Gizlilik Politikası / Privacy Notice

B. EU General Data Protection Regulation (GDPR) Notice

Articles 13/14 disclosure for data subjects in the European Economic Area.

B.1 Controller

ArchitectAPI AI Systems (Türkiye, address in Imprint) is the data controller for personal data described in this Notice.

EU Article 27 Representative: Not yet appointed (see Imprint). Until an EU Representative is designated, EEA data subjects may contact our Data Protection Officer at support@architectapi.com or their local supervisory authority directly.

B.2 Data We Collect (Article 13/14 categories)

Same categories as Section A.2 above (identity, contact, account, financial, digital footprint, customer content).

B.3 Lawful Bases (Article 6)

For purposes based on legitimate interest (Art. 6(1)(f)), our balancing test is available on request; you have the right to object (Art. 21).

B.4 Special Category Data (Article 9)

We do not knowingly process special category data (health, biometric, ethnic origin, religious belief, trade-union membership, genetic, sexual orientation). If your customer use of the platform involves such data (e.g. a healthcare customer uploading patient files), Art. 9(2) requires your separate lawful basis and an addendum to the DPA — please contact support@architectapi.com first.

B.5 International Transfers (Chapter V)

Personal data is transferred to non-EEA countries (Türkiye, USA) using:

• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) — primarily Module 2 (controller-to-processor) with our sub-processors;
• EU-U.S. Data Privacy Framework for DPF-certified processors (e.g. Stripe, Google, Anthropic, where applicable);
• Transfer Impact Assessments (Schrems II) documented and made available on request.

Türkiye is not subject to an EU adequacy decision; transfers to our Türkiye operations rely on Art. 49(1)(b) (necessary for performance of contract) and on SCCs where applicable. A copy of executed SCCs is available on request to support@architectapi.com.

B.6 Retention

See Section A.5; durations apply identically. Where Turkish tax law requires longer retention than GDPR's storage-limitation principle would allow, the longer Turkish-law period applies for the specific records covered by that obligation only.

B.7 Your GDPR Rights (Articles 15–22)

B.8 Exercising Your Rights / Lodging a Complaint

Email support@architectapi.com. We respond within one month (extensible by two further months for complex requests, with notice).

You have the right to lodge a complaint with a supervisory authority — typically the one in your EU country of residence. Find yours: edpb.europa.eu. Examples:

• Germany — local Land authority (e.g. BfDI, BlnBDI)
• Ireland — Data Protection Commission (dataprotection.ie)
• France — CNIL (cnil.fr)
• Netherlands — Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)

C. UK General Data Protection Regulation (UK GDPR) Notice

Applies to data subjects in the United Kingdom. Largely mirrors EU GDPR; key differences below.

C.1 Controller & UK Representative

Controller: ArchitectAPI AI Systems (Türkiye). UK Article 27 Representative: Not yet appointed (see Imprint). UK data subjects may contact support@architectapi.com directly while a Representative is being appointed.

C.2 Lawful Bases & Rights

Lawful bases under UK GDPR Art. 6, special category rules (Art. 9), and your rights (Art. 15–22) mirror Section B above. The supervisory authority is the Information Commissioner's Office (ICO) — ico.org.uk.

C.3 International Transfers from UK

Transfers from the UK to third countries use:

• UK International Data Transfer Agreement (IDTA) (ICO version), or
• UK Addendum to the EU SCCs issued under Section 119A Data Protection Act 2018, or
• UK Extension to the EU-U.S. Data Privacy Framework for DPF-certified recipients.

C.4 Direct Marketing — PECR

Where the Privacy and Electronic Communications Regulations (PECR) apply, we obtain prior consent for unsolicited marketing emails to UK individuals (the "soft opt-in" exemption applies to existing customers for similar products).

D. California Consumer Privacy Act (CCPA / CPRA) Notice

For California residents. Last 12-month disclosure required by Cal. Civ. Code § 1798.130.

D.1 "Do Not Sell or Share My Personal Information"

We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising. There is therefore no "Do Not Sell or Share" link required, but you may still submit an opt-out request via support@architectapi.com for completeness.

D.2 Categories of Personal Information Collected (last 12 months)

D.3 Your CCPA / CPRA Rights

D.4 Submitting a Verifiable Consumer Request

Email support@architectapi.com with subject line CCPA Request — [Your Name]. We verify identity by matching the request email with the email of record on your account; for non-account holders, additional verification may be required. We respond within 45 days (extensible by 45 days with notice). Authorized agents may submit on your behalf with a written authorization.

D.5 Financial Incentive Disclosure

We do not offer financial incentives in exchange for personal information.

D.6 Shine the Light (California Civil Code § 1798.83)

We do not share personal information with third parties for their direct marketing purposes.

E. Çocukların Gizliliği / Children's Privacy

E.1 Age Restrictions / Yaş Sınırları

• Türkiye (KVKK): Hizmetimiz 18 yaş ve üzeri profesyoneller / işletmeler için tasarlanmıştır. 18 yaş altı bireylerden bilerek veri toplamayız. (Türk Medeni Kanunu m.10 — reşitlik 18 yaş)
• EU GDPR Art. 8: Information society services require consent of a parent/guardian for children under 16 (member states may lower to 13). We do not target our services at children.
• UK GDPR + Age Appropriate Design Code (ICO): ICO's "Children's Code" applies to services likely accessed by children. Our service is B2B and not directed at children under 18.
• USA — COPPA (Children's Online Privacy Protection Act): We do not knowingly collect personal information from children under 13. If we learn we have, we will promptly delete it.

E.2 Reporting / Bildirim

If you believe a child has provided personal information to us / Çocuğunuzun bize kişisel veri verdiğini düşünüyorsanız: support@architectapi.com · Konu: Children's Privacy. We will investigate and delete within 30 days.

F. Çerez Politikası / Cookie Policy

Web sitemizde aşağıdaki çerez kategorileri kullanılır. Tercihlerinizi Çerez Tercihleri panelinden her zaman güncelleyebilirsiniz.

F.1 Çerez Kategorileri / Cookie Categories

• Zorunlu / Strictly Necessary: Oturum yönetimi, CSRF koruması, çerez tercih kaydı. Devre dışı bırakılamaz.
• Analitik / Analytics (Google Analytics): Anonimleştirilmiş istatistikler. IP anonimleştirilmiş; yalnızca açık onayınızla.
• Pazarlama / Marketing: Şu an aktif değil. İleride etkinleştirilirse yeniden onay alınır.
• Tercihler / Preferences: Dil ve UI ayarları.

F.2 Kullanılan Çerezlerin Detayı / Cookie Inventory

F.3 Tercihlerinizi Yönetme / Managing Your Choices

Sayfanın sol-alt köşesinde her zaman görünen "Çerez Tercihleri" butonuna tıklayın. Çerez politikamız değişirse versiyonu yenilenir ve sizden yeniden onay istenir. Her tercih değişikliğiniz, kanıt amacıyla anonim biçimde sunucumuza kaydedilir (KVKK m.5/6 — açık rıza kanıtı; GDPR Art. 7(1) — ability to demonstrate consent).