Privacy notice for Türkiye

Effective 24 October 2026

1. The data controller

The data controller (veri sorumlusu) is Wild Cats Media, SCO-47, Second Floor, World Street, Sector-79, Faridabad, Haryana, India – 121014, trading as AcrossView ("we", "us"). We have no office, branch, representative or server in Türkiye. Our privacy contact is Amit Goyal: use the contact form, choosing "Privacy request or grievance", or write to support@acrossview.com.

2. What this page is for

Article 10 of the KVKK obliges a data controller to tell you, when your data is collected, who the controller is, why the data is processed, to whom and why it may be transferred, how and on what legal ground it is collected, and what rights Article 11 gives you. This page, read together with the main policy, fulfils that duty in the form the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform requires. The main policy is the single description of what we collect, how long we keep it, who processes it with us, what we never see and how we secure it; where the two differ, the one that protects you more applies.

3. What we process, how and why

The full list, with the retention period for each item, is in section 3 of the main policy. In short: your account details (name, email, hashed password, sign-in records, and the ID a sign-in provider gives us); the records of the meetings, support sessions, devices, teams, bookings, webinars and calendar entries you use; the chat messages, boards, recordings and clips you choose to keep; connection records and a security log; and the messages you send us. We never see the content of a support session, which is end-to-end encrypted, and we never record one.

Method of collection: electronically, through acrossview.com, the AcrossView web app and the AcrossView app for Windows, by automatic or partly automatic means, when you type something in, when you connect a session or meeting, or when a sign-in or calendar provider you connect sends it to us. Purposes: to sign you in and run your account; to run the features you use; to give you the recordings, transcripts and summaries you asked for; to keep the service secure and prevent abuse and scams; to improve the product; to reply to you; and to meet our legal obligations. Recipients: Hostinger International Ltd. (our servers in Mumbai and our email), Google (Gemini API, for the transcript and summary of recordings), the sign-in and calendar providers you connect, WhatsApp if you message us there, and authorities when the law requires it, as listed in section 6 of the main policy. We do not sell personal data, show ads or send marketing.

4. Legal grounds under Article 5

• Article 5(2)(c), necessary for the establishment or performance of a contract: your account and sign-in, meetings, support sessions, devices, teams, chat, boards, bookings, webinars, the calendar, the API, and the recordings and clips you make.
• Article 5(1), explicit consent: the AI transcript and summary of a recording, for which the audio is sent to Google's Gemini API outside Türkiye and outside India. You give it when you turn recording on and are told that a transcript will be made; you withdraw it by deleting the recording, which deletes the transcript and summary. Explicit consent is also the ground for connecting a Google or Microsoft calendar and for messaging us on WhatsApp.
• Article 5(2)(f), our legitimate interests, where this does not harm your fundamental rights and freedoms: the security log, the mail log, the short list of product-use events, website server logs, clip views and comments, and answering your messages.
• Article 5(2)(ç), our legal obligation, together with Article 5(2)(f): connection records (IP addresses, device IDs, session times, relay volumes) kept 180 days under India's CERT-In Directions of 28 April 2022, the law of the country we operate from, and needed to prevent abuse and investigate scams. Valid requests from authorities are answered on the same grounds.

We do not process special categories of personal data (Article 6) on purpose. A recording may contain whatever its participants said; the host is responsible for telling participants that a meeting is recorded, and the app shows everyone when it is.

5. Transfer abroad under Article 9

Where your data goes. Because we are in India, your data leaves Türkiye the moment you use AcrossView: your browser or the Windows app sends it directly to our servers in Mumbai. The audio of a recording is then sent to Google's Gemini API, which may process it outside India, including in the United States. Nothing else is transferred onward, apart from what a sign-in or calendar provider you connect exchanges with us, and WhatsApp if you message us there.

The legal route. Article 9 of the KVKK, as amended by Law No. 7499 (in force since 1 June 2024) and detailed by the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad of 10 July 2024, allows a transfer abroad in three ways: to a country, sector or organisation for which the Personal Data Protection Board has issued an adequacy decision; under appropriate safeguards, such as the Board's standard contract, which must be notified to the Board within five business days of signing, binding corporate rules, or a written undertaking approved by the Board; or, where neither exists, for transfers that are occasional, on one of the grounds in Article 9(6), including your explicit consent after being informed of the possible risks, or necessity for the performance of a contract between you and us.

