KVKK Privacy Notice

This notice has been prepared in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

Data controller: Hertz Teknoloji Medya Yayıncılık Pazarlama ve Ticaret Anonim Şirketi ("Whispi")
Address: Esentepe Mah. Şehit Mehmet Mikdat Uluünlü Sk. Propa Plus Residence No: 26 İç Kapı No: 26 Şişli/İstanbul
MERSİS: 0462107776330001 · Tax No: 4621077763 (Zincirlikuyu Tax Office)
KVKK applications: kvkk@whispi.io

This notice covers everyone who visits whispi.io and its subdomains, sends a question, opens an account or uses our forms. Whispi is exempt from the obligation to register with VERBİS; this exemption does not remove its other KVKK obligations.

Which data is processed depends on how you use the Service. Passwords are kept only as an irreversible digest; Whispi never stores your password in plain form.

• Every visitor

  Data processed

  IP address, browser and device information, pages visited and the time (access logs), cookie preference, language and theme preference, Cloudflare Turnstile bot verification token, and, if you have consented to analytics cookies, Google Analytics' random cookie identifier

• Guest asker

  Data processed

  In addition to the above: a digest of the guest cookie, the question and follow-up texts sent, uploaded images and selected GIFs, the selected avatar, the IP address at the time the question is sent, acceptance of the Terms of Use and the declaration of being 18 or over (version and date)

• Member

  Data processed

  In addition to the above: email address, username, display name, bio, avatar and cover image, X and Instagram usernames and Spotify link, time zone, account settings, session information (IP and browser), questions received and answers given, questions asked, block list, karma points and streak information, notification preferences and push device registrations, acceptance of the Terms of Use and the declaration of being 18 or over (version and date), a digest of the Broadcast Mode link

• Member who signs in with Google

  Data processed

  Name, email address and profile picture from the Google account

• Person who reports or is reported

  Data processed

  The reason for the report and its note, the text of the reported content and its attachment links, the identity and IP address of the content's author

• Form sender (contact, sponsorship, bug report)

  Data processed

  Name, email address, message, optional screenshot, browser and operating system information

Whispi does not collect date of birth, phone number, location or special categories of personal data (health, religion, political opinion, etc.). However, Users may share such information of their own will in their questions and answers; because this content is public, Whispi keeps it as part of the content. The location and device metadata of uploaded images is deleted at the moment of upload.

Your personal data is processed for the purposes below and on the basis of the legal grounds in Article 5 of the KVKK. The only processing based on explicit consent is analytics cookies (Google Analytics); all other processing is based on the legal grounds below.

• Creating an account, signing in and managing the account

  Data

  Email, username, password digest, Google profile information, session information

  Legal ground (KVKK Art. 5/2)

  (c) Formation and performance of a contract

• Receiving, answering, following up and publishing questions

  Data

  Question, answer and follow-up texts, attachments, avatar

  Legal ground (KVKK Art. 5/2)

  (c) Performance of a contract

• Recording the asker's sender information

  Data

  Account or guest number, IP address

  Legal ground (KVKK Art. 5/2)

  (f) Legitimate interest: preventing abuse, enforcing blocks; (ç) Legal obligation: Law No. 5651

• Automated content moderation

  Data

  Texts, conversation context, profile fields, images

  Legal ground (KVKK Art. 5/2)

  (f) Legitimate interest: user safety; (ç) Legal obligation

• Reviewing reports and imposing sanctions

  Data

  Report record, content snapshot, the author's account or guest number and IP

  Legal ground (KVKK Art. 5/2)

  (f) Legitimate interest; (e) Establishment and protection of a right

• Blocks and IP bans

  Data

  Account or guest number, IP address

  Legal ground (KVKK Art. 5/2)

  (f) Legitimate interest: protection of the Profile Owner

• Sending notifications (in-app, email, push)

  Data

  Email, push registration, notification content

  Legal ground (KVKK Art. 5/2)

  (c) Performance of a contract; preferences are managed in the settings

• Broadcast Mode

  Data

  Unanswered questions, the asker's avatar

  Legal ground (KVKK Art. 5/2)

  (c) Performance of a contract with respect to the Profile Owner; (f) legitimate interest with respect to the asker, as notified in clause 8 of the Terms of Use

• Bot verification and rate limits

  Data

  IP address, Turnstile token

  Legal ground (KVKK Art. 5/2)

  (f) Legitimate interest: security

• Access logs and traffic data

  Data

  Identity, IP, browser, time

  Legal ground (KVKK Art. 5/2)

  (ç) Legal obligation: Law No. 5651 Art. 5

• Error tracking

  Data

  Error records

  Legal ground (KVKK Art. 5/2)

  (f) Legitimate interest: continuity of the service

• Responding to form requests

  Data

  Name, email, message, device information

  Legal ground (KVKK Art. 5/2)

  (c) Pre-contractual steps taken on request; (f) Legitimate interest

• Recording acceptance of the Terms of Use and the declaration of being 18 or over (members and guests)

  Data

  Version, date

  Legal ground (KVKK Art. 5/2)

  (e) Establishment and proof of a right

• Responding to requests from competent authorities

  Data

  The data concerned by the request

  Legal ground (KVKK Art. 5/2)

  (a) Expressly provided for by law; (ç) Legal obligation

• Showing ads

  Data

  Total impression and click counts (not personal data)

  Legal ground (KVKK Art. 5/2)

  —

Whispi does not use your data for profiling or targeted advertising; ads are not chosen per person. It does not send emails for marketing purposes. It uses Google Analytics for site usage statistics; this only works if you give explicit consent by ticking the analytics option in the cookie notice (KVKK Art. 5/1), and you can withdraw your consent at any time. The details are in the Cookie Policy.

