Privacy notice. What we keep, and why.

Wennes Biyoteknoloji Limited Şirketi, a limited liability company registered in Türkiye · MERSIS no. 0807071512000001 · trade registry no. 1044781 · Beylikdüzü tax office, tax no. 8070715120 · registered electronic mail (KEP) wennesbiyoteknoloji@hs01.kep.tr · Atatürk Mah. Hadımköy Yolu Cad. No: 10 İç Kapı No: 7, Esenyurt / İstanbul, Türkiye. We trade as Unique Alphabet®.

Write to hello@uniquealphabet.com about anything in this notice. Security reports go to dev@uniquealphabet.com.

We are the controller for website visits, forms, your account, your users, the Audit Log, support and billing records.

We are your processor for what your company puts into the platform: formulas, product files, supplier documents, and the details of your assessor, your Responsible Person, supplier staff and share recipients. For this content your company is the controller; we process it only on its instructions and under the Data Processing Agreement attached to the Terms of use. Informing those people is your company's duty.

We do not use your data for advertising, we do not sell it, and we do not build profiles of you from it. No automated decision has legal effects on you. The platform itself uses no analytics.

Formulas, product files, supplier documents and reports belong to your company. We use them only to run the platform for you: to check, calculate, draft, store, share where you choose, and export. We do not use them to train AI models.

Two modules send text to an AI service: Label Check and the Assistant.

Label Check. What is sent: the label text you paste (up to 20,000 characters), or the label file you upload itself (PDF or image, up to 4 files). We strip email addresses and phone numbers from pasted text before sending, and we do not send file names. An uploaded file goes as it is; if you do not want personal data in it, paste the text instead. No formula, product record, company profile, user name or email goes with it. Labels must by law show the Responsible Person's name and address, so these can be part of the text; where the Responsible Person is a company, that is not personal data.

The provider is Anthropic, PBC (USA), and no other. Under Anthropic's commercial terms the data is not used to train models and is deleted at the provider within 30 days. We keep the model's answer and a fingerprint (hash) of what was sent; we do not keep the sent text or file separately for this purpose.

Your company's Owner or an Administrator can switch off every AI operation in the platform at once with the "AI in Label Check and the Assistant" setting. While it is off, no text goes to any provider and the rule-based checks keep working. The screen says where the text will go before it is sent.

Assistant. The question you type to the Assistant is sent to the same provider (Anthropic) so that we can understand what you are asking; the last six turns of the conversation (up to 400 characters each) go with it. The Assistant works in three layers:

• Public data (regulations, shared toxicology sources) is used as it is.
• Your account's data reaches the model only as placeholders: a marker such as "PRODUCT_1" instead of the product name; values such as formula percentages and results are not sent. Account information in earlier answers goes in the conversation turns under the same rule. The model does not write the answer; the platform puts the values back from its own records.
• If a value is needed, it asks. If a better answer needs particular values, the Assistant stops and shows a permission card saying which fields of which product it needs, and why. The permission covers only that product and those fields (there is no broad permission such as "all my formulas"), lasts at most for that conversation and is asked again in every new one. Each permission is written to the audit log and listed in Settings. If you say no, the Assistant still answers and says plainly what it could not know. The note under the answer says what was sent: "Your formula data was not sent to AI" or "The {n} values you allowed were sent".

Your company's Owner or an Administrator chooses the permission policy: off (values are never sent), ask (the person asking is asked) or ask an admin. Do not type personal or sensitive information into questions; the Assistant says so under the message box. The setting above switches the Assistant off as well; while it is off, no question goes to any provider. How we keep your conversations is in §08.

The platform, its database, files and the emails we send are kept in İstanbul, Türkiye, at GNET İnternet Telekomünikasyon A.Ş., for every account, wherever the company is.

The website and the Talk to us form run on the same servers; only analytics, if you accept it, runs abroad, on Google (USA). In the platform, Label Check and Assistant AI runs at Anthropic (USA).

Groups of recipients and why

• Our service providers (processors): for hosting, email, the website, analytics, AI and the newsletter — table below.
• Your company: if you are a team member, your company's administrators see your account and activity details, so the company can run its account.
• Recipients you choose: when you send a share link, the file and link details.
• Public authorities and courts: only where the law requires it, and only what is required.
• Tax number check: on Free, we send an EU VAT number to the European Commission's VIES system, and a UK VAT number to HMRC, only to check whether the number is valid. A Turkish tax identification number or national ID number is not sent anywhere; it is checked only by its check digit (Terms of use §04).
• Payment institution and e-invoicing provider: once online payment opens, to take payment and issue invoices (announced 30 days before they join this list).

We keep error records on our own server. We tell customers 30 days before a new provider joins this list.

