Version 1
The data controller is KIRIMLI TEKNOLOJİ LİMİTED ŞİRKETİ, Yakuplu Mah. Hürriyet Bul. Skyport Residence NO: 1 Kat: 10 İç Kapı NO: 113 BEYLİKDÜZÜ / İSTANBUL, Türkiye.
For any request about your personal data, write to support@doculiq.com.
DocuLiq is not directed to anyone under 18. This age rule is about the account holder: documents that an adult uploads may contain data about children.
| Data | Purpose | Where it is kept | How long | Legal basis |
|---|---|---|---|---|
| Account: email address, display name, account identifier and, if you sign in with a password, that password (Google keeps it in hashed form). When you sign up or sign in, the authentication service also logs your IP address and your browser or device details | Opening your account, identifying you and keeping your sign-in secure | Our authentication service; in a team workspace, the member list (email address and display name) | Until you delete your account; Google states that it keeps the logged IP addresses for a few weeks | Performance of the contract; for the IP address and the browser or device details, legitimate interest: account security |
| Data we receive when you sign in with Apple, Google or Microsoft: your name, your email address (with Apple's "Hide My Email", a relay address) and your account identifier at that provider. We do not keep the provider's sign-in token. In the desktop app, sign-in with Microsoft and, on Windows, sign-in with Apple are completed through our server: the one-time sign-in code the provider issues and, the first time you sign in with Apple on Windows, the name and email address Apple sends pass through our server on their way to our authentication service; our server does not store them | Letting you sign in with the provider you choose | Our authentication service | Until you delete your account | Performance of the contract |
| A sign-up that was never completed (the email code was never confirmed): email address, account identifier and what a sign-in provider passed on | Letting you finish the sign-up you started | Our authentication service | Deleted by a daily clean-up once the sign-up and the last sign-in are more than 7 days old | Steps taken before entering into the contract |
| Profile photo | Showing your profile | Our file storage | Until you change it or delete your account | Performance of the contract |
| Your documents, their previews and details (name, original file name, type) | Storing and showing your documents, letting you share them and providing the features you use | Our file storage and database | Until you delete them. Deleted documents stay in the Bin for 7 days (Free), 30 days (Pro, Team, and Business personal workspace) or 90 days (Business team workspace), then are deleted permanently. A document recognised as a health or criminal-record document whose uploader has not given the explicit consent is deleted 7 days after notice (section 5). On the Free plan, the documents in the personal workspace of an account not signed in to for 180 days are deleted 30 days after an email warning (section 7) | Performance of the contract; for other people's ordinary personal data in them, our legitimate interest in providing the service you asked for; for your own special-category data in them, your explicit consent (section 5); for another person's special-category data in them, that person's explicit consent, given through you, or your being their legal representative (section 5). If you act in a professional or commercial capacity, we process other people's data as your processor instead (section 4) |
| Content derived from your documents: extracted text (OCR), summaries, risk reviews, extracted information, the search index, and passage vectors used to pick the relevant passages for document chat | Making your documents searchable and providing the AI features | Our database | Deleted together with the document and with your account | The same as for your documents (row above) |
| A record that a document was recognised as a health or criminal-record document: the document's and the uploader's identifiers, which of the two was recognised and, where there is no explicit consent, the date the document will be deleted | Finding a recognised document that has no explicit consent, notifying its uploader and the workspace owner and admins, and deleting it on time | Our database | Deleted with the document, or at once when the document's text is no longer recognised | Your explicit consent (section 5); where there is none, legal obligation: not keeping special-category data without explicit consent |
| Reminders, tasks, notes and lists | Letting you keep track of your deadlines and tasks | Our database | Until you delete them or permanently delete the document they belong to; a reminder is deleted 1 day after its due date. On the Free plan, those in the personal workspace of an account not signed in to for 180 days are deleted together with the documents (section 7) | Performance of the contract |
| Audio recordings you upload for transcription | Transcribing the recording | Our file storage | The converted copy is deleted after processing; the uploaded original is removed automatically after about 1 day | The same as for your documents (above) |
| Results of a request (for example a transcript or a chat answer), kept so a repeated request is not charged twice | Keeping a repeated request from being charged twice | Our database | 24 hours | Performance of the contract |
| Sign-in codes sent by email | Verifying your sign-in | Our database | 5 minutes, or until used | Legitimate interest: account security |
| Trusted devices (device name, platform, dates) | Skipping the code on a device you trust and verifying a device we do not know | Our database | 90 days after last use | Legitimate interest: account security |
| Security and abuse counters (kept under your account identifier, or under your IP address before you sign in) | Stopping abuse and overload | Our database | From minutes to 40 days | Legitimate interest: preventing abuse |
| Team invitations (the invitee's email address) | Delivering the invitation and letting it be accepted | Our database | 7 days | Performance of the contract |
| Team workspace activity log (who did what) | Being able to show who did what in the workspace | Our database | 365 days | Legitimate interest: security and evidence |
