GDPR Data Protection Notice
GDPR Data Protection Notice
This Notice has been prepared to inform you about the personal data processed by the ToRun AI platform ("ToRun", the "Platform") pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "KVKK" or the "Law") and the "Communiqué on the Principles and Procedures to Be Followed in Fulfilling the Obligation to Inform".
ToRun is a platform that provides AI services such as chat, image/video/music/audio generation, workflows, and an in-app assistant. The Platform is operated by an individual (sole proprietor) founder resident in Türkiye, and is not operated within a legal entity (company).
Note: This document is prepared to meet the KVKK duty to inform for data subjects resident in Türkiye. For users outside Türkiye and for general data-processing principles, the separately applicable Privacy Policy (GDPR) governs, and this Notice is complementary to that policy.
1. Identity of the Data Controller
In its capacity as the "data controller" defined in Article 3 of the KVKK, your personal data is processed by the individual (sole proprietor) operating the ToRun platform.
| Information | Detail |
|---|---|
| Data controller | The individual (sole proprietor) operating the ToRun platform |
| Platform / website | torun.ai — api.torun.ai |
| Application e-mail address | [email protected] |
| Nature of activity | Provision of AI-based online services |
ToRun is not a legal entity (limited/joint-stock company, etc.); the activity is carried out individually by a natural person resident in Türkiye. The obligation to register with the Data Controllers' Registry (VERBİS) is assessed within the framework of the exceptions and thresholds set out in the relevant legislation; should a registration obligation arise, the relevant registration will be made (see Section 9).
2. Personal Data Processed (Data Categories)
Within the scope of your use of ToRun, the following categories of personal data may be processed:
2.1. Identity and Account Data
- Username
- E-mail address
- Password — not stored in plain text; kept only in an irreversibly hashed form
2.2. External Authentication (Social Sign-in) Data
If you choose to create your account / sign in with an external provider:
- Authentication information shared by the relevant provider regarding your Google, Microsoft and/or Apple account (e.g. unique user identifier, e-mail address, name, profile information — to the extent permitted by the provider)
2.3. Profile Data
- Profile settings, preferences and any profile information you optionally provide
2.4. Transaction Security and Usage Records (Logs)
- Sign-in/sign-out records, service usage/transaction logs
- Technical records kept for security and account-security purposes
2.5. Device and Analytics Data
- Device/browser information and technical analytics data
- This data is processed on our own infrastructure (self-hosted); it is not transferred to third-party advertising/analytics networks and is not used for profiling directly associated with your identity
2.6. User-Generated Content
- The prompts and commands you enter into the Platform
- The image, video, audio and text content produced through the Platform
- Content within your workflows and in-app assistant interactions
2.7. Payment and Subscription Data
- Subscription plan, transaction/invoice information and payment status
- Runs balance - your prepaid usage-credit (Runs) balance and its transaction history (top-ups, consumption, refund reversals)
- Important: Payments are collected through Lemon Squeezy, which acts as the "Merchant of Record". Credit/debit card numbers, CVV and similar sensitive payment-instrument information are not held, stored, or viewable by ToRun. This data is processed directly by the payment service provider.
ToRun does not request or process special categories of personal data (KVKK Art.6 — health, religion, biometric data, etc.) within its routine operation. You are advised not to share such data through prompts/content.
3. Purposes of Processing Personal Data
Your personal data is processed for the following purposes:
- Account creation and management — completing the registration, authenticating you and managing your account
- Provision of the service — providing AI services including chat, image/video/music/audio generation, workflows and the in-app assistant
- Billing and subscription management — carrying out payment, subscription, renewal and refund processes
- Security and fraud prevention — ensuring account security and detecting/preventing abuse, misuse and fraud
- Fulfilment of legal obligations — meeting retention, notification and authority-response obligations arising from legislation
- Support and communication — handling requests, complaints and support inquiries, and communicating with you about the service
- Improvement of the service — improving the quality, stability and user experience of the service (through identity-independent technical measurement)
- Optional / marketing activities — sending informational and promotional messages only where you have given explicit consent
4. Legal Grounds for Processing (KVKK Art.5 / Art.6)
Your personal data is processed on the basis of the following legal grounds set out in Article 5 of the KVKK:
| Legal ground (Art.5) | Example of processing to which it applies |
|---|---|
| Necessity for the establishment or performance of a contract (Art.5/2-c) | Account creation, provision of the service, subscription and billing |
| Fulfilment of a legal obligation (Art.5/2-ç) | Statutory retention, tax/financial legislation and responses to authority requests |
| Legitimate interest of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject (Art.5/2-f) | Security, fraud prevention, service improvement, identity-independent analytics |
| Data made public by the data subject / establishment and protection of a right (Art.5/2-d, e) | Keeping records necessary to protect rights in the event of a dispute |
| Explicit consent (Art.5/1) | Non-mandatory marketing messages and optional processing activities |
- Explicit consent is not additionally sought for mandatory processing (based on performance of a contract, legal obligation and legitimate interest).
- Marketing and optional processing rely solely on your explicit consent; you may withdraw this consent at any time.
