Personal Data Protection Law (KVKK) Disclosure
Last updated: 13 October 2026
This is a translation; in case of conflict the Turkish version prevails.
This version takes effect on 24 September 2026 for new users and on 8 October 2026 for existing users. Rows about cookies apply to everyone from 28 September 2026 (Cookie Policy 4.5).
Addition of 29 September 2026: Şirketim (section 5.1), company following, internal opportunities, the process survey and the employer's ✦ status message draft (sections 5.2–5.5) were added. These features are switched on at least 15 days after this addition is published; until then, this processing does not take place.
This disclosure is made as data controller under article 10 of Law no. 6698 on the Protection of Personal Data ("KVKK").
1. Data controller
Çelik Yazılım ve Ticaret Limited Şirketi (brand: Cvisioner) MERSIS: 0240153782200001 · Çankaya Tax Office 2401537822 Address: Kızılırmak Mah. Dumlupınar Bulvarı Next Level No:3 A Kat:4 D.No:11 PK:06520 Çankaya, Ankara Email: support@cvisioner.com · Phone: +90 544 473 5632
2. The personal data we process
| Category | Scope |
|---|---|
| Identity | First name, last name, date of birth, optional national ID or tax number for invoicing |
| Contact | Email address, phone number, address |
| Professional experience | Work experience, education, skills, certificates, projects and languages in your CV |
| Career preferences | Title, city and country, experience level and years, work model preference, job-seeking status, industry |
| Images | Profile photo and the photo on your CV |
| AI outputs | Match scores, CV analyses, job-specific fit analyses |
| In-product usage records | Jobs viewed, match interactions |
| Transaction security | IP address, sign-in and sign-out records, browser information |
| Cookie and advertising identifiers | Unless you declined in the banner (Cookie Policy) |
| Customer transaction | Subscription details, payment reference, invoice details, subscription status and plan change records, the payment provider's card token (we never hold the card number), the ₺1 card verification record, payment consent records (date, amount, hashed IP) |
| Preference and participation records | Companies you follow and your email notification choice; your internal opportunities choice; the rating and comment you give in the process survey (stored without a link to your identity) |
3. Purposes and legal grounds
| Purpose | Data categories | Legal ground (KVKK) |
|---|---|---|
| Membership, account and session management | identity, contact, account, transaction security | art. 5/2-(c) conclusion and performance of a contract |
| CV creation, CV import, AI-assisted analysis (ATS, gap analysis, cover letter, career suggestions) | CV content, career preferences | art. 5/2-(c) |
| Job matching, match score, selecting the open jobs in the free tier | profile, CV, preferences, job interactions | art. 5/2-(c) |
| Showing you to employers in the talent pool (while visibility is on) | the fields in Section 5 | art. 5/2-(c); you can turn it off at any time |
| Delivering your application to the employer (when you apply) | the CV and cover letter you selected | art. 5/2-(c) |
| Payment, invoice and subscription records | customer transaction, invoice details | art. 5/2-(ç) legal obligation and (c) |
| Keeping distance sales and consent records | consent records (date, amount, text, hashed IP) | art. 5/2-(ç) |
| Security, prevention of abuse, error tracking | transaction security, device and browser, error records | art. 5/2-(f) legitimate interest; art. (ç) for records with statutory retention |
| Service emails (account, security, payment, application status, match digest) | contact | art. 5/2-(c) |
| Commercial electronic messages (campaigns, news) | art. 5/1 explicit consent and art. 6 of Law no. 6563 (optional) | |
| Analytics and advertising cookies; sign-up, payment and purchase notice to Meta | cookie identifiers, page events; in the notice, hashed email and user ID, IP, browser, payment amount | art. 5/2-(f) legitimate interest; you can stop it with Decline in the banner (Cookie Policy) |
| Masked session recording | masked screen recording | art. 5/1 explicit consent (Accept in the banner) |
| Cookieless performance measurement | anonymous page views | art. 5/2-(f) |
| Establishment, exercise and protection of rights | the related records | art. 5/2-(e) |
| Company following and notifications about new jobs at companies you follow | follow record, notification choice, email | art. 5/2-(c); you can stop following or switch off emails at any time |
| Internal opportunities: appearing as an internal candidate for jobs at the company you work for (only if you switch it on) | name, title, unit, job card skills; your candidate profile if you choose to share your CV (excluding your salary expectation) | art. 5/2-(c); you can switch it off at any time |
| Process survey (one optional question once your application is concluded) | rating and optional comment, without a link to your identity | art. 5/2-(f) legitimate interest |
4. Transfers
4.1. Within Türkiye
| Recipient | Purpose | Data |
|---|---|---|
| Employers on the platform | showing you in the pool (while visibility is on); delivering your application to the employer of the job you applied to; contact after you accept an offer | the pool data in Section 5; the CV and cover letter you selected; your contact details when you accept an offer |
| PayTR (payment institution) | payment, card storage | name, email, amount, IP; card data goes directly to PayTR and we never see it |
| Accounting and e-invoice providers | issuing invoices | invoice details |
| Competent public authorities and judicial bodies | lawful requests | the data covered by the request |
| Companies you follow | seeing their follower count and applications that came through following | the total follower count only; who follows is not shown; if you applied through following, that your application came this way |
| The company you work for (if you switched on internal opportunities) | display in the internal candidate list | name, title, unit, the date you switched it on, match percentage for the job and its basis; your CV and profile themselves are not shown |
| Companies you applied to (if you answered the process survey) | seeing the quality of their process | aggregate results only: average, distribution and comments without your name; results are shown as at least 5 answers accumulate |
When you consent to automatic renewal, your IP address is stored in encrypted form solely to be passed to the payment institution (PayTR) for renewal payments; it is deleted when automatic renewal is turned off.