| Purchase records (account identifier, product, event, store country; for a purchase on our website, Paddle's subscription and transaction identifiers; for a purchase in the App Store or Google Play, the store's transaction or order identifier) | Applying your plan and purchases to your account | Our database | 400 days, even after account deletion | Performance of the contract; legitimate interest: applying each purchase only once and tracing a plan change back to the purchase behind it. These are not accounting records; the store keeps those and, for a purchase on our website, Paddle does |
| The link between your account and your App Store or Google Play purchases (your store purchase token, the store's original purchase identifier, your account identifier) | Applying a store purchase and its renewals, refunds and cancellations to your account, and refusing a purchase that is already linked to another DocuLiq account | Our database | Until you delete your account | Performance of the contract |
| Your purchase status on our website: the record of the information sent before a purchase (product, the price shown to you, when it was sent and its language), when you withdrew from a subscription or ended it with a refund inside the withdrawal period, and whether purchases are closed for this account | Being able to show that the purchase information we email you before you pay was sent; making sure purchases are not abused (repeated buying and refunding, payment disputes) | Our database | Until you delete your account (the last 20 notice records and the last 20 early endings) | Legal obligation: pre-contract information for distance contracts and proof of it; legitimate interest: preventing abuse of payments |
| Usage records (section 8) | Running the service, showing you your usage, improving the product and measuring growth (section 8) | Our database and our internal reporting archive (a copy of these records, from which we build our reports) | 400 days (about 13 months) | Legitimate interest: operating the service, showing paying customers their own usage, understanding how the product is used and improving it, and measuring growth and retention |
| Country and region signals captured at first sign-in (store country, device region, time zone), the country if you later change it yourself, and your language preference | Choosing the service region and the language; in the web version, checking from your browser's time zone that you register from a country where we offer the service (today Türkiye only) | Our database | Until you delete your account | Entering into and performing the contract: choosing the service region and the language, checking the country where the service is offered |
| Your acceptance, permission and consent record: each time you accept the Terms of Use, give or take back the AI data sharing permission, are presented with this notice or the AI Notice, or give or withdraw the explicit consent, we record what happened, which text, version and language it concerned, when and on which screen; for the first screen, also which version of its wording you saw | Being able to show what you accepted, permitted or consented to, and when | Our database | While your account is open, and for 5 more years after you delete it (section 7) | Legal obligation: proof of your explicit consent and that this notice was presented; legitimate interest: evidence of your acceptance of the Terms of Use and of the permission; after you delete your account: establishing, exercising or defending legal claims |
| Support messages and AI answer feedback (your name, email address, account identifier and message; for feedback, the option you chose — helpful, wrong or harmful — the screen it came from and the document's identifier, never the answer's text) | Answering your request and monitoring the quality of AI results | Our support mailbox (Google Workspace) | 12 months after the last message about your request; deleted in the monthly clean-up that follows | Legitimate interest and performance of the contract |
| Application logs (account and workspace identifiers, partly masked email addresses, request details such as your IP address) | Finding errors and investigating security incidents | Our logging service | 30 days | Legitimate interest: security and fixing errors |
| Download archives you request (a ZIP of your documents) and files still being uploaded | Preparing the download you asked for and completing an upload | Our file storage | 1 day; a download link works for 30 minutes | Performance of the contract |
| A pending account deletion request (email address) | Having you confirm your deletion request and completing it | Our database | 30 minutes; after deletion, a marker without your email address for 7 days | Performance of the contract |
| Data the app keeps on your device (in the web version, in your browser's local storage): your sign-in session, your settings, temporary copies of documents you open, a trusted-device token and the AI data sharing permission. In the web version, Google reCAPTCHA, which checks that a request comes from a real browser, sets its own cookie. We set no advertising or analytics cookies | Remembering your session and settings, opening the app quickly and checking that requests come from a real browser | Your device or browser | Until you sign out or remove the app's data. The trusted-device token (until it expires or you remove the device) and the AI permission (until you take it back in Profile > Legal) stay after sign-out | Performance of the contract; legitimate interest: account security |
| Diagnostic data that Google's Firebase software in the app sends to Google: software version, client type, which service was called and how it performed. It is not linked to your account and is not used to track you | Letting Google monitor that its software works correctly | We do not keep it; Google's published disclosures give its periods | Legitimate interest: operating the service |
We collect this data from you (what you enter and upload), from your device and the app (technical and usage data), from the sign-in provider you choose (Apple, Google or Microsoft) and, for your purchases, from Paddle if you buy on our website, or from Apple or Google if you buy in the App Store or Google Play.
