Privacy Notice (KVKK)
Version 2026-09-27 · Effective 27 September 2026
This notice is given under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Obligation to Inform. It explains how your personal data is processed when you use the Viyu app and website and when you join the waitlist. It is information, not consent. The texts for processing that needs your explicit consent are separate: Consents. The Turkish version prevails if the two differ.
Viyu is an independent private company. We are not affiliated with any government, embassy, consulate or visa application center. Only the relevant authorities decide on applications.
1. Data controller
- Company: [company name to be added]
- Address: [company address to be added]
- MERSİS: [MERSİS number to be added]
- Tax office and number: [tax office and number to be added]
- Registered e-mail (KEP): [KEP address to be added]
- E-mail: viyu@neuros.com.tr
2. First: data we do not process
- Your documents. Documents you add to the app (passport page copy, bank statement, payslip, social security record, criminal record, medical report and the like) are kept only in the encrypted vault on your phone and checked only on your phone. The document, its image, its text and anything read from it are never sent to our servers or to the AI provider. Documents are deleted from your phone automatically 30 days after your goal ends; we remind you 3 days before.
- ID numbers. We never ask for or store passport numbers or Turkish national ID numbers. We don't scan your passport (no MRZ, NFC or photo reading) and don't connect to e-Devlet.
- Your name. Your name and your family members' names stay on your phone.
- Location and contacts. We don't access your location or contacts; you choose your province yourself.
- Biometric data. Not processed.
3. Categories, purposes and legal bases
| Data category | Examples | Purpose | Legal basis (KVKK) |
|---|---|---|---|
| Identity and contact | E-mail address; Apple or Google account ID | Opening your account, verifying sign-in, service messages | Establishing and performing the contract (Art. 5/2-c) |
| Profile and plan | Stage, goals and countries, dates, province, birth year, work status, social security type, income band, ties, languages; family members' relationship and birth year | Your personal plan, checklist, timeline and reminders | Performing the contract (Art. 5/2-c) |
| Travel and visa details | Passport type, issuing country, issue and expiry dates; visa types and dates; application stage, center, appointment date; refusal country, date and ticked standard grounds; trips (dates, countries, cities) | Day Ledger (90/180), expiry reminders, travel log, application tracking | Performing the contract (Art. 5/2-c) |
| Document status | Document type, ready or not, issue and validity dates, deletion day (not the content) | Freshness and deletion reminders | Performing the contract (Art. 5/2-c) |
| Customer transactions | Plan bought, period, renewal status, store transaction ID; support messages; "This is wrong" reports | Unlocking your plan, managing the subscription, support, correcting the rule base | Performing the contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| Transaction security | IP address, session and device data, access logs, content-free error logs | Protecting your account and the service, preventing abuse, fixing errors; duties under Law No. 5651 | Legitimate interest (Art. 5/2-f); legal obligation (Art. 5/2-ç) |
| AI Q&A | Your question, earlier messages in the chat, identity-free plan summary | General Q&A and rule explanations | Explicit consent (Art. 5/1); Art. 9 for the transfer abroad |
| Community contributions | Slot radar observation (center, visa type, date, waiting time); Türkiye's Route board row | User-reported slot radar and anonymous board | Explicit consent (Art. 5/1) |
| Usage measurement | Pseudonymous, content-free screen and card events | Improving the app | Explicit consent (Art. 5/1) |
| Marketing | Consent and preferences for commercial messages | Offer notifications, campaign e-mails | Explicit consent (Art. 5/1) and consent under Law No. 6563 |
| Waitlist | E-mail address, language, optional destination, campaign codes, consent record | Launch e-mail, e-mail verification, aggregate campaign measurement | Explicit consent (Art. 5/1); legitimate interest for measurement (Art. 5/2-f) |
| Legal records | Consent records (which text version, when), deletion records (content-free) | Proving consent and compliance | Establishing, exercising or protecting a right (Art. 5/2-e); legal obligation (Art. 5/2-ç) |
Special categories of data. If you want to add a document such as a criminal record or a medical report, the app first asks for a separate explicit consent (Art. 6). Such documents also stay only in the encrypted vault on your phone and are never sent to our servers or to AI. The app never asks about religion, ethnicity or political opinion.
