KVKK privacy notice

This notice explains what data is processed when you use Ara Karar (www.arakarar.com), why it is processed, and where and for how long it is stored. The same rules apply no matter which country you connect from; it has been prepared within the framework of applicable data protection legislation, including Personal Data Protection Law No. 6698 (KVKK) for users in Turkey and the General Data Protection Regulation (GDPR) for users in the European Union.

In brief

We do not show ads, we do not sell your data, and we do not share it with ad networks.
We keep site statistics on our own server; the last byte of the IP address is zeroed, and query strings are not recorded.
Our servers are in Finland, within the European Union.
Decision texts are documents that judicial authorities publish openly to the public; free access to information is the purpose of this site.
You can delete your account, search history, and AI answers at any time.

1. Data controller

The Ara Karar service is provided by OPUSMIND LLC (Wyoming, United States), which is the controller of the data described in this notice. For any questions and requests: destek@arakarar.com.

2. What data we process, why, and for how long

Membership: First name, last name, email address, phone number, and a hash of the password (the password itself is not stored). To open the account, verify sign-in, and provide the service. Kept until the account is deleted; when you delete the account, plan, search history, and settings records are deleted as well.
Phone verification: Your phone number and a one-time code are sent to our SMS provider to send the verification SMS.
Payment: Your card details are processed only by the payment provider (Stripe); they never reach us. We keep the purchased plan, amount, date, and payment status; these are stored for the period required by tax and accounting legislation.
Search history: Members' search text, search type, date, and number of results; to show you your history. Kept up to your plan's retention limit (your most recent searches); your favorites remain until you remove them. You can delete them one by one or all at once from the "My searches" page.
AI answers: Your question and the decision excerpts found relevant to it are sent to the AI provider to generate the answer. The question and answer are kept until you delete them, so you can open them again without paying again. When you delete them, the question and answer text are deleted; only a content-free cost record remains for expense accounting. Failed and deleted records are permanently deleted after 180 days. We recommend that you do not include your own or anyone else's identifying information in your question.
File conversion: Files you upload to the UDF, Word, and PDF converters and their converted versions are stored on our server so you can download the result. You can request their deletion through our support address.
Contact form: Name, email, subject, and your message; to respond to your request. You can request their deletion.
Site statistics: The URL and title of the page viewed, the name of the referring site, device type, IP address with the last byte zeroed, and a random visitor ID generated in your browser. Query strings and the path of the referring page are not recorded. To understand which content is useful; deleted after 400 days. Google Analytics is also used (see Cookie Policy).
Anonymous search logs: For searches made without signing in: the search query, anonymized IP (/24 for IPv4), and a random tab-specific ID; to measure search quality and prevent abuse. Deleted after 180 days.
Error and security logs: Error message, page or request URL, browser information, IP address, and (if you are signed in) user ID; to fix errors and protect the site. Error logs are deleted after 60 days, and server access logs after about two weeks.

The legal bases for this processing are: the formation and performance of a contract for membership and the service you purchase; our legitimate interest in keeping the service secure and running for error logs, security, and statistics; and our legal obligations for payment records.

3. Who we share data with and where it is processed

We share data only with the following providers we work with to deliver the service, and only as much as necessary:

Hosting: Hetzner Online GmbH. Our servers and databases are located in a data center in Finland (European Union).
Payment: Stripe, Inc. (USA). Card details and payment processing.
AI: DeepSeek (People's Republic of China). Your question and excerpts from decisions, only when you request an AI answer.
SMS: MSG91 (India). Your phone number and the code, for phone verification.
Email: GoDaddy (USA). Your email address and name, for sending account and notification emails.
Google: Google LLC (USA). Site statistics (Google Analytics), bot protection on the sign-in and sign-up forms (reCAPTCHA), and the icon font.

Because some of these providers are located outside Turkey and the European Union, data may be transferred to those countries. We do not share data with anyone else, except in response to duly made requests from public authorities empowered by law.

4. Personal data in decision texts

The decisions published on the site are documents made publicly available by official sources such as the Court of Cassation, the Council of State, and UYAP, and they usually arrive already anonymized at the source. We publish the texts as we receive them, without changes. If you see personal data that has not been anonymized in a decision, report it to destek@arakarar.com together with the decision's URL; we will review it and either mask the information or take the decision down.

5. Your rights

Whichever country you are in, you have the following rights regarding your data:

To learn whether your data is being processed and to request a copy.
To request correction of inaccurate or incomplete data.
To request deletion of your data.
To object to processing or request that processing be restricted.
To receive your data in a portable format.
To file a complaint with the data protection authority of the country you are in.

You can send your requests to destek@arakarar.com; we respond within 30 days at the latest. You can also delete your account, search history, and AI answers yourself from your dashboard.

6. Security

Connections are encrypted (HTTPS), passwords are stored only in hashed form, and external access to our databases is blocked. No system is flawless; if we detect a breach, we will notify affected users and the authorities required by law without delay.

7. Changes

We update this notice as the service changes; the current version is always on this page, and the date at the top shows the most recent change.