How we collect it: this data is collected electronically, through the app and our website, by fully or partly automated means.
The legal bases in the table correspond to these provisions of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies to you, of the EU General Data Protection Regulation (GDPR): entering into or performing the contract, including steps taken before it — KVKK Article 5/2-c, GDPR Article 6(1)(b); legal obligation — KVKK Article 5/2-ç, GDPR Article 6(1)(c); establishing, exercising or defending legal claims — KVKK Article 5/2-e, GDPR Articles 6(1)(f) and 17(3)(e); legitimate interest — KVKK Article 5/2-f, GDPR Article 6(1)(f); explicit consent for special categories of data — KVKK Article 6/3-a, GDPR Article 9(2)(a).
Your email address and sign-in details are needed to open an account and use the service; without them an account cannot be opened. Uploading a document is your choice. The explicit consent is optional; not giving it does not affect your account or your other documents (section 5).
We do not collect card or payment details. The seller of a purchase on our website is Paddle, our authorised reseller: you give your email address, billing details and payment details to Paddle directly on the checkout, and we never see your card data. From us, Paddle receives only your purchase identifier, which contains your account identifier, and the product you buy. In the web version, when you open the purchase screen, the prices and the checkout are loaded from Paddle: your browser connects to Paddle, Paddle sees your IP address and sets the price and tax by the country you are in; the app does not connect to Paddle unless you open the purchase screen. A purchase in the App Store or Google Play is processed by Apple or Google in its own store. To apply it to your account, the app gives the store a random purchase token that we derive from your account; it does not contain your account identifier and cannot be turned back into it. The store returns the token with the purchase, and our server then asks Apple's or Google's server to confirm the purchase and its status (renewal, refund or cancellation).
The following are located on Google Cloud in the European Union: our database, our file storage, our server functions, document conversion, speech-to-text, and our internal reporting archive with the reports built from it.
Text recognition and the AI features also run on European Union endpoints:
DocuLiq's features are built on these AI services. The first screen the app shows after you sign in tells you so, and one button on it does three things together: you allow your document content (file text, page images and audio recordings, including any personal data in them) and your questions to be sent to them (Gemini on Vertex AI, Cloud Vision and Speech-to-Text), you accept the Terms of Use and you declare your age. This permission is part of the service we provide under the Terms of Use; it is not an explicit consent, and it does not replace the separate explicit consent for special-category data (section 5), which has its own switch above the button on the same screen. This notice and the AI Notice are linked on that screen for your information; you are not asked to accept them. Until you tap the button the app does not open and sends nothing to these services; from that screen you can only sign out or delete your account (Terms of Use, section 3).
The screen is shown once for your account on each device, and the device remembers the permission, even after you sign out. It is shown again when a new version of the Terms of Use takes effect, when we add an AI service or a recipient or start sending a new kind of data to them, and when you take the permission back. You can take it back at any time in Profile > Legal: from that moment the app starts no text recognition, transcription or AI request from that device, and it stays closed there until you allow it again. A request that had already been sent may still finish.
Our systems do not send your documents themselves — the file, its extracted text, page images and audio recordings — outside the European Union. There are three exceptions:
Some processing still takes place outside the European Union:
We are established in Türkiye, and none of these systems is in Türkiye. Your data is therefore stored and processed by these systems outside Türkiye: in the European Union and, for the services listed above, in the United States or wherever the provider's global service runs. The only processing in Türkiye is our own access to your data, described above.
