The scope of the data is also
It should be obvious.

1. Data controller and contact

The VulKill product, offered under the VulKill Security brand, is the service provider and data controller for this site and direct communication activities, Gökçe Baran Karakamış. For privacy questions and personal data requests, you can reach info@vulkill.com.

This clarification has been prepared based on the Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR) to the extent applicable to the processing activity. Reading the text or visiting the site does not mean that you give explicit consent to a transaction that requires additional consent.

2. Which data is processed by which method?

• Visit and technical security information: data such as IP address, request time, requested page, browser/device information, HTTP response and security events; Network requests you make to the site may be processed automatically through hosting/network security services.
• Contact information: When you send an e-mail, the name, e-mail address, institutional information, subject and message, if any, are received directly from you. Do not email source code, private repository archives, passwords or API keys; The email system is not a zero source code retention flow.
• Request and right exercise records: when you make an application, the content of the request, correspondence, transaction and response information can be recorded through direct communication. Only necessary identity or authorization verification may be requested.

3. Processing purposes and legal grounds

• Providing the site, preventing abuse and investigating faults: operating interest of secure service balanced with your rights and freedoms (KVKK art.5/2-f; GDPR art.6/1-f, if applicable).
• Preparing the service or offer you request and fulfilling the contract: your pre-contractual request and the necessary actions for the performance of the contract (KVKK art.5/2-c; GDPR art.6/1-b). Answering general questions is considered a legitimate interest balanced with your rights.
• Legal notification, invoicing and personal data application obligations: relevant legal obligation (KVKK art.5/2-ç; for obligations under GDPR, art.6/1-c). Records required for legal claim or defense: KVKK art.5/2-e and applicable GDPR basis.
• Optional marketing or processing requiring separate consent: separate, free and revocable choice for the purpose (KVKK art.5/1; GDPR art.6/1-a). Sending us an inquiry is not marketing consent; Withdrawal of consent does not affect previous lawful transactions.
• Only necessary information is requested. If you do not provide information necessary for the conclusion of a contract or legal obligation, the relevant transaction may not be completed; Failure to provide optional information will not prevent you from accessing the basic service.

4. Recipients and overseas data processing

Data; Hosting and content distribution/network security providers may be accessible to the extent necessary to provide the service, e-mail service providers and authorized service personnel for the transmission of the e-mail request. To authorized public institutions in case of a legal obligation or due request; Transfers can be made to consultants when necessary to protect a right.

The demo site is published on OpenAI Sites; Cloudflare infrastructure is used for hosting and content transmission. These services process network request data within their own infrastructure. Since global infrastructure is used, no commitment is made that all data is kept only in Turkey.

Activities that require transfer of personal data abroad are evaluated with the applicable transfer conditions and guarantees stipulated in KVKK Article 9. Your use of the site or reading this text does not alone constitute a general consent for continued overseas transfer. SaaS specific providers, data regions and transmission pattern will be disclosed separately before data is collected on the service.

Transfers outside the European Economic Area under the GDPR require valid safeguards, such as an appropriate adequacy decision or standard contractual clauses, and additional measures where necessary. You can ask for information about the security used and the recipients involved. SaaS subprocessors, processing regions, and concrete transfer mechanism are disclosed before data acceptance; Simply citing this text does not establish a transmission mechanism.

5. Payment data with Paddle

When selling via Paddle is enabled, the Paddle entity specified on the payment screen becomes the Merchant of Record for the transaction. It processes the information required for payment, invoice/tax, anti-fraud and refund activities within the scope of its own privacy statement. For these purposes, Paddle is a separate data controller; It is not available as an instruction-only subprocessor of VulKill.

VulKill can retrieve customer/transaction reference, contact information, schedule, payment or refund status required for subscription and support. The full card number and card security code are not required to be transmitted to VulKill. Your source code is not input to the payment process and is not sent to the payment provider.

Paddle's privacy channels for claims regarding payment data processed independently by Paddle; You can use the address info@vulkill.com for the records held by VulKill. Retention of legal billing records may not automatically terminate upon account closure.

6. Cookies and links

Your cookie preference is stored in a first-party cookie called vulkill_consent for 180 days and shared between vulkill.com, www.vulkill.com, and app.vulkill.com in this browser. The vulkill_locale cookie, which remembers the language you choose, is stored for one year. Cookies required for session and security are independent of these preferences.

If you allow functional cookies, the side menu choice of the application panel will be stored in your browser. When you remove this permission, the registry is cleared. Optional analytics or ad trackers are not currently available. You can change your preferences at the Cookie preferences link at the bottom of each page. If a new optional tool is added, you will be notified separately before use.