Your questions are anonymous towards the Profile Owner and other users; they only see the avatar you chose. A question's sender information consists of: the Whispi account it was sent from, or, if it was sent without an account (as a guest), a random guest number assigned to your browser; and in both cases your IP address. Whispi does not ask for or store official identity information such as a national ID number. For the security of the Service and legal obligations, when you send a question, the system records the question's sender information.

The use of this information, and its limits, are as follows:

• It is used so that the Profile Owner can block you; the Profile Owner blocks you without seeing the sender information.
• In the event of a report review or a request from a competent authority, the Whispi team can see from the admin panel from which account or guest number a question was sent. Your email and IP address are masked by default in the panel, and every access is logged.
• Sender information is never passed on to notifications, data export files or the Profile Owner.
• Your IP address in question and follow-up records is deleted automatically after 30 days. If you have been the subject of a report or a moderation record, your IP address is kept in that record for 1 year.
• Sender information is shared only upon duly made requests from public prosecutors, courts and other authorities empowered by law. "Who asked" requests from Profile Owners are not fulfilled.

Every question, answer, follow-up message, username, display name, bio and uploaded image goes through AI-based moderation before it is published. The moderation is carried out by an OpenAI model provided through the Bedrock service of Amazon Web Services, Inc. (410 Terry Ave North, Seattle, USA), acting as a data processor on Whispi's behalf. Sender information and your email are not sent to moderation; only the content and (for answers and follow-ups) the latest messages of the conversation are sent. Texts containing a phone number or an email address are rejected on Whispi's servers without being sent to moderation.

Moderation has two automated outcomes that affect you directly:

1. Rejection of content. The content is not published and you are shown the reason category. The rejected text is kept for 1 year, together with its context and sender information, in a record accessible to the Whispi team.
2. Hiding of the page from search engines. If moderation flags content as "needs review", the content is published, a review record is opened for the team and the page is hidden from external search engines, regardless of your settings and without notifying you.

Automated moderation never suspends or bans an account; only the Whispi team makes such decisions. Under KVKK Art. 11/1-g, if you believe that a result to your detriment has arisen from analysis carried out exclusively by automated systems, you can object through kvkk@whispi.io or support@whispi.io and ask for the decision to be reviewed by a person; objections are concluded within 15 days at the latest.

GIFs are not moderated by Whispi; the provider Klipy's own content filter applies.

Within Türkiye, your data is transferred only to public institutions and organisations with legal authority (prosecutors, courts, BTK, the Personal Data Protection Authority) upon a duly made request. Public content can, by its nature, be seen by all visitors and search engines.

Transfers abroad are made by signing the Standard Contract (controller to processor) announced by the Board under KVKK Art. 9 and notifying it to the Board. These contracts have been signed with Google Cloud and Amazon Web Services and notified to the Board. Cloudflare, Hostinger and Klipy are global service providers that do not offer the standard contract announced by the Board; the relationship with these recipients is based on their data processing agreements under the European Union General Data Protection Regulation (GDPR), independent security certifications and the technical limitations set out in the table below. All recipients are data processors acting on Whispi's behalf; they cannot use your data for their own purposes.

• Google Cloud EMEA Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland)

  Purpose

  Servers, database, file storage, system logs

  Data transferred

  All data

  Country / region

  Belgium (europe-west1)

  Safeguard

  Standard Contract 2

• Cloudflare, Inc.

  Purpose

  Traffic proxy, CDN, TLS, bot verification (Turnstile)

  Data transferred

  All traffic (content passes in clear because encryption is terminated at Cloudflare), IP address

  Country / region

  Global network, headquartered in the USA

  Safeguard

  Data processing agreement (DPA) under the GDPR and EU Standard Contractual Clauses; Cloudflare's own ISO 27001 and SOC 2 certifications; data is not stored at Cloudflare, only processed in transit

• Amazon Web Services, Inc. (USA)

  Purpose

  Automated content moderation (Bedrock)

  Data transferred

  Texts, conversation context, profile fields, images

  Country / region

  Called from Frankfurt; processing may take place in any AWS region

  Safeguard

  Standard Contract 2

• Amazon Web Services, Inc. (USA)

  Purpose

  Email delivery (SES)

  Data transferred

  Email address, notification content (question text, answer preview)

  Country / region

  USA (us-east-1)