We use service providers who process data on our behalf: Google (cloud infrastructure, authentication, AI, text recognition, speech-to-text, the emails we send you and our support mailbox, logging, web hosting). Paddle, our authorised reseller, processes a purchase you make on our website, the details you give it and the purchase identifier it receives from us under its own terms, as an independent controller, and tells us about purchase, subscription and refund events; you exercise your rights over your data at Paddle in the way Paddle's privacy notice describes. Apple and Google process your store purchases as independent controllers under their own terms; they receive from us only the purchase token described in section 2, and our server asks them only about a purchase made in their store. On iOS, Android and macOS the app asks your device's store for its prices when it starts, even if you never buy anything; that request goes from your device to Apple or Google. If you sign in with Apple, Google or Microsoft, that provider confirms your identity in your own account with it, as an independent controller under its own terms; with Apple's "Hide My Email", the emails we send you pass through Apple's relay. Device and browser integrity checks (App Check) are performed by Apple and Google; on the web, by Google reCAPTCHA. Document conversion runs on our own infrastructure.
Google provides the cloud services named in section 3, and our email service (the sending account and the support mailbox), under the Google Cloud Data Processing Addendum, which binds Google to give your data the same or equivalent protection as this notice describes.
What Google does with AI inputs: Google states in its Vertex AI documentation that it does not use content sent to its Gemini models to train or fine-tune its models without the customer's permission or instruction. Google may keep inputs and results in memory for up to 24 hours to answer faster. If Google's automated safety systems flag a request as possible abuse of its service, Google may log that request for up to 90 days, in the same region, and authorised Google staff may review it.
When you delete your DocuLiq account, we also delete the link between your account and your store purchases; deleting the account does not end a subscription bought in the App Store or Google Play, which you manage in the store. We cancel a subscription bought on our website at Paddle; as the seller, Paddle keeps its own sales and invoice records under its own terms.
We do not sell your data. DocuLiq contains no third-party analytics or advertising SDK, shows no advertising, uses no advertising identifier and does not track you across other companies' apps or websites. It does no marketing measurement: it does not record which campaign or store link your account came from.
How we protect your data: connections between the app and our systems are encrypted; Google Cloud encrypts the data it stores for us; access to documents follows your role in the workspace; a sign-in from a device we do not yet trust is confirmed with a code sent to your email address; an integrity check (App Check) helps confirm that requests come from a genuine copy of the app; and document names and contents are never written to our logs.
In a team workspace, the documents and content you add are visible to the other members of that workspace. The app tells you this before your first upload to a team workspace, and the invitation to join one says so too.
Who is the controller: for your account, your usage and purchase records and the security records listed in section 2, we are the controller. Documents often contain personal data of other people, such as the other party to a contract. If you use DocuLiq privately, we are the controller of that data too: we process other people's ordinary personal data on the basis of our legitimate interest in providing the service you asked for, and their special-category data on the ground section 5 names. If you use DocuLiq in a professional or commercial capacity, you are the controller of that data and we process it on your behalf, as your processor, in every workspace (Terms of Use, section 11). In a team workspace the controller is the workspace owner, who decides which documents are kept there and who can see them.
The law gives special protection to some kinds of personal data ("special categories"): data about health, criminal convictions and security measures, race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, sexual life, and biometric and genetic data. You are not required to upload documents that contain such data.
DocuLiq processes your own data of these kinds on the basis of one separate, optional explicit consent (the Explicit Consent text). The consent covers every special category and every step: storing the document, text recognition (Cloud Vision), audio transcription (Speech-to-Text) and the AI features (Gemini on Vertex AI). You give it with the explicit consent switch, which is on the first screen the app shows after you sign in, above its button, and in Profile > Legal. The switch is off unless you have turned it on. The button on the first screen works the same whether the switch is on or off, and a switch you leave off is not recorded. The app does not ask again before an upload. You can turn the switch on or off at any time in Profile > Legal; the change takes effect at once. The consent counts only for the version of the text in effect; when a new version takes effect, the switch goes back to off and the consent must be given again. A new version only stops the AI features: a consent you gave and have not withdrawn still covers keeping your documents, and they are not deleted for this reason.