4.2. Service providers abroad
The providers below act as data processors on our behalf, for the performance of the service.
| Provider | For what | Which data | Location |
|---|---|---|---|
| Supabase Inc. | database, sessions, file storage | account, profile, CV and other platform data | US-based company; servers in the European Union |
| Vercel Inc. | hosting, server-side processing, system logs, cookieless measurement | request logs (IP, browser), processed data | US-based; processing region EU (Ireland), global content network |
| Google LLC (Gemini API) | AI and semantic vectors for CV import, analysis and matching | CV content, job text, profile text (for matching); the application CV and cover letter in the employer's ✦ AI Analysis | USA |
| Functional Software, Inc. (Sentry) | error tracking; masked session recording if you pressed Accept in the banner | error records, user id, browser | USA |
| Resend | sending email | name, email, email content | USA |
| Upstash, Inc. | rate limiting, short-lived cache | IP address, user id | abroad |
| Meta Platforms | ad measurement; sign-up, payment and purchase notice (unless you declined in the banner) | cookie identifiers, page events; in the notice, hashed email and user ID, IP, browser | USA, Ireland |
| Google LLC (Analytics, Ads, Tag Manager) | measurement and advertising (unless you declined in the banner) | cookie identifiers, page events | USA |
| Google, LinkedIn, GitHub | authentication, only if you sign in with that method | name, email, profile photo | USA |
| logo.dev and Google's favicon service | company logos on job cards | your browser's IP address while the logo loads | abroad |
Transfers abroad are made in accordance with KVKK art. 9 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad.
5. Talent pool
Your candidate account is visible in the talent pool by default so that employers on the platform can find you. You turn visibility off in one tap from Profile > Preferences > "Talent pool visibility"; the moment you turn it off you drop out of employer lists, and no other service is affected.
If you started without an account: Until you save your account, your profile is not visible to employers.
What employers see: first and last name, profile photo, title, your profile summary (about text), city and country, experience level and years, skills, industry, work model preference, job-seeking status, education, languages; the summary, experience, education, project, skill, language and certificate sections of the CV you show in the pool, plus driving licence information; and your match score calculated against their own criteria.
What employers do not see: email, phone, website, social media accounts, date and place of birth, nationality, marital status, military service status, blood type, salary expectation and the cover letter attached to your CV. Your contact details are shared with an employer only when you accept that employer's offer.
Special categories of data: we do not ask for health, disability, religion, sect, ethnic origin, association or union membership, political opinion or criminal conviction data, and we recommend that you do not add them to your CV. If you add them to free-text fields they may be visible to employers as part of the CV; you can delete them at any time.
Your current employer: the employer you work for may also be on the platform. If you do not want it known that you are job hunting, keep visibility off.
An employer you are connected to through Şirketim: If your employer invited you to Şirketim and you accepted, that employer does not see you in the talent pool until you leave it. Your visibility to other employers does not change.
5.1. Şirketim (if your employer has added you as an employee)
If an employer invites you to Şirketim and you join, your work records are processed under that employer's responsibility. These records are onboarding tasks, leave, documents, job card, goals and 1:1 records. For this data, your employer is the data controller; Cvisioner processes it on your employer's behalf.
- Your employer provides the privacy notice for this data. Send your requests to your employer; if they reach us, we forward them to your employer.
- Your candidate account is separate. Your employer cannot see the applications you make to other companies or your job searches in your candidate account.
- No advertising or marketing measurement tools run on Şirketim pages.
5.2. Company following
- If you follow a company, you get in-app notifications about its new jobs.
- Email notifications are on by default for each company. You get at most one email per company per day.
- You can switch emails off with the link in the email or under Settings → Companies I follow.
- The company sees only the total number of followers, not who follows it.