  Safeguard

  Standard Contract 2

• Hostinger

  Purpose

  support@ mailbox

  Data transferred

  Form contents, daily report summary, KVKK applications

  Country / region

  Lithuania / EU

  Safeguard

  Data processing agreement (DPA) under the GDPR; data is processed within the European Union

• Klipy

  Purpose

  GIF search and display

  Data transferred

  From the server: search text, language, anonymous client identifier. From the browser: the IP and browser information of anyone viewing a GIF (GIFs are loaded directly from Klipy)

  Country / region

  Abroad

  Safeguard

  Data sent from Whispi's server is not personal data; GIFs are loaded by your browser directly from Klipy, and that connection is governed by Klipy's own privacy policy

• Google, Apple, Mozilla push services

  Purpose

  Web push notifications

  Data transferred

  Only the device address and the time of sending; content is end-to-end encrypted

  Country / region

  Depending on the browser vendor

  Safeguard

  Browser standard (RFC 8291); content cannot be read

• Google LLC

  Purpose

  Sign in with Google

  Data transferred

  Name, email and profile picture from your Google account (flows from Google to Whispi)

  Country / region

  USA

  Safeguard

  A sign-in started by you; Google's own privacy policy

• Google LLC (Google Analytics 4)

  Purpose

  Site usage statistics

  Data transferred

  Page view and interaction events, approximate location, device and browser information, random cookie identifier; no identity, email or content is sent

  Country / region

  USA

  Safeguard

  Your explicit consent (KVKK Art. 5/1); no IP address is processed, no identity or content is sent, Google Signals and advertising features are off; consent can be withdrawn at any time

Data is kept for the period necessary for the purpose and the period required by law; when the period ends, it is deleted, destroyed or anonymised.

• Account information, profile, settings, questions received and answers

  Retention period

  Until the account is deleted; permanently at the moment of deletion

• Questions and follow-ups asked to others

  Retention period

  Until that Profile Owner deletes them; anonymised when the account is deleted

• IP address in questions and follow-ups

  Retention period

  30 days

• Session records (IP, browser)

  Retention period

  At sign-out, password change or account deletion; expired sessions are cleared within 30 days

• An asker's IP block

  Retention period

  30 days

• IP ban imposed by the team

  Retention period

  Length of the ban (1–365 days) + 30 days

• Report records and automated moderation reports (text, context, sender information)

  Retention period

  1 year

• Guest cookie record

  Retention period

  1 year from last use; acceptance of the Terms of Use and the declaration of being 18 or over are kept with this record

• In-app notifications

  Retention period

  90 days

• Data export file

  Retention period

  7 days

• Form submissions (contact, sponsorship, bug)

  Retention period

  1 year

• Acceptance of the Terms of Use, declaration of being 18 or over and cookie consent preference (with date)

  Retention period

  Until the account is deleted

• Reserved username

  Retention period

  30 days

• Access logs (account, IP, browser)

  Retention period

  1 year (Law No. 5651 Art. 5)

• Error tracking records

  Retention period

  90 days

• Database and file backups

  Retention period

  7 days

• Team action logs

  Retention period

  13 months

In line with KVKK Art. 12 and the Board's Personal Data Security Guide, Whispi applies the following measures: storing passwords only as an irreversible digest, and guest, Broadcast Mode and share link tokens as digests; protecting traffic with TLS and keeping data encrypted on disk; httpOnly and Secure cookies; CSP and HSTS security headers; IP- and account-based rate limits for sign-in, questions, uploads and email; removing metadata from uploaded images; and not writing message content or email addresses to system logs.

Access to the admin panel requires two-step verification (TOTP), sessions expire after 12 hours, re-verification is required for critical actions, email and IP addresses are masked by default and every action of the team is written to an unalterable log.

In the event of a data breach, Whispi notifies the Board within 72 hours at the latest after becoming aware of the breach, in accordance with KVKK Art. 12/5, and informs the persons affected as soon as possible.

Under KVKK Art. 11 you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in line with that purpose; know the third parties to whom it is transferred in Türkiye or abroad; request rectification if it has been processed incompletely or inaccurately; request its erasure or destruction within the framework of the legal conditions; request that these actions be notified to the third parties to whom it was transferred; object to a result to your detriment arising from analysis exclusively by automated systems; and claim compensation if you suffer damage because of unlawful processing.

Within the app: Members can correct their profile information in the settings, download a copy of their data as a ZIP and delete their account. The ZIP file does not include IP addresses, session history, consent records, notifications or reports; for these, use the channel below.

Applications: In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can apply by email to kvkk@whispi.io or in writing to the address in section 1, together with information that verifies your identity. Your application is concluded free of charge within 30 days at the latest. This channel is open to everyone, including suspended users and guests.

If your application is rejected, the answer is found insufficient or no answer is given in time, you can file a complaint with the Personal Data Protection Board.

This notice is version 2.0 and is effective as of November 13, 2026. Changes are announced in three ways: a new processing purpose, a new recipient or a change that narrows your rights, with your explicit acceptance on the screen shown at sign-in; other significant changes, with an in-app notification or announcement; and corrections to spelling, links and contact details, only by updating the version and date on this page.