KVKK clarification notice

This clarification notice (Aydınlatma Metni) is provided under Article 10 of Turkey's Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It applies to people in Turkey who use nomitale.com or the NomiTale app.

1. Data controller

Data controller: Cryptosam LLC, a company established in the United States (address below). Contact: support@nomitale.com.

2. Personal data we process

• Identity and contact data: name, email address.
• Customer transaction data: waitlist sign-up, support messages, subscription status, stories prepared, consent records.
• Transaction security data: IP address hash, device user agent, sign-in records, error logs.
• Audio recordings and special-category data: your voice sample, recorded consent sentence and the voice model created from them (treated as biometric data).
• Household data (optional): voice display names, a child's first name and age range.
• Marketing and analytics data: website usage data, only if you accept cookies.

We store private story text, titles, reader names, recordings, purchase identifiers and credit history in your account. Manual recordings do not go to AI providers. Optional AI narration sends your text, only with separate permission, to the reviewer shown in the app: OpenAI, Anthropic, or OpenRouter and its specifically named upstream provider. Reviewers receive text, not audio. Approved text then goes to the selected voice provider. A change of processing company requires new permission before new processing. Provider security retention may apply; disabling response storage does not guarantee zero retention. Private stories and recordings remain until deleted; financial records may be retained as legally required.

3. Purposes of processing

• creating and managing your account and providing the service;
• creating a voice copy and preparing stories in that voice;
• managing subscriptions and cost limits;
• answering support requests and data-subject applications;
• ensuring information security, preventing abuse and fraud;
• sending waitlist and launch announcements if you have confirmed your sign-up;
• improving the website through analytics, if you have given consent;
• complying with legal obligations and requests from authorised public bodies.

4. Method of collection and legal grounds

Your data is collected electronically through the website forms, the NomiTale app, the recordings you make in the app, cookies (with your consent) and our service providers' systems. Legal grounds (KVKK Articles 5 and 6):

• necessity for the establishment or performance of a contract (Art. 5/2-c) — account, service and subscription data;
• compliance with a legal obligation (Art. 5/2-ç);
• establishment, exercise or protection of a right (Art. 5/2-e) — consent records, security logs;
• our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f) — information security and abuse prevention;
• your explicit consent (Art. 5/1 and Art. 6) — voice recordings and voice model (biometric data), analytics cookies and waitlist emails.

5. Transfer of personal data and transfer abroad

Because the data controller is located in the United States, your personal data is processed abroad. It is shared, only as needed for the purposes above, with our service providers: Hetzner Online GmbH (Germany, hosting), Cloudflare, Inc. (USA, security and encrypted storage), Amazon Web Services (Ireland, email), Fish Audio / ElevenLabs (USA, voice model and speech synthesis), Apple and Google (USA, subscription verification), Expo (USA, notifications), Sentry (error monitoring) and — only with your consent — Google (website analytics). It may also be shared with authorised public institutions when legally required.

Transfers abroad are carried out under KVKK Article 9 by means of the standard contracts announced by the Personal Data Protection Authority, which are notified to the Authority within the legal period, and, where applicable, with your explicit consent for occasional transfers.

6. Retention

Your data is kept only for as long as the purpose requires and the law demands, and is then deleted, destroyed or anonymised. Voice data is deleted when you delete the voice or your account. The retention periods are listed in the Privacy policy.

7. Your rights under KVKK Article 11

You have the right to:

• learn whether your personal data is processed;
• request information about the processing;
• learn the purpose of processing and whether data is used in line with that purpose;
• know the third parties in Turkey or abroad to whom data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of your data under Article 7;
• request that the third parties to whom data was transferred be notified of such correction, deletion or destruction;
• object to a result against you arising exclusively from automated analysis of your data;
• claim compensation for damage caused by unlawful processing.

8. How to apply

You can send your application in Turkish, in writing or by email from the address registered with us, to support@nomitale.com, or by post to our address below, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application must include your name and surname, your address or email for notification, and a clear description of your request. We will answer free of charge within 30 days at the latest; if the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, the answer is found insufficient or not given in time, you may lodge a complaint with the Personal Data Protection Board.

Tell NomiTale about inappropriate content or voice misuse. Only the story reference, selected reason and your note are sent to our support team. Audio and story text are not attached. Reports are deleted after 90 days or when you delete your account.