Privacy and Cookie Policy

This translation is provided for convenience; the Turkish text prevails.

This policy describes the privacy principles of iyibir Cloud (accounts, the iyibir Cloud panel and the cloud products) and the cookies it uses in your browser. The purposes and legal bases for processing your personal data are in the Privacy Notice (KVKK); how your company's business data is processed is in the Data Processing Agreement. iyibir's marketing website (www.iyibiryazilim.com.tr) has its own privacy text.

1. Our principles

• Your company's data belongs to your company. We do not use your Logo ERP or payroll data for our own purposes, and we do not sell or rent it.
• No model training. We do not train artificial intelligence models with your company's data or your conversations. Requests to a language model pass through the model gateway running on our own server in Türkiye; the gateway does not record the content of your questions and answers. We send requests to our language model provider, OpenAI, with storage switched off; OpenAI does not store requests or answers (except OpenAI's abuse-monitoring logs, kept for at most 30 days), processes them only at the time of the request and does not use them to train its models.
• Companies do not see each other. Your company and identity are read only from your session token; another company's records are never shown to you and yours are never shown to others.
• Only the data we need. We collect only the data needed to provide the Service; we collect no data for advertising or tracking.
• Reads are read-only, writes are approved. The PaaS Agent reads your Logo database only with a read-only user; only documents you approve are written to Logo, through Logo's own REST service.

2. How we protect your data

• All traffic between your browser and our servers, and between the PaaS Agent and our servers, is encrypted (TLS).
• The PaaS Agent connects outwards from your company's server; you do not open an inbound port. The Logo database password stays only on your server, in an encrypted store; it is not sent to us.
• Your password is stored as a one-way hash. Access tokens are short-lived (30 minutes) and renewable.
• Our servers and databases are in Türkiye; only authorised iyibir technical staff can reach production systems, and that access is logged.
• Every write proposal is stored on the server; the body executed is the body you saw on the approval card; the same write is never sent twice.
• We monitor the health of the Service with a monitoring system on our own server; these records are kept briefly (logs 14 days). We keep traffic records under Law No. 5651 for 2 years.

If a security breach occurs we notify the Personal Data Protection Board and affected people as KVKK requires and, where your company's data is affected, your company under the Data Processing Agreement.

3. Our service providers

We use the following providers to deliver the Service:

• RNG Bilişim Teknolojileri San. ve Tic. Ltd. Şti. (Türkiye): hosting our servers and databases; data is stored in Türkiye.
• OpenAI, L.L.C. (USA): the language model in the cloud products and iyibir Assistant; requests are not stored (except OpenAI's abuse-monitoring logs, kept for at most 30 days) and are processed in the USA only at the time of the request.
• Vercel Inc. (USA): serving the files of the panel and web interfaces.
• Google (Google Workspace): sending and receiving iyibir's e-mails (iyibiryazilim.com.tr domain) through the Gmail infrastructure; processed outside Türkiye.
• İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico, Türkiye): taking credit and invoice payments. The payment page is iyzico's; the panel sends you to that page and brings you back after payment. Your card details are entered only on that page and never reach us. iyzico's own privacy and cookie notice applies on that page.

Transfers to OpenAI, Google and Vercel are transfers abroad because the data leaves Türkiye to be processed, even though OpenAI does not store requests. They are made under Article 9 KVKK with the Board's standard contract, notified to the Authority within 5 business days; details are in the Privacy Notice and the Data Processing Agreement.

4. Cookies and browser storage

A cookie is a small text file a site stores in your browser. iyibir Cloud uses no analytics, advertising or third-party tracking cookies. It uses only the records needed for the Service to work and to remember the interface preferences you choose. Under the Personal Data Protection Board's Guide on Cookie Practices these are strictly necessary and need no explicit consent, so we do not show a cookie consent banner.

4.1 Strictly necessary cookies

• Session cookie (accounts, with the Host prefix in its name): remembers that you are signed in so we do not ask for your password again between products. Only the server can read it (HttpOnly) and it is sent only over encrypted connections. It lasts at most 12 hours and is deleted when you sign out.
• Session renewal cookie (name starts with "iyibir.rt."): keeps your panel session going without asking for your password until you sign out. Only the server can read it (HttpOnly); it lasts as long as the renewal token and is deleted when you sign out.
• Guide cookie (iyibir_guide): lets you view the user guide pages that are open only to signed-in users; it lasts as long as the session.

4.2 Preference records

• Sidebar preference (sidebar_state, cookie): remembers whether the panel menu is open or closed. It lasts 7 days.
• Theme and language (browser local storage): remembers your light/dark theme and Turkish/English choice until you clear it.
• Sign-up continuation (browser local storage): lets you continue where you left off after verifying your e-mail during sign-up.
• Page reload marker (session storage): makes the page reload once when a new version of the application is released; deleted when you close the tab.

Session tokens may be held in the browser's memory or session storage; these too only keep you signed in.

4.3 Hosting logs

The files of the panel and web interfaces are served through Vercel. When you open a page, Vercel briefly records your IP address and request details (time, requested address, browser information) to run the service and prevent misuse. This is not a cookie.

4.4 Managing cookies

You can delete or block cookies in your browser settings. If you block the necessary session cookies you cannot sign in; if you clear the preference records your theme, language and menu settings return to their defaults.

5. Product applications

iyibir Copilot, iyibir Mind, iyibir WMS and iyibir Workforce open at their own addresses and sign you in through accounts. They follow the principles in this policy; if they start to use analytics or advertising cookies, this policy is updated beforehand and your explicit consent is asked where required.

6. Contact

For privacy questions write to destek@iyibiryazilim.com.tr. How to exercise your rights under KVKK is described in the Privacy Notice.

7. Changes

We update this policy as the Service changes. A new version is announced in the panel and published with its effective date.

Version 2 · Effective 17 Oct 2026