KVKK Disclosure (Summary)

Summary

• Data controller: Tokenarch Studio Teknoloji A.Ş. (Şişli, Istanbul, Türkiye), which operates Letterin. Contact: info@letterin.app.
• Data processed: account and contact details, CV content (experience, education, skills), an optional photo (off by default, opt-in), job postings you paste or read with the browser extension (with the page address), AI usage metrics, a record of a few product steps (for example a CV download, the day the app was opened, or accepting an AI suggestion — the step's name and date, never content), and where your first visit came from (campaign tags, the name of an ad click identifier but not its value, the referring domain, the landing page, the date) with a random visitor identifier, kept in a first-party cookie (letterin_ft) and saved to your account once when you sign up. If you consent, the Google Ads conversion tag used to measure our ads lets Google set its own advertising cookies and receive the page address, your IP address and browser details. No special-category data is requested or given a dedicated field.
• Purposes: providing the CV builder, AI text tailoring you initiate, PDF export, fair-use metering, seeing which product steps people get stuck on so the service can be improved, and measuring which promotion channels work and what acquiring a user costs.
• Legal bases: performance of a contract, legitimate interest, and your explicit consent for transfers abroad and for advertising cookies (asked on your first visit, optional, and withdrawable at any time via "Cookie settings" at the bottom of the site).
• Transfers: hosting on Supabase (cloud); account emails through Resend, which receives only your email address, the first word of your name and the email's text (never CV or posting content); and, when you use AI features, transmission of the relevant text to the configured AI providers (currently OpenAI for reading and scoring and Google Gemini for writing, both via the OpenRouter API gateway, plus TypeSafe for the match verdicts when an English CV is scored against an English posting), whose servers are located abroad; and, only with your consent, the page address, IP address, browser details and Google's own cookie identifiers sent to Google through the Google Ads conversion tag for ad measurement (no ad personalization/remarketing, and never on pages whose address carries personal content; without consent Google receives only a cookieless signal with no identifier). Cross-border transfer relies on your explicit consent per KVKK art. 9. If you choose to save a CV to Google Drive (optional, Pro), the file goes from your browser straight to Google with our servers as no intermediary, under the "drive.file" permission alone. If you import a CV by picking it from Drive, that one file is sent to our servers like an uploaded CV and read by the AI providers above.
• Retention: as long as your account exists; account deletion permanently removes your data, subject to statutory retention duties.
• Your rights (KVKK art. 11): access, information, rectification, erasure, objection and compensation. You can also export your data and delete your account directly in the app.

Requests: info@letterin.app. Requests are answered free of charge within 30 days at the latest.