DRAFT — Not Yet in Effect
This is a draft; legal counsel should be obtained for KVKK compliance before publication. Last updated: June 2026.
Privacy Policy
Last updated: June 2026
KVKK Disclosure Notice — Data Controller
Data Controller: CV Mimarı
Email: destek@cvmimari.com
Location: Turkey
Under Turkish Data Protection Law No. 6698 ("KVKK"), your personal data is processed for the purposes described below.
1. Data We Collect
- Account information: Email address and encrypted password (Supabase Auth).
- Resume content: Name, contact information, work experience, education, skills, and other resume data you enter.
- Job posting text: Job posting content you paste in for AI analysis.
- Usage data: Credit transactions, number of AI analyses, session times.
- Technical data: IP address, browser type (via server logs).
2. Purposes of Processing
- Providing the service and delivering the resume-building feature.
- Generating AI-powered resume improvement suggestions.
- Tracking credit balances and processing payments.
- Providing technical support and fixing issues.
- Fulfilling legal obligations.
3. Data Transfer to Anthropic
Important: When a resume improvement suggestion is generated, your resume content (including personal information) and job posting text are sent to the Claude AI API operated by Anthropic PBC ("Anthropic"). This means an international data transfer to a US-based server.
- Anthropic does not use API inputs for model training (by default). See the Anthropic Privacy Policy for details.
- This transfer is required for the core function of the service; by using the AI improvement feature, you are considered to have consented to this transfer.
- Using the AI improvement feature is optional. Creating a resume and downloading a PDF happen without this transfer.
4. Data Storage and Security
Your data is stored encrypted on Supabase infrastructure (PostgreSQL). Supabase's servers are located in the EU region.
- Passwords are hashed with bcrypt; never stored in plain text.
- Database access is protected with Row Level Security (RLS).
- Payment information (card numbers, etc.) is not kept on CV Mimarı systems; it is processed by Lemon Squeezy.
5. Third-Party Services
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU |
| Anthropic (Claude) | AI resume improvement | US |
| Lemon Squeezy | Payment processing | US |
| Vercel | Application hosting | US/EU |
6. Cookies
CV Mimarı only uses essential session cookies. No third-party cookies are used for advertising or tracking purposes.
- Session cookie: Supabase authentication token — required for the service to function.
7. Your Rights Under KVKK
Under Article 11 of KVKK, you have the following rights:
- To learn whether your personal data is being processed.
- To request information about it if it has been processed.
- To learn the purpose of processing and whether it's used accordingly.
- To know the third parties to whom it is transferred, domestically or abroad.
- To request correction if it has been processed incompletely or incorrectly.
- To request its deletion or destruction.
- To object to the processing.
You can send your requests to destek@cvmimari.com. Requests are answered within 30 days.
8. Data Retention Period
- Account data is retained until the account is closed.
- All data is deleted within 30 days of an account closure request.
- Financial records required by law are retained for the period required by applicable regulations.
9. Contact
For privacy-related questions: destek@cvmimari.com