Privacy Notice (GDPR)
Last updated: July 4, 2026
Effective for: www.kovan-ai.com and the Kovan platform
For where data lives, who can open it, and what the AI provider retains, read Data security. This notice covers legal rights.
1. Data Controller
Under the EU General Data Protection Regulation (“GDPR”) and, where applicable, Turkey’s Personal Data Protection Law No. 6698 (“KVKK”), the data controller is:
| Name | Bartu Atilla (sole proprietorship) — kovan-ai.com platform |
| Address | Cevizli Mah. Zühal Cad. A Ticari Blok Apt. No:46/50 Maltepe / Istanbul |
| hello@kovan-ai.com | |
| Web | https://www.kovan-ai.com |
You may submit requests regarding your personal data to hello@kovan-ai.com.
2. What Is Kovan?
Kovan is a B2B SaaS platform where early-stage startups use AI-powered assistants, shared memory, document management, analysis, image generation, and presentation creation. The service is provided through Founder accounts and team members (“Members”) who join by invitation.
3. Categories of Personal Data Processed
Depending on how you use the Platform, the following data may be processed:
3.1 Identity and contact
- First name, last name (or display name)
- Email address
- Account role (founder / member)
3.2 Transaction security
- Session information, authentication records
- IP address, browser/device information (log records)
- Password (stored only in hashed form; never stored in plain text)
3.3 Startup and business content
- Startup profile (name, sector, stage, problem, solution, target audience, etc.)
- Chat messages and session history
- Uploaded/created documents
- AI analysis insights, decision records
- Generated images and presentation content
- Team invitation details (invited email, assigned role/domain)
3.4 Usage and billing
- Plan type, usage counters (messages, analyses, images, presentations)
- Payment and invoice information (when paid plans are introduced; via the payment infrastructure)
3.5 Integration data (optional, when the Founder connects integrations)
- Google Analytics / Search Console summary metrics
- GitHub repository/metadata
- Stripe summary revenue metrics
Integration access keys are stored securely and used only for service delivery.
4. Purposes of Processing Personal Data
| Purpose | Description |
|---|---|
| Account and authentication | Registration, login, session management |
| Service delivery | AI assistant chat, shared memory, analysis, documents/images/presentations |
| Team management | Invitations, role assignment, access control |
| Security | Abuse prevention, logging |
| Legal obligation | Retention/notification required by law |
| Improvement | Service quality, bug fixing (anonymous/aggregate where possible) |
| Communication | Support, information, contractual notices |
5. Legal Bases (GDPR Art. 6; KVKK Arts. 5 and 6)
Your personal data is processed on the following legal bases:
- Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c): Account creation and delivery of platform services,
- Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç): Legal retention and official requests,
- Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f): Security, fraud prevention, service improvement (without overriding your fundamental rights and freedoms),
- Consent (GDPR Art. 6(1)(a); KVKK Art. 5/1): Non-essential integrations, marketing communications (separate consent is obtained)
6. Artificial Intelligence and Third-Party Service Providers
Kovan may use the following types of data processors to deliver the service:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, file storage |
| OpenAI | Chat, analysis, image generation, presentation text |
| Vercel | Application hosting |
| Resend | Transactional email (invitations, verification) |
| Google / GitHub / Stripe | Only when the Founder enables the integration |
Your chat and startup content is transmitted to the OpenAI API to generate AI responses. OpenAI servers may be located outside the EEA (e.g., the United States); such transfers occur as an inherent part of the service. Where applicable, contractual safeguards (Standard Contractual Clauses / data processing agreements) are used.
Only Growth plan and above Founder accounts (or accounts permitted under current plan terms) may connect integrations.
7. Transfers of Personal Data
Your data may be transferred to:
- The service providers listed above (as processors),
- Competent public authorities where required by law,
- Authorized Members within the same startup workspace under the Founder’s team invitation (role-based access), based on your consent or the Founder’s invitation framework
International transfers: Due to OpenAI and hosting/CDN services, your data may be processed on servers outside Turkey and/or the EEA. Transfers are carried out with appropriate administrative and technical measures under GDPR Chapter V, KVKK Art. 9, and applicable regulations.
8. Retention Periods
| Data | Period |
|---|---|
| Account information | While the account is active + up to 30 days after a deletion request |
| Chats and documents | Until the account/workspace is deleted or the user deletes them |
| Log records | 2 years (security and legal obligation) |
| Invoices/payments | 10 years (Turkish tax and commercial law, where applicable) |
| Pending/expired invitations | 90 days |
At the end of the retention period, data is deleted, destroyed, or anonymized.
9. Your Rights (GDPR; KVKK Art. 11)
Under the GDPR and, where applicable, KVKK Art. 11, you have the right to:
- Know whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used in line with that purpose,
- Know third parties to whom data is transferred domestically or abroad,
- Request correction if data is incomplete or inaccurate,
- Request erasure or destruction under GDPR Art. 17 / KVKK Art. 7,
- Request that correction/erasure be notified to third parties to whom data was transferred,
- Object to automated decision-making that produces legal or similarly significant effects concerning you,
- Lodge a complaint with a supervisory authority (e.g., your EU member state DPA or Turkey’s Personal Data Protection Authority),
- Claim compensation if you suffer damage due to unlawful processing
Requests: hello@kovan-ai.com — additional information may be requested to verify your identity. Requests are answered within 30 days where required by law.
Your right to complain to the relevant data protection authority remains unaffected.
10. Cookies and Similar Technologies
The Platform uses essential cookies to maintain sessions and security. If analytics/marketing cookies are used, separate notice and (where required) consent mechanisms are provided.
11. Security Measures
Kovan implements appropriate technical and organizational measures under GDPR Art. 32 and KVKK Art. 12, including access control, encryption in transit (TLS), role-based authorization, secure API key management, and vendor agreements.
12. Team Members and Founder Responsibility
- The Founder may be responsible for informing data subjects and establishing a lawful basis where startup business content (documents, chat context, etc.) contains third-party personal data.
- A Member may access only the assistant for their assigned domain; they cannot access chats in other domains.
13. Changes
This notice may be updated. Material changes will be announced via the platform or email. Current version: https://www.kovan-ai.com/gizlilik-kvkk
This notice is for general information purposes. Consult a lawyer regarding registry filings and final legal compliance.