Other people's data: the switch is not a consent given on their behalf. If you use DocuLiq privately and a document you upload contains special-category data about another person (for example a family member's medical report), we process that data on the basis of that person's own explicit consent, which they give through you, or on the basis that you are their legal representative (for example the parent or guardian of a child). By turning the switch on you declare that one of these is the case; you confirm it in the Terms of Use (section 4) too. Without it, do not upload such documents. If you act in a professional or commercial capacity (for example as their lawyer or accountant), you are the controller of that data and decide on its legal ground; by turning the switch on you instruct us to process it on your behalf, as your processor (Terms of Use, section 11).
While the switch is off, do not upload such documents, and do not use the tools that do not add a document to a workspace (such as text recognition, transcription and translation in Tools, or a temporary document in chat) on them; the switch applies to those tools too. DocuLiq cannot check a document before it receives it: storing, text recognition and transcription come first. Then an automatic check reads the extracted text. This check does not use AI. It recognises only health and criminal-record documents, only in the document languages DocuLiq supports, and it can miss a document. If you upload such a document anyway, it is first stored and its text is extracted like any other document. Once the check recognises it, the AI features (summary, risk review, extracted information, chat, translation and the AI step of reminder suggestions) stay off for that document, and it may not be kept without explicit consent: at the next daily check we email the person who uploaded it and the workspace owner and admins, and the app shows the date on which it will be deleted. 7 days after that notice, in the daily clean-up that follows, the document is permanently deleted together with its extracted text, analysis results, reminders, tasks and notes. Until that date you can download it, export it or delete it yourself; if the person who uploaded it turns the switch on, it is not deleted. The email does not name the document. The check does not recognise the other special categories: such a document is treated like any other document, and not uploading it while the switch is off is your responsibility (Terms of Use, section 4).
In a team workspace, the switch of the member who uploaded the document counts, not that of the member who runs the AI feature. If the uploader has the switch off, or has deleted their account, the AI features stay off for a recognised document for every member. Only the uploader can change this, by turning the switch on in Profile > Legal; otherwise the document is deleted after the period described above. If the uploader has deleted their account, the way to keep the document is to export it before that date and have a member who has given the consent upload it again. Once the uploader has turned the switch on, the other members do not have to wait for the uploader: the workspace owner or an admin can start the document's analysis again, and its summary, risk review and extracted information are then produced. For text that is not a stored document (a temporary document, or text you type in for translation), your own switch counts.
For a recognised document whose uploader has the switch off, a reminder email names neither the document nor the reminder: it only says that a reminder is due, on which date and in which workspace.
You can withdraw your consent at any time by turning the switch off in Profile > Legal. From that moment the AI features stop for the recognised documents you uploaded, and those documents may no longer be kept: at the next daily check we email you, and 7 days after that notice, in the daily clean-up that follows, they are deleted together with the results already produced. Until that date you can download or export them; if you turn the switch on again, they are not deleted. Withdrawal does not affect processing that took place before it.
DocuLiq reviews your documents automatically and lists findings, such as dates, obligations and a risk score, for you to check. These results do not produce a decision with legal effect about you. They are not legal, financial or medical advice and do not replace a full reading of the document.
When you permanently delete a document, its file, derived content, passage vectors and linked reminders, tasks and notes are deleted. Deleted files stay in our storage's recovery area for up to 30 days and in database backups for up to 28 days. Records about the document that hold none of its content are kept a while longer: AI cost records and reminder delivery records for 90 days, and its line in the workspace's activity log for up to 365 days.
You delete your account in the app, or by emailing us from your account's verified email address; either way you confirm it through a link we email to that address, and nothing is deleted until you open it. Your account, personal workspace, files, derived content, devices and preferences are then deleted, and file-right packs you have not used end. Team workspaces you own are deleted too, including the documents other members added to them. The link between your account and your store purchases is deleted too, so the same store purchase can later be restored on a new account; a subscription bought on our website is cancelled at Paddle, and Paddle's own sales and invoice records stay with Paddle. The following remain for a limited time:
Two things have no fixed period. In team workspaces you did not own, the documents, tasks, notes, reminders and list items you added stay with that workspace and keep your account identifier as their author for as long as that workspace keeps them (Terms of Use, section 4). There is one exception: those of these documents that are recognised as health or criminal-record documents are deleted 7 days after the workspace owner and admins are notified, because the explicit consent that allowed them to be kept ends with your account (section 5). On the device you start the deletion from, the trusted-device token and the AI permission marker are removed too; on your other devices they stay until you remove the app's data. Neither names your account.
Deleting your account does not cancel a subscription bought through the App Store or Google Play; cancel it in that store's account settings. The app says this before you delete your account.