4. How we collect it
Electronically and by automated means: when you enter it into the app or the website forms, when you sign in with Apple or Google (the account ID and e-mail they pass to us), when you buy a plan (purchase records via Apple, Google and RevenueCat) and when you use the app (security records and, with your consent, usage events).
5. Who receives it and why
| Recipient | Purpose | Data | Location |
|---|---|---|---|
| Our own server | Providing the service | The data this notice says we process | Türkiye |
| Resend (e-mail delivery) | Sign-in code and waitlist e-mails | E-mail address, e-mail text | USA |
| Apple | Sign in with Apple, App Store purchases, push delivery (APNs) | Account ID, purchase record, device token, notification text without sensitive details | USA, Ireland |
| Sign in with Google, Google Play purchases, push delivery (Firebase Cloud Messaging) | Account ID, purchase record, device token, notification text without sensitive details | USA, EU | |
| RevenueCat | Syncing purchases with the stores | Pseudonymous user ID, purchase records, device platform | USA |
| DeepSeek (only with your consent) | General Q&A in the assistant | Question, earlier messages in the chat, identity-free plan summary | People's Republic of China |
| Authorised public bodies and courts | Legal obligation | Only the data legally required | Türkiye |
- We never sell your data or share it with ad networks or data brokers. The app contains no advertising or tracking software.
- These providers act as data processors on our instructions. Apple and Google also process data under their own policies for sign-in and payment services.
6. Transfers abroad
Transfers to recipients outside Türkiye in the table above are made under Article 9 of the KVKK: standard contracts announced by the Board are signed with these providers and notified to the Personal Data Protection Authority within 5 business days of signing.
The transfer to the AI provider (DeepSeek, servers in the People's Republic of China) additionally depends on your explicit consent. Without it, nothing is sent to the AI provider and the rest of the app keeps working. The provider may retain this data and use it to improve its service under its own terms; that is why documents, ID and account details are never sent to the assistant, and our server does not forward any text containing such patterns.
7. Retention
| Data | Period |
|---|---|
| Documents on your phone (not on our servers) | Deleted automatically on your phone 30 days after the goal ends; reminder 3 days before |
| Account, profile, plan, document status, travel log | While the account is open; on deletion immediately, from backups within 35 days |
| Slot radar observations | 180 days; then only identity-free totals |
| Türkiye's Route board rows (identity-free) | 18 months; then only totals |
| Usage measurement events | 24 months |
| AI usage records (content-free) | 13 months |
| Support messages | 2 years after closing |
| Consent records | 10 years |
| Purchase and invoice records | 10 years |
| Access and security logs | At least 1, at most 2 years (Law No. 5651) |
| Waitlist record | Until consent is withdrawn; at most 12 months after Viyu launches |
| Deletion and destruction records (content-free) | 3 years |
When a period ends, data is deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Full list: Privacy Policy.
8. Your rights (KVKK Art. 11)
You can apply to us to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties it is transferred to, in Türkiye or abroad,
- ask for it to be corrected if incomplete or inaccurate,
- ask for it to be deleted or destroyed under the conditions of Article 7,
- ask for corrections, deletions and destructions to be notified to third parties it was transferred to,
- object to an outcome against you that results solely from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
You can withdraw any explicit consent at any time, with effect for the future: Profile → Privacy & data.
9. How to apply
- E-mail viyu@neuros.com.tr from the address registered in the app, with "My personal data" in the subject line,
- send a signed letter to [company address to be added],
- or write to [KEP address to be added] via KEP or with a secure electronic signature.
Include your name, the e-mail address linked to your account and your request. We reply free of charge within 30 days at the latest; our target is 7 days. If the request involves an extra cost, a fee may be charged under the Board's tariff. If you find our reply insufficient or receive none in time, you can complain to the Personal Data Protection Board.