Personal Data Protection Clarification Notice (KVKK / GDPR)
In compliance with Turkish Personal Data Protection Law No. 6698 (“KVKK”) Art. 10 and GDPR provisions.
1Data Controller Identity
This clarification text is issued by Projectviate Technologies (“Projectviate”, “Company” or “Data Controller”) as the data controller to inform users, subscribers, and team collaborators regarding the collection, processing, storage, and legal rights relating to personal data within our multi-tenant SaaS application.
2Processed Personal Data Categories
Full name, email address, avatar photo, unique user UUID identifier.
Workspace roles (Admin, Member, Viewer), sprint allocations, task assignments, worklogs, and time entries.
Argon2id password hashes, IP addresses, session tokens, login failure attempts, and audit trails.
AES-256-GCM encrypted API keys (at-rest only), key fingerprints (masked), model preferences, and token usage counts.
3Purposes of Data Processing
- Providing multi-tenant Agile project management, sprint planning, and Kanban workflows.
- Enforcing strict tenant isolation between different workspaces and organizations.
- Executing user-requested AI task breakdowns and draft summaries strictly with user-owned BYOK keys.
- Protecting account security, preventing credential stuffing, and maintaining forensic audit logs.
- Managing subscription limits, usage quotas, and compliance reporting.
4Data Transfers & AI Third-Party Safeguards
Projectviate never sells, monetizes, or leases personal data. When you connect your personal OpenAI or Anthropic API key via BYOK, only the specific task title or user prompt is transmitted via TLS 1.3 to that provider. Your API key is encrypted at-rest using AES-256-GCM with unique nonces and is never transmitted back to any browser.
5Your Rights Under KVKK Art. 11 & GDPR
You hold the right to learn whether personal data is processed, request information, request correction of inaccurate data, request erasure under statutory conditions, object to automated profiling, and claim damages for unlawful processing.