KVKK Disclosure Notice

1. Identity of the Data Controller

CVProfile currently operates as a pre-incorporation startup managed by the founder operator.

Data Controller: Emre Taptil.

Based in: Istanbul, Türkiye.

General legal contact: contact@cvprofile.tr

KVKK application email: iletisim@cvprofile.tr

2. Categories of Personal Data Processed

The following personal data categories may be processed:

• Identity and contact data: first name, last name, email address.
• Account security data: password hash, session records, verification and reset token records.
• Legal acceptance records: Terms of Service and Privacy Policy acceptance timestamps, version records, acceptance locale, and acceptance IP metadata.
• Profile/content data: username, display name, headline, uploaded CV file (PDF), optional preview image.
• Usage/security data: IP address, request logs, error/security logs, rate-limit records.
• Subscription/billing metadata: customer and subscription identifiers and plan/payment status metadata. Polar acts as Merchant of Record and independently processes card, invoicing, tax, and billing country/address data.
• Cookie/preference data: session cookie, locale cookie, and analytics cookies depending on consent model.

3. Processing Purposes

Personal data is processed for account management, public CV link publication, file upload/view/download functions, subscription and billing workflows, platform security, service improvement, and legal compliance.

4. Legal Grounds under KVKK (Art. 5/6)

Processing is primarily based on Article 5/2 legal grounds, including contractual necessity, legal obligations, protection/establishment of rights, and legitimate interests.

Where explicit consent is required, Article 5/1 consent basis is used.

CVProfile does not aim to process special categories of personal data.

5. Data Transfers and Transfer Purposes

Personal data may be transferred to limited third-party providers required for service delivery (Neon, Cloudflare R2, Resend, Polar as Merchant of Record, Vercel Analytics/Speed Insights).

Payment card details are processed by Polar as Merchant of Record and are not stored by CVProfile.

Where cross-border transfers occur, appropriate safeguards under KVKK and related regulations are applied.

6. Collection Method and Legal Reason

Data is collected through web forms, account/profile interfaces, file upload tools, cookies, security logs, support channels, and payment integrations via automated or semi-automated methods.

Processing is based on applicable Article 5/2 grounds; explicit consent is used where legally required.

7. Data Subject Rights (KVKK Art. 11)

You have rights under Article 11, including:

• Learn whether personal data is processed.
• Request information if personal data has been processed.
• Learn the processing purpose and whether data is used accordingly.
• Know third parties to whom data is transferred domestically or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion/destruction under KVKK Article 7.
• Request notification of correction/deletion to third parties.
• Object to adverse outcomes from automated analysis.
• Request compensation for damages due to unlawful processing.

8. Application Procedure

KVKK requests may be submitted by email to iletisim@cvprofile.tr.

Recommended email subject: "Personal Data Request (KVKK Art. 11)".

Additional information may be requested to verify identity before processing a request.

Valid requests are finalized within legal timelines and in any case no later than 30 days.