What we rely on today, stated plainly. The Board has issued no adequacy decision for India and none for Google's processing locations that we can rely on. We have not signed and notified the Board's standard contract, with Hostinger or with Google. Our processing of Turkish residents' data is occasional: AcrossView is not promoted in Türkiye, and the people there who use it do so on their own initiative. We therefore rely on Article 9(6): on the necessity of the transfer to perform the service you asked us for (Article 9(6)(b)) for everything stored on our servers, and on your explicit consent, given after this notice has informed you of the risks (Article 9(6)(a)), for the audio sent to Google for a transcript. The risk to be aware of is that neither India nor the United States has been found by the Board to give protection equivalent to the KVKK, and that your rights there are enforced through us and our contracts, not through a Turkish authority. Google processes under its data processing terms, which include contractual clauses for international transfers. Before promoting AcrossView in Türkiye we will put the Board's standard contract in place with our processors and notify it, and update this notice.

Safeguards in practice. Support sessions are end-to-end encrypted on the two devices and are never readable on our servers in any country. All other connections use TLS, passwords and API keys are stored only in hashed form, and access to our servers is restricted and logged. See Security. If you do not want audio sent to Google, do not record, or delete a recording as soon as it is made.

6. Your rights under Article 11

By applying to us you have the right to:

1. learn whether your personal data is processed;
2. request information about it if it is;
3. learn the purpose of processing and whether the data is used in line with it;
4. know the third parties, in Türkiye or abroad, to whom it is transferred;
5. request correction of incomplete or inaccurate data;
6. request erasure or destruction of the data under the conditions of Article 7;
7. request that the correction, erasure or destruction be notified to the third parties who received the data;
8. object to a result against you produced by analysing your data exclusively through automated systems. We make no such decisions; session time limits follow your plan, not a profile of you;
9. claim compensation for damage caused by unlawful processing.

How to apply (Article 13). Under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your application in writing to our address in section 1, or by email to support@acrossview.com from the email address registered on your AcrossView account, or through the contact form, choosing "Privacy request or grievance". Say which rights you are using and give enough detail for us to identify you and your data; we may ask you to prove who you are. We answer within 30 days of receiving the application, free of charge, unless the Board's tariff allows a fee for an unusually costly request, in which case we will tell you first. You can delete many things yourself: recordings, clips, boards, chat messages, API keys and your whole account. Connection records are kept for their 180 days and the security log for as long as security requires, as described in section 4.

7. VERBİS and a representative in Türkiye

Article 16 of the KVKK and the Regulation on the Data Controllers' Registry require a data controller outside Türkiye that processes Turkish residents' data to register in the Data Controllers' Registry Information System (VERBİS) and to appoint a representative in Türkiye. We have not yet registered in VERBİS and have not yet appointed a representative in Türkiye. AcrossView is not promoted there today, and the small number of people in Türkiye who use it do so on their own initiative. We will register and appoint a representative, and name them here, before promoting AcrossView in Türkiye. Until then, write to us directly at the address in section 1.

8. Children

The KVKK sets no separate age for consent, so the Turkish Civil Code applies: a person under 18 acts through a parent or guardian. AcrossView is not meant for anyone under 18 to use on their own; our terms require a parent or guardian to set it up and stay present. We do not knowingly create accounts for children. If you believe a child has given us personal data without a parent's involvement, tell us through the contact form and we will delete it.

9. Data breaches

If personal data is obtained by others unlawfully, Article 12(5) requires us to notify the people concerned and the Personal Data Protection Board as soon as possible; the Board's decision No. 2019/10 sets that at 72 hours from learning of the breach. We will do so, describing what happened, which data was involved, and what we and you can do. The content of support sessions cannot be exposed by a breach of our servers, because it is end-to-end encrypted and never stored.

10. Complaints to the Board

Article 14 asks you to apply to us first. If we reject your application, answer it unsatisfactorily, or do not answer within 30 days, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your application, at kvkk.gov.tr. Your right to claim compensation in the courts is unaffected.

A Turkish version of this notice is being prepared and will be published at this address. If we change this notice we will update the date at the top; significant changes will be announced on this website before they take effect. Other countries' notices are on Privacy notices by country.