Privacy Policy

The data controller under this policy is Halil İbrahim Örkcü (Kelyvaro). Identity and contact details are at the top of this page; for any request concerning your personal data, write to info@kelyvaro.com.

When you open an account we process your profile data (education, experience, languages, skills, visa status and job preferences) and use it to find listings that fit you. Per-listing CV generation and application sending run only when you use those features: CV files when you create them, application records when you prepare an application, and the Gmail send permission when you connect your account. No application is ever sent without your approval.

Collected today:

• Email address and account. When you open an account, your email address and an irreversible hash of your password are held in Supabase authentication; the password itself is never stored.
• Campaign data. If you arrived through an advertising link, the campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term) are stored with your account. This is kept only to see which promotion works and is not sent to third parties.
• Consent record. The moment you accept the Privacy Policy and Terms of Use at signup, and the version of the text you accepted.
• Profile information. What you enter during onboarding: first and last name, year of birth, nationality, country and city you live in, phone, LinkedIn/portfolio URLs, a short summary; your profile photo if you upload one; education and work history; language levels and certificates; skill tags; passport country, EU work permit status, degree recognition (Anerkennung) status; target countries and target job titles, preferred working arrangement.
• Technical data. Session cookie, IP address and browser information needed to operate the service securely. On the signup and password reset endpoints your IP address is held in a short-lived counter to prevent abuse.
• Generated CV. When you press "generate CV", your profile is sent to an AI model provider and the resulting German CV text is stored in your account. You start that transfer yourself; your profile is never sent automatically. The provider does not use the content for model training.
• Password safety check. We check whether the password you choose appears in known data breaches. The check uses k-anonymity: the SHA-1 hash of your password is computed on our server and only the first five characters of that hash leave it. Your password and its full hash never leave our server.

Not collected yet (each will start when the related feature opens):

• CV files you upload, and the CV and cover letter text produced for each individual listing.
• Application records: which listing you applied to, the status of the application and the status of any employer response.
• Gmail send permission. If you choose to connect your Google account so applications go out from your own address, only the permission to send mail on your behalf (gmail.send) is requested. It does not allow reading, searching or deleting your inbox.

We process your data only to find listings that fit you, to prepare a CV and cover letter for each listing, to send an application once you approve it, to show the process in your dashboard, to keep the service secure and to meet our legal obligations.

The legal basis is, under KVKK, the formation and performance of a contract together with your explicit consent; under the GDPR, performance of a contract (Art. 6(1)(b)), explicit consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f)).

We do not use your data for advertising, do not sell it to third parties, and do not commercialise your profile for any purpose outside Kelyvaro.

The permissions granted when you connect your Google account are used only to send the applications you have approved, from your address. This data is not used for advertising, is not read by humans (except where required by law, for security investigation, or at your explicit request) and is not transferred to any other application.

Kelyvaro's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can revoke the connection at any time from your Google account security settings or from the Kelyvaro dashboard.

We share your data only with the service providers required to run the service. They act as data processors and may not use your data for their own purposes:

• Hosting and delivery: Vercel Inc. (serving the application)
• Database and authentication: Supabase Inc. (account and profile data)
• Abuse prevention: Upstash Inc. (a short-lived derivative of the IP address, for rate limiting)
• Measurement and advertising: Google LLC (GA4) and Meta Platforms, Inc.; only if you accepted cookies
• Email delivery: application emails are sent through your own Google account; an email infrastructure provider is used for notification emails
• AI text generation: Groq, Inc. (USA) for the German CV text; what is sent is the text parts of your profile (experience, education, documents, languages, skills, name, city) — phone, email and photo are not sent; the provider does not use this content for model training. The application email is written from a template and never goes to the AI

Some of these providers may host servers outside the European Union. In that case transfers are made under standard contractual clauses (SCCs) and in line with KVKK rules on international transfers. Data may also be shared with competent public authorities where legally required.

• Waitlist record, if you joined the list earlier: no longer than twenty-four months. If you ask to be removed, your record is deleted immediately.
• Account, profile and CV data: for as long as your account is open. When you delete your account, this data is permanently deleted within thirty days at the latest.
• Application records: deleted along with your account.
• Google permission: access tokens are revoked and deleted the moment you disconnect.
• Records subject to a statutory retention obligation (for example invoices and payment records) are kept for the period the relevant legislation requires.

Under Article 11 of the KVKK and Articles 15–22 of the GDPR you have the right to learn whether your data is being processed, to access it and request a copy, to have inaccurate or incomplete data corrected, to request erasure, to request restriction of processing, to receive your data in a portable format, to object to processing and to withdraw consent you have given.

Three of these you can exercise yourself from the dashboard: correct any field from the Profile page; use "Download my data" in Settings to get every record you hold with us as a single machine-readable JSON file; use "Delete my account" to open a deletion request. Opening a request closes your account and permanently deletes it within thirty days — log in during that window to cancel it.

You may also object where a decision based solely on automated processing produces an adverse effect on you. No application is ever sent from Kelyvaro without your approval, so the decision in the process always remains yours.

Send requests to info@kelyvaro.com; we respond within thirty days at the latest. If you are not satisfied with the outcome, you may complain to the Personal Data Protection Authority in Turkey or, in the European Union, to the supervisory authority of your country.

Kelyvaro uses the cookies strictly necessary to run the service: the session cookie that keeps you signed in and a cookie remembering your language preference. These do not require consent.

Beyond those, measurement and advertising cookies run only if you give explicit consent in the cookie bar shown on your first visit. If you decline, Google Analytics and Meta Pixel are never loaded and no request goes from your browser to those parties; the site keeps working exactly the same. Your choice is stored only in your own browser and you can change it by clearing your browser data.

We use no profiling cookies.

Data is protected with TLS in transit and encryption at rest. Access rights are role-based and logged. Even so, no system is entirely secure; if a breach affecting your personal data occurs, we will notify you and the competent authorities within the period the relevant legislation requires.

We may update this policy as the service changes. When a material change is made, we send a notice to your registered email address. The date at the top of the page shows when it was last updated.