- Special categories of personal data (Art.6) are not routinely processed; should such processing be required, the additional conditions prescribed by the Law (explicit consent or a statutory exception) are observed.
5. Transfer of Personal Data and Transfer Abroad (KVKK Art.8 / Art.9)
In order to provide the service, your personal data is transferred to the service providers listed below, limited to the relevant purpose. As the majority of ToRun's infrastructure and service providers are located abroad, some of these transfers constitute transfers abroad.
5.1. Parties to Whom Data Is Transferred
| Recipient / Provider | Purpose of transfer | Location |
|---|---|---|
| Bunny.net | Content delivery (CDN), file storage and static-asset serving | Abroad |
| AI providers (e.g. OpenAI, Anthropic, Google, ElevenLabs and similar) | Processing your prompts and content to generate AI output | Abroad |
| Lemon Squeezy (Merchant of Record) | Carrying out payment, subscription and billing processes | Abroad |
| Analytics infrastructure | Identity-independent technical measurement and service improvement (self-hosted) | Our own infrastructure |
| Authorized public institutions and organizations | Only as required by legal obligation and to the extent permitted by legislation | Türkiye |
5.2. Transfer of User Content to AI Providers
By the nature of the service, the prompts you enter and the related content are transferred for processing to the AI providers you select/use so that output can be generated. Most of these providers are located abroad. Therefore, this transfer falls within the scope of a transfer abroad under KVKK Art.9.
5.3. Legal Basis of the Transfer
Transfers abroad are carried out within the framework of Article 9 of the KVKK, based on:
- your explicit consent for the provision of the service, and/or
- the conditions prescribed by the Law such as performance of a contract, legal obligation and legitimate interest, and
- the principles prescribed by the relevant legislation (adequate safeguards, undertakings / standard contractual clauses, etc., where such mechanisms are required).
The transfer is in all cases kept limited and proportionate to the relevant purpose.
6. Method of Collecting Personal Data
Your personal data is collected:
- Directly from you: through actions such as account creation, signing in, editing your profile, entering prompts/content and submitting support requests,
- By automated means: through log, device and analytics records generated during your use of the Platform,
- Through third-party identity providers: from the relevant provider if you sign in with Google/Microsoft/Apple,
- Through the payment service provider: through status information relating to subscription/payment transactions,
by wholly or partly automated means, or by non-automated means provided that it forms part of a data-recording system.
7. Retention Period
- Your personal data is retained for as long as your account is active and for the period required by the processing purposes.
- Even where the purpose has ceased, it may be retained for the statutory retention periods arising from the relevant legislation (tax, commercial, consumer and e-commerce legislation, etc.).
- Upon expiry of statutory retention periods or cessation of the processing conditions, your data is deleted, destroyed or anonymized pursuant to Article 7 of the KVKK.
- Deletion request: You may request deletion/anonymization of your data by using the in-app "Delete Account" function or by submitting your erasure request via
/api/gdpr/requests. Your request is fulfilled in accordance with the legislation, save for data subject to a statutory retention obligation.
8. Rights of the Data Subject (KVKK Art.11)
Pursuant to Article 11 of the KVKK, by applying to the data controller you have the right to:
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used in accordance with that purpose,
- Know the third parties to whom the data is transferred, domestically or abroad,
- Request rectification if it has been processed incompletely or incorrectly,
- Request erasure or destruction (anonymization) of the data within the framework of the conditions set out in KVKK Art.7,
- Request that the rectification, erasure and destruction operations be notified to the third parties to whom the data was transferred,
- Object to a result arising against you through analysis of the processed data solely by automated systems,
- Request compensation for damages you suffer due to unlawful processing.
In addition, for processing based on explicit consent, you have the right to withdraw your consent at any time.
9. Method of Application
You may submit your requests under KVKK Art.11 through the following means, pursuant to the "Communiqué on the Procedures and Principles of Application to the Data Controller":
- By e-mail: by sending a written application to
[email protected]together with information verifying your identity (formal legal notices may also be addressed to[email protected]), - In-app functions: through the "Delete Account" feature in account settings and the related data-request tools (
/api/gdpr/requests).
Your application must clearly state your name and surname, your signature if the application is in writing, your contact details and the subject of your request. Your applications are concluded free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request; however, should the transaction require an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
VERBİS note (informational): The data controller's VERBİS registration obligation is assessed within the framework of the thresholds and exceptions set out in the relevant legislation. Where a registration obligation arises, the relevant registry entry will be made.
10. Changes and Effect
- This Notice may be updated in line with changes in legislation and updates to our services.
- The current text takes effect on the date it is published on the Platform. For material changes, notification may be provided by appropriate means.
- You may review the most up-to-date version of this text on the Platform at any time.
Complementary-document note: This KVKK Data Protection Notice is prepared for data subjects resident in Türkiye; for users outside Türkiye and for general data-protection principles (including the GDPR), it complements the applicable Privacy Policy. In the event of any discrepancy between the two documents, for data subjects resident in Türkiye the KVKK provisions and this Notice prevail.