Skip to content

KVKK information notice

On this page9 sections · 6 min read

Version 2026-11-11. The consent box on the application form is tied to this version.

Turkish consumer law notice

This page is an English translation of the Turkish page /kvkk/, which is the original text and is written under Turkish law.

Data controller

The data controller is VitrinAI Digital Studio (vitrinai.co). Contact: [email protected]. Requests are answered through this address.

Personal data processed

  • Identity: name (when signing in with Google or GitHub).
  • Contact: e-mail address.
  • Customer transaction: your role and document type (application form), your jobs, your usage and cost records. When buying is open: payment amount, date and status.
  • Invoice: when buying is open, name or company name, address and, if any, tax ID number for the invoice.
  • Transaction security: session record, browser information, salted digest of the IP address, confirmation time and version.
  • Your documents: the content of the documents you upload and the video, audio and video produced from it. The document may contain personal data of third persons; for that data you or your organisation is the data controller and Zıpır works only on your instruction as the processor (your declaration in the terms of use is the basis of this role). This information notice describes the data for which Zıpır is itself the data controller; the duty to inform the persons in the document is yours as data controller.
  • Test participant (only if the video owner turns the test on): the first and last name the test taker writes, their score, time and the verification code given to those who pass. For this data you or your organisation, as the one sharing the video, is the data controller, and Zıpır is the processor that serves the test and the document on your instruction; the short notice for the test taker is written on the test page. Zıpır does not use this data for any other purpose.

Purposes of processing

  • To receive and answer an access request.
  • To open your account, run your session and verify the sign-in link.
  • To make a video from your document, verify it against the source, narrate it, and prepare the video and the proof report.
  • To investigate unauthorised copying and abuse through the technical identifier in the videos produced (legitimate interest).
  • To prevent abuse and excessive load, to apply spending caps, to find errors.
  • To fulfil legal obligations.

Legal bases

  • Establishment or performance of a contract (art. 5/2-c): account and session data, your documents and what we produce, usage and minutes records, payment data when buying is open.
  • Legal obligation (art. 5/2-ç): invoice and payment records and their retention period in legislation.
  • Legitimate interest (art. 5/2-f): session security, the salted digest of the IP address, prevention of abuse, spending caps, the technical identifier in videos. Our interest is the security of the service and the prevention of abuse; we do not use this data for any other purpose.
  • Application: your sending the form is a request that we process it to answer your application (art. 5/2-c). The consent box is a declaration that you have read the information notice; it is not explicit consent to the processing of data.

Method of collection

By electronic means: the application form on zipirapp.com, the app.zipirapp.com panel (upload, editing, account), the Google and GitHub sign-in providers and the records the servers keep automatically.

Transfer

Your personal data is transferred only to the following groups of recipients, only to provide the service:

  • Cloud hosting provider (Europe): application servers, database, job queue and server logs.
  • Database and file storage service (Europe): videos, audio clips and uploaded documents.
  • AI model providers (USA): text passages chosen from the document; the providers' terms forbid training models on customer data.
  • Narration voice provider (USA): scene sentences only; no document file, user ID or e-mail address goes.
  • Transactional e-mail provider (EU): the recipient address and the e-mail text for sign-in links, account confirmations and administrator alerts.
  • Payment institution (USA; only when buying is open): name or company name, e-mail address, billing address, tax ID number if any, and card details.
  • Error monitoring service (USA; when enabled): error reports with e-mail, tokens, IP and document content stripped out.

Detail: privacy page. No transfer to a third person inside the country is made.

All of these recipients are abroad: hosting and file storage are in data centres in Europe, and their companies are abroad. The transfer is made to perform the service. Only the data needed to provide the service goes to the recipient: text passages chosen from the document to the model provider, narration sentences to the voice providers, the recipient address and the text of the e-mail to the e-mail provider, payment and invoice information to the payment provider. Your rights and how to apply are below, in the Your rights section.

Retention period

Your documents and what we produce stay until you delete them; deletion is done from the panel. What is deleted and what remains is written line by line on the privacy page. We keep the remaining records for the following periods:

  • Source document and what is made from it (video text, audio, video, proof report): Until you delete it.
  • Application records: 12 months.
  • Session records: 30 days.
  • Usage and cost records and audit records: 24 months.
  • Page-count rows (only the daily totals remain): 90 days.
  • Test results and attendance certificates (only if the video owner turned the test on): As long as the video's share link is open; deleted immediately when the link is closed, and within one hour at the latest when it expires.
  • Payment records (amount, date, status; we do not hold card details): For the retention period in tax and commercial law.

Backups are taken daily and kept for 7 days; a copy of a record you deleted also drops out of the backups at the end of that period.

Your rights (KVKK art. 11)

To learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of the processing and whether it is used in line with its purpose; to know the third persons to whom it is transferred inside or outside the country; to request correction if it is incomplete or wrongly processed; to request its deletion or destruction within the conditions of art. 7; to request that correction and deletion be notified to the third persons to whom the data was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to request compensation if you suffer damage because of unlawful processing.

Application: write to [email protected] from the e-mail address in your account. We answer your application free of charge within 30 days at the latest, depending on the nature of the request; if the procedure requires a separate cost, the fee in the tariff set by the Board may be charged.

If you have an account, you see and delete most of your data yourself in the panel: your jobs in My jobs, your account on the Account page.