Privacy Policy
Last updated: 11 September 2026Text version: 2026-09-11
This English version is provided for information only. The agreement is governed by Turkish law and the Turkish text prevails in case of any discrepancy.
1. Introduction and Our Roles
At YouReply Teknoloji Ticaret Eğitim Danışmanlık Araştırma Organizasyon A.Ş. ("YouReply", "the Company", "we"), this Privacy Policy explains how your personal data is collected, used, stored and protected when you use the YouReply Manage platform (the "Platform"). It has been prepared under Turkish Personal Data Protection Law no. 6698 (KVKK) and related legislation.
Two distinct roles apply. For your account information and Platform usage data, we are the data controller. For the project and task content you enter (brief text, task descriptions, comments, team member and stakeholder names), which may belong to your own research and clients, you are the data controller and we act only as a processor. It is your responsibility to ensure that such data was collected lawfully and that you have a legal basis for processing it.
The Platform does not host raw research data. Survey responses stay in YouReply Survey and analysis output in YouReply Analyze. The Platform does not accept file attachments; you can only add files as links.
2. Personal Data Processed
The table below shows which category of data is processed for which purpose and on what legal basis, how it is collected, who receives it and how long it is kept.
| Data category | Examples | Purpose | Legal basis | Collection | Recipients | Retention |
|---|---|---|---|---|---|---|
| Account and identity | Name, e-mail, phone, organization name, role | Account creation, session management, delivering the service | Formation and performance of the contract | Sign-up form; organization invitation | Hosting infrastructure; e-mail provider for transactional mail | While the account is open; anonymized on a deletion request |
| Project and task content | Brief text, task and subtask descriptions, comments, labels, dates | Delivering the service; running the project | The legal basis you rely on as controller (we are the processor) | User input | Hosting infrastructure | While the account is open; archiving a project does not delete it |
| Usage and activity records | IP address, browser information, access time, task and project change history | Security, incident investigation, traceability | Legitimate interest (security and continuity); legal obligation | Generated by the system | Hosting infrastructure | As long as the purpose requires |
| Contact form messages | Name, e-mail, phone (optional), subject, message | Answering your enquiry | Legitimate interest (responding to a request) | The form on the website | E-mail infrastructure provider (processor) | Not stored in the site database; kept in corporate mailboxes as long as needed |
| Billing and payment | Invoice title, address, tax details, order and payment records | Completing the sale and issuing invoices | Performance of the contract; legal obligation | Payment step | Payment institution; invoicing service provider | For the minimum period required by law |
| Database backups | Backups of account, project and billing records | Protection against data loss | Legitimate interest (business continuity) | Automated backup | The Company's own backup infrastructure | Deleted at the end of the retention period |
| Cookies and preferences | Language preference, cookie preference | Remembering your preference | Legitimate interest | Browser | Not shared | The periods in the Cookie Policy |
3. Purposes of Processing
- Account creation and authentication
- Delivering the project and task management service
- Providing customer support
- Billing and payment processing
- Keeping the Platform secure and investigating faults
- Meeting legal obligations
- Anonymous statistics about service usage
We do not send commercial electronic messages. Messages from the contact form are used only to answer your enquiry and are not added to a marketing list.
4. No Artificial Intelligence Is Used
YouReply Manage performs deterministic computation: calculations and thresholds are rules defined in source code. The content you enter is never sent to a language model or a third-party AI service. If you are looking for text analysis (reviews, open-ended answers, feedback), YouReply Intelligence is a separate product that does use language models; its own privacy policy explains that flow.
5. Sharing and Processors
Your personal data is not sold and is not shared with third parties for marketing. To deliver the service, the following providers may process personal data as processors on our behalf and on our instructions:
- Hosting infrastructure: account, project, usage and billing records
- E-mail infrastructure provider (Amazon Web Services, Amazon SES): transactional e-mail, contact form messages and verification codes
- Payment institution (iyzico): card payments
- Invoicing provider (Paraşüt): issuing invoices
- SMS provider (VatanSMS): phone verification codes in the central account
The current list and processing locations are published as a table on the security page.
