Privacy Policy

The data controller under this policy is Kelyvaro. For any request concerning your personal data, write to info@kelyvaro.com.

Kelyvaro is currently pre-launch. At this stage only waitlist data is collected; the product-related processing described below applies once the service opens and only to users who create an account.

• Email address. When you join the waitlist we record your email address, your language preference, the country you are interested in, which page the signup came from and any campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term).
• Profile information. The work experience, education, language level, visa and residence status, preferred cities and working arrangement you enter when you open an account.
• CV content. The CV files you upload and the CV and cover letter text Kelyvaro produces for each listing.
• Application records. Which listing you applied to, the status of the application and the status of any employer response.
• Gmail send permission. If you choose to connect your Google account so applications go out from your own address, only the permission to send mail on your behalf (gmail.send) is requested. It does not allow reading, searching or deleting your inbox.
• Technical data. Session information, IP address and browser information needed to operate the service securely.

We process your data only to find listings that fit you, to prepare a CV and cover letter for each listing, to send an application once you approve it, to show the process in your dashboard, to keep the service secure and to meet our legal obligations.

The legal basis is, under KVKK, the formation and performance of a contract together with your explicit consent; under the GDPR, performance of a contract (Art. 6(1)(b)), explicit consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f)).

We do not use your data for advertising, do not sell it to third parties, and do not commercialise your profile for any purpose outside Kelyvaro.

The permissions granted when you connect your Google account are used only to send the applications you have approved, from your address. This data is not used for advertising, is not read by humans (except where required by law, for security investigation, or at your explicit request) and is not transferred to any other application.

Kelyvaro's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke the connection at any time from your Google account security settings or from the Kelyvaro dashboard.

We share your data only with the service providers required to run the service. They act as data processors and may not use your data for their own purposes:

• Hosting and delivery: Vercel Inc. (serving the application)
• Database and authentication: Supabase Inc. (account and profile data)
• Abuse prevention: Upstash Inc. (a short-lived derivative of the IP address, for rate limiting)
• Measurement and advertising: Google LLC (GA4) and Meta Platforms, Inc.; only if you accepted cookies
• Email delivery: application emails are sent through your own Google account; an email infrastructure provider is used for notification emails
• AI text generation: a model provider for producing CVs and cover letters; content sent to that provider is not used for model training

Some of these providers may host servers outside the European Union. In that case transfers are made under standard contractual clauses (SCCs) and in line with KVKK rules on international transfers. Data may also be shared with competent public authorities where legally required.

• Waitlist record: until the service launches, and no longer than twenty-four months. If you ask to be removed, your record is deleted immediately.
• Account, profile and CV data: for as long as your account is open. When you delete your account, this data is permanently deleted within thirty days at the latest.
• Application records: deleted along with your account.
• Google permission: access tokens are revoked and deleted the moment you disconnect.
• Records subject to a statutory retention obligation (for example invoices and payment records) are kept for the period the relevant legislation requires.

Under Article 11 of the KVKK and Articles 15–22 of the GDPR you have the right to learn whether your data is being processed, to access it and request a copy, to have inaccurate or incomplete data corrected, to request erasure, to request restriction of processing, to receive your data in a portable format, to object to processing and to withdraw consent you have given.

You may also object where a decision based solely on automated processing produces an adverse effect on you. No application is ever sent from Kelyvaro without your approval, so the decision in the process always remains yours.

Send requests to info@kelyvaro.com; we respond within thirty days at the latest. If you are not satisfied with the outcome, you may complain to the Personal Data Protection Authority in Turkey or, in the European Union, to the supervisory authority of your country.

Kelyvaro uses the cookies strictly necessary to run the service: the session cookie that keeps you signed in and a cookie remembering your language preference. These do not require consent.

Beyond those, measurement and advertising cookies run only if you give explicit consent in the cookie bar shown on your first visit. If you decline, Google Analytics and Meta Pixel are never loaded and no request goes from your browser to those parties; the site keeps working exactly the same. Your choice is stored only in your own browser and you can change it by clearing your browser data.

We use no profiling cookies.

Data is protected with TLS in transit and encryption at rest. Access rights are role-based and logged. Even so, no system is entirely secure; if a breach affecting your personal data occurs, we will notify you and the competent authorities within the period the relevant legislation requires.

We may update this policy as the service changes. When a material change is made, we send a notice to your registered email address. The date at the top of the page shows when it was last updated.