroad, some of these transfers constitute transfers abroad.

5.1. Parties to Whom Data Is Transferred

Recipient / Provider	Purpose of transfer	Location
Bunny.net	Content delivery (CDN), file storage and static-asset serving	Abroad
AI providers (e.g. OpenAI, Anthropic, Google, ElevenLabs and similar)	Processing your prompts and content to generate AI output	Abroad
Dodo Payments (Merchant of Record)	Carrying out payment, subscription and billing processes for purchases on the website	Abroad
Apple (App Store), Google (Google Play)	Carrying out purchases made in the mobile app	Abroad
Apple and Google device-verification services (App Attest, DeviceCheck; Play Integrity)	Confirming that the device and the app are genuine during the mobile app's trial without an account	Abroad
Google Maps Platform	Place search, place details, directions and maps when you ask about places or share your location	Abroad
Analytics infrastructure	Identity-independent technical measurement and service improvement (self-hosted)	Our own infrastructure
Authorized public institutions and organizations	Only as required by legal obligation and to the extent permitted by legislation	Türkiye

5.2. Transfer of User Content to AI Providers

By the nature of the service, the prompts you enter and the related content are transferred for processing to the AI providers you select/use so that output can be generated. Most of these providers are located abroad. Therefore, this transfer falls within the scope of a transfer abroad under KVKK Art.9.

5.3. Legal Basis of the Transfer

Transfers abroad are carried out within the framework of Article 9 of the KVKK, based on:

• your explicit consent for the provision of the service, and/or
• the conditions prescribed by the Law such as performance of a contract, legal obligation and legitimate interest, and
• the principles prescribed by the relevant legislation (adequate safeguards, undertakings / standard contractual clauses, etc., where such mechanisms are required).

The transfer is in all cases kept limited and proportionate to the relevant purpose.

---

6. Method of Collecting Personal Data

Your personal data is collected:

• Directly from you: through actions such as account creation, signing in, editing your profile, entering prompts/content and submitting support requests,
• By automated means: through log, device and analytics records generated during your use of the Platform,
• Through third-party identity providers: from the relevant provider if you sign in with Google/Microsoft/Apple,
• Through the payment service provider: through status information relating to subscription/payment transactions,

by wholly or partly automated means, or by non-automated means provided that it forms part of a data-recording system.

---

7. Retention Period

• Your personal data is retained for as long as your account is active and for the period required by the processing purposes.
• Even where the purpose has ceased, it may be retained for the statutory retention periods arising from the relevant legislation (tax, commercial, consumer and e-commerce legislation, etc.).
• Upon expiry of statutory retention periods or cessation of the processing conditions, your data is deleted, destroyed or anonymized pursuant to Article 7 of the KVKK.
• Trial without an account (mobile app): trial records are deleted 90 days after the trial was given, device records 90 days after the device was last used for the trial, and outputs that were not moved to an account after 24 hours; the latest messages are kept for up to 24 hours after the last message, and the account–device link for 365 days. You can delete your trial data in the app at any time (see 2.8).
• Mobile app crash reports are kept in server logs for at most 30 days.
• Deletion request: You may request deletion/anonymization of your data by using the in-app "Delete Account" function or by submitting your erasure request via /api/gdpr/requests. Your request is fulfilled in accordance with the legislation, save for data subject to a statutory retention obligation.

---

8. Rights of the Data Subject (KVKK Art.11)

Pursuant to Article 11 of the KVKK, by applying to the data controller you have the right to:

1. Learn whether your personal data is processed,
2. Request information if it has been processed,
3. Learn the purpose of processing and whether it is used in accordance with that purpose,
4. Know the third parties to whom the data is transferred, domestically or abroad,
5. Request rectification if it has been processed incompletely or incorrectly,
6. Request erasure or destruction (anonymization) of the data within the framework of the conditions set out in KVKK Art.7,
7. Request that the rectification, erasure and destruction operations be notified to the third parties to whom the data was transferred,
8. Object to a result arising against you through analysis of the processed data solely by automated systems,
9. Request compensation for damages you suffer due to unlawful processing.

In addition, for processing based on explicit consent, you have the right to withdraw your consent at any time.

---

9. Method of Application

You may submit your requests under KVKK Art.11 through the following means, pursuant to the "Communiqué on the Procedures and Principles of Application to the Data Controller":

• By e-mail: by sending a written application to [email protected] together with information verifying your identity (formal legal notices may also be addressed to [email protected]),
• In writing: by delivering it by hand to the Company's registered office stated in Section 1, or by sending it there through a notary,
• In-app functions: through the "Delete Account" feature in account settings and the related data-request tools (/api/gdpr/requests).

Your application must clearly state your name and surname, your signature if the application is in writing, your contact details and the subject of your request. Your applications are concluded free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request; however, should the transaction require an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

VERBİS note (informational): The Company's position regarding VERBİS is described in Section 1. Should a registration obligation arise, or should the Company register voluntarily, the registry entry will be made and this Notice updated.

---

10. Changes and Effect

• This Notice may be updated in line with changes in legislation and updates to our services.
• The current text takes effect on the date it is published on the Platform. For material changes, notification may be provided by appropriate means.
• You may review the most up-to-date version of this text on the Platform at any time.

---

Complementary-document note: This KVKK Data Protection Notice is prepared for data subjects resident in Türkiye; for users outside Türkiye and for general data-protection principles (including the GDPR), it complements the applicable Privacy Policy. In the event of any discrepancy between the two documents, for data subjects resident in Türkiye the KVKK provisions and this Notice prevail.