Support access: to resolve a support request or investigate a fault, authorized staff can open a session on your behalf through a short-lived, single-use link. This access is not used for any other purpose.
Otherwise personal data is shared only in response to legal requests and court orders, or where you have given explicit consent.
6. International Transfers
Transfers are assessed per category of data:
- Project and account data: processed in our hosting infrastructure; not transferred to AI or third-party analysis services.
- E-mails: transactional e-mails, contact form messages and verification codes are sent through Amazon Web Services servers in the European Union (Frankfurt) region. This constitutes a transfer abroad.
- Payment: card details are processed directly in the infrastructure of the payment institution iyzico and are subject to iyzico's own privacy notice.
- Analytics: no analytics measurement is currently used on this site, so no transfer takes place for analytics.
- External content: the map on the contact page loads only when you choose "Load the map"; at that moment your IP address and browser information are sent to Google.
Transfers abroad are carried out in line with the conditions set out in Article 9 of KVKK. To ask which mechanism a transfer relies on, write to kvkk@youreply.com.tr.
7. Protection of Data
- TLS encryption in transit; HTTP requests are redirected to HTTPS and HSTS is applied
- Role-based access, enforced on the server
- Signed, short-lived session cookies; central sign-out applies to every product
- Database backups pulled by a separate server and integrity-checked
- Task and project changes recorded with who and when
The detail of the measures in place and what we do not offer yet are written openly on the security page.
8. Cookies
No non-essential cookie or script runs without your consent. For details see our Cookie Policy; you can change your choice at any time from the cookie preferences dialog.
9. Your Rights (under KVKK)
Under Article 11 of KVKK you have the right to:
- Learn whether your personal data is being processed
- Request information if it has been processed
- Learn the purpose of processing and whether it is used accordingly
- Know the third parties to whom it is transferred, domestically or abroad
- Request correction if it is incomplete or inaccurate
- Request erasure or destruction under Article 7 of KVKK
- Request that correction and erasure be notified to third parties it was transferred to
- Object to an adverse outcome arising from analysis carried out solely by automated systems
- Claim compensation for damages arising from unlawful processing
9.1 How to Apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply:
- In writing with a wet signature, in person or through a notary: Hacettepe Üniversitesi Teknoloji Geliştirme Bölgesi, Beytepe Kampüsü, 6. Ar-Ge Binası C Blok, Çankaya / Ankara
- With a secure electronic signature or mobile signature to kvkk@youreply.com.tr
- From the e-mail address registered in our system to the same address; we may ask for additional information to verify your identity
Your application is concluded within thirty days at the latest. Where the request incurs a cost, the fee set by the Board's tariff may be charged.
10. Retention, Deletion and Return
Your personal data is kept for as long as the purpose requires and within statutory retention obligations. In detail:
- Project content: projects are archived rather than deleted and can be restored. To have project content deleted, write to kvkk@youreply.com.tr.
- Account data: you can raise a deletion request from your central YouReply account; it has a seven-day undo window, after which the account record is anonymized.
- Invoice and payment records: kept for the minimum period required by law and are outside the scope of a deletion request.
- Data download: you can download your account data as a JSON file from the central account. There is no ready export for project content; write to our support team if you need one.
- Backups: copies of deleted records remain accessible only for restore purposes until the backup retention period ends.
11. Changes
We may update this policy from time to time. The text version and date at the top of the page show which version you are reading; you will be notified by e-mail of significant changes.
12. Contact
For questions about this policy and for KVKK applications, write to kvkk@youreply.com.tr.
Data controller: YouReply Teknoloji Ticaret Eğitim Danışmanlık Araştırma Organizasyon A.Ş.
Address: Hacettepe Üniversitesi Teknoloji Geliştirme Bölgesi, Beytepe Kampüsü, 6. Ar-Ge Binası C Blok, Çankaya / Ankara