7. SaaS scan data and customer roles

The SaaS service can process destination addresses, ownership and test authorization records, scan settings, job status, and finding reports that do not contain source code. Additional access or input is received only to the extent required by the selected review. Source code or application package is not requested for every scan.

For personal data processed on behalf of the customer upon his instruction, VulKill may be the data processor, and the customer may be the data controller or data processor depending on his own activities. Before accepting the source, a data processing agreement (GDPR art.28 DPA, if applicable) is made, which determines the subject of processing, purpose, duration, data categories, confidentiality, security, sub-processors, assistance with claims, violation notification, audit and deletion/return conditions.

The role of VulKill for its own communications, accounts, security and legal records is also evaluated. Technical and administrative measures and, where necessary, impact assessment, representative or data protection officer obligations are handled according to the actual scope of the service.

Use test data and mask unnecessary third-party data. Private client findings and reports are not released to the public without separate authorization. This site does not use automated decision-making that may have legal or similarly important consequences for visitors.

8. Zero permanent source code retention commitment

Our commitment to the VulKill SaaS stream accepting source code is: not to permanently store source files, repository copies, archives and code snippets provided as crawl input. This assurance is valid when the scanning service is turned on, subject to the following conditions; The publication of a demo page does not in itself constitute verification of a working deletion system.

The code must be processed temporarily before scanning can be performed. The code is processed only in the isolated temporary work area of ​​the relevant job; When the job is completed, canceled, or terminated with an error, temporary copies and intermediate outputs containing the code generated from them are purged. Keeping the repository outside of scanning or archiving for subsequent scanning is not part of this flow.

• Source code; It is not copied to application logs, analytical logs, persistent cache, search or vector index, backups, or error dumps.
• Finding type, severity level, required file/line reference and solution description are used in reports instead of source code blocks. Outputs that leak passwords, keys, personal data or source code are not included in the permanent report.
• The source code is not used for model training, product development dataset or advertising purposes. Raw source code will not be sent to external AI or any other provider that cannot provide this commitment.
• If the delete and backup exclusion controls are not validated, source code commit is not initiated. If a processing/deletion problem is detected, new source code work is stopped and the necessary notification process is implemented.

9. Storage and deletion criteria

The commitment to zero persistent source code retention is laid out in the special section below. This commitment does not mean that all personal and business records are not kept at all.

Communication records; finalization of the request and necessary follow-up; technical security logs incident investigation; Contracts, payments and legal records are limited to the relevant legal obligations and claim periods. No unnecessary personal data is collected; It is deleted, destroyed or anonymized when the processing purpose and valid legal reason expire.

SaaS concrete retention periods of report records that do not contain accounts and source code, deletion cycle from backups and customer deletion options are notified before the service is opened. The legal retention requirement covers only relevant records; It cannot be used as a justification for archiving the entire repository or source code.

10. Your rights regarding your personal data

With the conditions within the scope of KVKK article 11; You have the right to learn whether your personal data is processed, to request information if processed, to learn its purpose and appropriate use, to learn about domestic/international recipients, to have incomplete or inaccurate information corrected, and to request deletion or destruction when the conditions are met.

You may ask us to notify recipients of your data of its correction or deletion, object to an adverse outcome based solely on automated analysis, and seek compensation for damage caused by unlawful processing.

You can send your request to info@vulkill.com. Duly applications are concluded as soon as possible and within 30 days at the latest; Necessary guidance can be given regarding identity/authority verification or legal application method. Do not include identification documents, passwords, or unnecessary sensitive data in the initial email. Your complaints and other legal remedies to the Board are reserved.

11. Your rights under the GDPR

If the GDPR applies to the relevant activity, you have the right to access your data, rectify, erase, restrict processing, portability and object to processing based on legitimate interest, subject to its conditions. You can object to direct marketing at any time and withdraw your consent in transactions based on consent. These rights are subject to exceptions, such as required legal retention.

You can send your request to info@vulkill.com. A response is given without unnecessary delay, as a rule, within a month. If necessary due to complexity or number of requests, an extension of up to two months may be available; The reason will be notified within the first month. If the request cannot be fulfilled, the reason and remedies are explained.

You reserve the right to complain and take legal action to the competent data protection authority where you live, work or where you think the violation has occurred. Reasonable authentication can be done; Do not send a full copy of your identity document or unnecessary sensitive data when you first apply.

12. Updates

When there is a new data processing activity or significant change, this text is updated and necessary additional information is provided. The date of the current version is located at the top of the page.