Last updated: July 16, 2026
1. Data Controller
Your personal data is processed by Faydabul Bilişim Teknolojileri ("FaydabulCloud"), located at Sancak Mahallesi 1609 Nolu Sokak 11/F Yomra Trabzon, Türkiye, as the data controller under KVKK.
2. What Data Do We Collect?
Account data: When you create an account, we collect your name, email address, and authentication credentials. If you register via Google or GitHub OAuth, we receive your name and email from those providers. Platform usage data: We collect project names, repository metadata (when you connect GitHub), deployment configurations, environment variable keys (not values are stored encrypted), domain names, SSL certificate status, build and runtime logs, and session timestamps. Payment data: For paid plans, billing address and TL-based payment information is processed through our payment provider. We do not store full credit card numbers. AI Gateway data: Request counts, token amounts, model names, and timestamp metadata are collected for usage measurement and billing. Prompt content and model outputs are not retained unless separately announced for a specific product phase.
3. Purposes of Data Processing
We process your personal data for the following purposes: (a) creating and managing your account; (b) providing the deploy platform, domain management, SSL provisioning, and log viewing services; (c) operating the AI Gateway, including request routing, usage tracking, and quota enforcement; (d) calculating TL-based usage and generating invoices; (e) sending service-related notifications (deployment status, quota alerts, maintenance windows); (f) analyzing aggregated usage patterns to improve the platform; (g) fulfilling legal obligations under KVKK, Law No. 5651, and tax regulations.
4. Legal Basis for Processing
Under KVKK Article 5, we process your data based on: (a) your explicit consent for optional features such as marketing communications; (b) the necessity of processing for the performance of the service contract between you and FaydabulCloud; (c) compliance with legal obligations under Turkish law, including KVKK, Law No. 5651 on internet content regulation, and tax legislation requiring invoice retention; (d) our legitimate interest in improving platform security, preventing abuse, and analyzing aggregated usage trends, provided your fundamental rights are not overridden.
5. AI Gateway Data Handling
FaydabulCloud's AI Gateway routes requests to external model providers (such as OpenAI, Anthropic, Google, Mistral, and DeepSeek). Operational metadata — including request count, token consumption, and model identifier — is logged for usage billing and quota management. When you use external AI models through our Gateway, the model provider's own privacy policy and data processing terms apply to the prompt content and generated outputs. We recommend reviewing each provider's data policy separately, especially for projects subject to KVKK, sectoral regulations, or contractual data localization requirements. The Control Plane metadata remains in Türkiye. Prompt and output retention policies will be clearly announced by product phase and are not active during early access.
6. Cross-Border Data Transfer
FaydabulCloud's primary compute and storage infrastructure is located in Türkiye. Your project data, deployment logs, domain records, and Control Plane metadata are processed and stored on servers within Türkiye. If a future product phase introduces a secondary region outside Türkiye, any cross-border transfer will comply with KVKK Article 9: we will rely on adequate protection determinations, standard contractual clauses, binding corporate rules, or your explicit consent, as applicable. If you choose to use third-party AI model providers through the AI Gateway, those providers may process data outside Türkiye. In such cases, the provider's own data processing location and policies govern the prompt and output data flow. You should evaluate this separately for KVKK compliance. We commit to documenting data flow maps and regional processing details transparently so that enterprise and regulated teams can make informed procurement decisions.
7. Data Retention
We retain your personal data only as long as necessary for the purposes described in this policy. Account data is kept while your account is active and for a reasonable period after account deletion to resolve disputes, enforce our terms, and comply with legal obligations. Build and runtime logs are retained according to your plan tier limits and automatically rotated. AI Gateway usage metadata is retained for billing and usage history during the account lifecycle. Under Turkish law, commercial books and invoices must be kept for 10 years. When retention is no longer required, data is deleted or anonymized.
8. Security Measures
We implement administrative and technical measures to protect your personal data: (a) encryption of data in transit (TLS) and at rest; (b) access controls limiting data access to authorized personnel on a need-to-know basis; (c) regular security assessments and infrastructure hardening; (d) CSRF protection on all state-changing requests; (e) session management with HTTP-only and secure cookies; (f) environment variable encryption at rest. While we take reasonable measures, no method of electronic storage or transmission is 100% secure. In the event of a data breach affecting your personal data, we will notify the KVKK Authority and affected users as required by law.
9. Your Rights Under KVKK
Under KVKK Article 11, you have the right to: (a) learn whether your personal data is processed; (b) request information if your data has been processed; (c) learn the purpose of processing and whether data is used accordingly; (d) know the third parties to whom data is transferred domestically or abroad; (e) request correction of incomplete or inaccurate data; (f) request deletion or destruction of data under KVKK Article 7; (g) object to processing that produces results against you through automated systems; (h) request compensation for damages arising from unlawful processing. To exercise these rights, contact us at the address or email listed below. We will respond within 30 days as required by KVKK.
10. Cookies and Tracking
FaydabulCloud uses essential session cookies for authentication (NextAuth.js) and locale preference storage. We do not use third-party tracking cookies, advertising pixels, or behavioral analytics scripts on the platform. The dashboard uses functional localStorage only for UI preferences (theme selection) and does not store personal data there.
11. Third-Party Services
FaydabulCloud integrates with third-party services that you choose to connect: (a) GitHub OAuth — when you link your GitHub account, we access repository lists, branch information, and commit metadata through GitHub's API on your behalf; your GitHub credentials are never stored by us; (b) External AI model providers — when you use the AI Gateway, requests are forwarded to OpenAI, Anthropic, Google, Mistral, DeepSeek, or other supported providers based on your configuration; (c) Payment processor — paid plan billing is handled through a PCI-compliant payment provider; we do not store full payment card details. Each third-party service operates under its own privacy policy. We are not responsible for their data practices.
12. Contact and Changes
For privacy-related questions or to exercise your KVKK rights, contact us at: Faydabul Bilişim Teknolojileri, Sancak Mahallesi 1609 Nolu Sokak 11/F Yomra Trabzon, Türkiye. Email: hello@faydabul.com. Phone: +90 538 704 6131. We may update this policy as the product evolves or as legal requirements change. Material changes will be announced through the platform and, where required, we will obtain your renewed consent.