- If you apply to a job at a company you follow, the company may see that your application came through following.
- When you stop following, your follow record is deleted.
5.3. Internal opportunities
If you switch on "I want to appear for internal opportunities" in the Şirketim area of the company you work for, the company's owner and admin users see you in the internal candidate list for their jobs. They see:
- your name, title and unit
- the date you switched it on
- your match percentage for the job and its basis
The match percentage is calculated as follows:
- If you also choose to share your CV, it is calculated from your candidate profile; your salary expectation is not used. Your CV and profile themselves are not shown.
- If you do not share it, only the skills on your job card are used.
The option is off by default, and you can switch it off at any time; when you do, you drop out of the list immediately. If you apply to that company's job while the option is on, your application is marked as internal.
5.4. Process survey
Once one of your applications is concluded (hire, rejection or withdrawal), we may ask you a single in-app question: "How was the process?" Answering is optional.
- Your rating and optional comment are stored without a link to your identity or your application.
- The company sees aggregate results only. As at least 5 answers accumulate, the average, distribution and comments are shown; comments appear as written, without your name. We recommend not writing anything in your comment that would identify you.
- You are asked at most once per company every 180 days.
5.5. The employer's status message draft (✦)
If your application has been waiting for a while, the employer may send you a "still under review" update. This is not a rejection.
- The employer may prepare a draft of this message with AI (✦). Your details are not part of the draft: the model receives only the company name and the job title, and your name is added when the message is sent.
- The message is not sent without the employer's approval.
- It is not sent twice for the same application within 7 days.
6. Automated processing and profiling
We process your profile and CV with AI and ranking algorithms to produce a match score for jobs, to rank jobs for you, and to decide which 2 jobs are open in the free tier. While your pool visibility is on, employers see you with your match score in a list ranked by their own criteria. When you apply to an employer's job, the employer may evaluate your application with the ✦ AI Analysis tool; that tool is configured not to infer characteristics such as age, gender, health, religion or ethnic origin, and it does not see personal contact fields. Scores and analyses are assistive tools; the hiring decision is the employer's, and Cvisioner does not make hiring decisions on your behalf.
If you believe a decision produced solely by automated processing works against you, you may object under KVKK art. 11/1-(g): write to support@cvisioner.com. Your objection is reviewed by a member of our team and answered within 30 days at the latest.
7. Method of collection
Your personal data is collected through our website and application channels, wholly or partly by automated means, from the information you enter directly and from the records created while you use the service.
8. Retention periods
| Record | Period |
|---|---|
| Account, profile, CV and files | Permanently deleted 30 days after the deletion request |
| Session started without an account (CV, profile) | Permanently deleted after 30 days if you do not save your account |
| Invoice, payment transaction and distance sales consent | 10 years (Turkish Commercial Code art. 82, Tax Procedure Law art. 253) |
| Audit records (excluding CV content) | 2 years |
| Security and transaction records | 24 months |
| Session records | 90 days |
| AI usage, notification and system records | 90 days |
| Match interactions | 180 days |
| Page view records | 90 days |
| Email delivery log | The recipient address is removed after 90 days; the record of which email was sent is kept so the same message is not sent twice |
| Commercial message consent and refusal records | At least 3 years after the consent ends; 10 years for deleted accounts |
| IP address in the automatic renewal consent | Deleted when automatic renewal is turned off |
| Cookie preference | 180 days (in your browser) |
| Follow record | Until you stop following or delete your account |
| Internal opportunities choice | While it is on; when you switch it off, a record of when you switched it on and off is kept until your account is deleted |
| Process survey answer | Without a link to your identity; while the account of the company you answered about remains open |
When the retention period expires or the purpose of processing ceases, personal data is deleted, destroyed or anonymised.
9. Your rights
Under KVKK art. 11 you may exercise the following rights:
- Learn whether your personal data is processed
- Request information if your personal data has been processed
- Learn the purpose of processing and whether the data is used in line with that purpose
- Know the third parties to whom the data is transferred, in Türkiye or abroad
- Request correction of incomplete or incorrectly processed data
- Request deletion or destruction of your personal data under the conditions set out in KVKK
- Request that actions taken under (5) and (6) be notified to the third parties to whom the data was transferred
- Object to a result against you arising from analysis solely by automated systems
- Claim compensation for damage arising from unlawful processing of your personal data
10. How to apply
To exercise your rights, send your request (a) from the email address registered in our system to support@cvisioner.com, or (b) in writing with a wet signature to the address above. The request must include your first and last name, your national ID number if you are a Turkish citizen (otherwise your nationality and passport or ID number), an address or email for notification, and your request.
Applications are free of charge and are concluded within 30 days at the latest; if the action requires an additional cost, the fee set out in the Authority's tariff may be charged. If your application is rejected, the answer is found insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date.