If a paid subscription ends and is not renewed, at the end of the paid period a personal workspace falls to the Free limits and keeps working within them; in a team workspace only the owner keeps access, and documents can be opened and exported but no new uploads or AI features run. A team workspace, and a personal workspace that stores more than the Free storage limit, then enter a 60-day retention window during which you can export your files; we email the workspace owner and admins before anything is deleted, and the app shows the date. After these 60 days, such a team workspace is deleted with all its documents, and all documents in such a personal workspace are deleted, permanently; a personal workspace within the Free limit is not emptied, and your account remains.
On the Free plan, if you do not sign in to your account for 180 days, we warn you by email; 30 days after the first warning, at the next daily cleanup, all documents in your personal workspace are permanently deleted, together with the reminders, tasks, notes and lists kept there. Signing in during that time stops the deletion. Your account is not deleted. For this we look at the last sign-in and last session-refresh times kept by our sign-in service, and we keep the warning dates in our database; they are removed at the first check after you sign in, or once the deletion is complete. This processing rests on our legitimate interest in not keeping the documents of unused accounts indefinitely.
When your personal workspace is emptied in either of these two ways, your documents' files, previews, derived content and passage vectors, your document preferences, the reminders, tasks, notes and lists kept there, files that have been waiting in upload for more than an hour, that workspace's export archives and stored request results are all deleted together. Files you sent within the last hour that are still being processed are left out of this deletion so that work in progress is not interrupted; they are deleted automatically within 1 day at the latest. The workspace itself and the following records, which hold none of your documents' content, remain:
To run the service, show paying customers their usage, size quotas fairly, stop abuse, understand how the product is used and improve it, and measure growth and retention, we record which actions you take in the app, how many times and when, together with the outcome (done, refused or failed, with its code), technical details such as page count, file size, duration, target language, upload source and AI model, your platform, app version, a session identifier and your account and workspace identifiers.
In these usage records we never record document contents or file names. A document appears there only as a pseudonymous code derived from the workspace and document identifiers.
These records are kept per account, not only as totals. From them we build reports that list, for each account identifier, its daily usage, its first steps in the product and the months in which it was active. When you delete your account, the reports drop your account identifier within about 25 hours (section 7).
In a team workspace, per-member usage is visible only to the workspace owner.
Under the Turkish Personal Data Protection Law No. 6698 (KVKK, Article 11) you may: learn whether we process your personal data; ask for information about it if it has been processed; learn the purpose of the processing and whether the data is used for that purpose; learn which third parties, in Türkiye or abroad, it is transferred to; ask for incomplete or inaccurate data to be corrected; ask for it to be deleted or destroyed; ask that the correction or deletion be passed on to the third parties who received the data; object to a result against you that arises solely from automated analysis of your data; and claim compensation if you suffer damage because of unlawful processing.
Where the EU General Data Protection Regulation or the UK GDPR applies to you (Articles 15 to 22), you may ask for access to your data and a copy of it, have it corrected or erased, restrict its processing, receive it in a portable format, object to its processing, not be subject to a decision based solely on automated processing that has legal or similarly significant effects, and withdraw any consent you gave, at any time and without affecting earlier processing.
Your right to object: you may object at any time, on grounds relating to your own situation, to any processing we base on our legitimate interests (section 2 names them). Write to support@doculiq.com; we answer within 30 days. Where the GDPR or the UK GDPR applies, that processing must then stop unless there are compelling grounds that override your interests, or the data is needed for legal claims.
In the app you can delete documents, delete your account and request a copy of your data (Profile > Legal). While the first screen is shown (section 3), the app is closed: you can sign out or delete your account from that screen; for a copy of your data in that case, write to support@doculiq.com from your account's verified email address and we provide it to that address. For any other request, write to support@doculiq.com from the email address registered to your account; you can also send your request in writing to our address in section 1. We answer within 30 days (KVKK Article 13; under the GDPR, within one month).
You can send a complaint to us first at support@doculiq.com. You may also complain to: in Türkiye, the Personal Data Protection Board; in the EU/EEA, the supervisory authority of the country where you live, where you work or where you believe the infringement took place; in the United Kingdom, the Information Commission (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).
When this notice changes, we publish a new version and present it to you in the app; you are not asked to accept it, and you can close it and go on. We keep a record of which version was presented to you and when.