Transfers abroad (KVKK Art. 9). We have asked the two providers abroad (Anthropic and Google) in writing to sign the standard contracts published by Türkiye's Personal Data Protection Board, and we notify the Board of each signed contract within five working days. Until that is complete: analytics runs only if you accept it; you can write to hello@uniquealphabet.com instead of using the Talk to us form; and your company can switch off AI (Label Check and the Assistant) with one setting.

• Account data and your company's content: while the account is open. Closing it starts a 90-day wait in which you can export everything and undo the closure; then the account is deleted.
• Free allowance fingerprint: when the account is deleted, your tax number is deleted with the account data. Only the number's keyed fingerprint (HMAC) and the number of Free new files used remain; no company name, address, email or content remains. These two are kept for 5 years after closing, so that a Free account reopened with the same number knows how many of its new files are left; then they are deleted. The number cannot be recovered from the fingerprint; it only matches when the same number is entered again. For an account that has had a paid period, the tax number on invoices stays as part of the billing record for 10 years (below); that record is not used to check the Free allowance.
• If a paid period ends or a payment fails: 90 days of read-only access and downloads; then account closure begins.
• Audit Log: entries older than 400 days move to a protected archive and are kept there for 10 years. Because the record cannot be rewritten, entries stay for that time even after the account is closed.
• IP addresses and browser details (Audit Log, share views, records): 1 year; then removed, while the event itself stays.
• Error records: deleted 90 days after the error was last seen.
• Platform usage: deleted after 90 days; only daily counts per company remain (no person), and those go when the account is deleted.
• Assistant conversations: only you can see your conversations (not even your company's Owner or an Administrator). They are deleted 90 days after the last message; you can delete them yourself at any time, and they are deleted with the account data when the account closes.
• Record of emails we send: 2 years.
• Support requests: deleted when the account closes; while it is open, 3 years after the request is closed.
• Record of accepted terms, billing and subscription records: 10 years (Turkish Commercial Code Art. 82).
• Talk to us messages: 2 years after the conversation ends; if you become a customer, with your account data.
• Newsletter subscription: until you unsubscribe; we keep the unsubscribed address on a suppression list so we do not write to it again. If you submit the form again, the suppression is lifted and you are subscribed again.
• Company address that received an introductory email: until the company unsubscribes or asks us not to write; after that the address stays on the suppression list, marked "do not contact", so it is never written to again.
• Website analytics: 2 months in Google Analytics; the cookie expires after 13 months or when you withdraw consent.

Data whose period has ended is deleted or anonymised at the next periodic disposal, within six months at the latest; we keep a record of disposals for 3 years.

You can ask us: whether we process your data; for information about it; for the purpose and whether it is used for that purpose; who it has been transferred to in Türkiye or abroad; to correct it if incomplete or wrong; to delete or destroy it under the conditions in KVKK Art. 7, and to tell those it was transferred to; to object to an outcome against you that results solely from automated analysis; and for compensation if you suffer damage from unlawful processing. You can withdraw consent at any time (unsubscribing from the newsletter or Cookie settings on the website is enough).

How to apply (Communiqué on the Procedures and Principles of Application to the Controller, Art. 5): in Turkish or English,

• in writing to our address in §01,
• by registered electronic mail (KEP) to wennesbiyoteknoloji@hs01.kep.tr,
• by email signed with a secure electronic or mobile signature to hello@uniquealphabet.com,
• or to hello@uniquealphabet.com from the email address you gave us before and that is registered with us.

Include your name, signature (if on paper), national ID number or, if you are not a Turkish citizen, nationality and passport number, an address or email, and your request. We answer free of charge within 30 days; if the request involves a separate cost, the Board's fee schedule may apply. If the request concerns your company's content (where your company is the controller), we pass it to your company without delay.

If you ask us to delete Audit Log entries, we tell you in writing, with reasons, that we keep them for the period in §08 because of our legal obligations and as evidence in case of a dispute (KVKK Art. 5(2)(ç), (e)).

If our answer does not satisfy you, or you have no answer within 30 days, you can complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application.

Connections use TLS 1.2 or 1.3. Passwords are stored as hashes. Each company's data is kept separate, and the server enforces it row by row. Significant actions in the platform are written to an Audit Log on a SHA-256 chain. Two-step sign-in is available to every user. When our staff may access content is limited by a written policy. The details, with the dates they were measured, are on Security and data.

If we learn of a breach affecting your personal data, we notify the Board within 72 hours and you as soon as possible.

The platform is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data.

When this notice changes, the date and version at the top change; earlier versions are available on request. If a change affects how we use your account data, we email account owners before it takes effect.

Our service is for companies that operate, or want to operate, in Türkiye; we do not offer services for the EU or UK market. If your company is based abroad and you are in the EU or the UK, we summarise here, for information, your rights under the GDPR and the UK GDPR. Everything above applies to you too.

• Legal bases (Art. 6(1)): the "contract" rows in §03 rely on (b); "legal obligation" on (c) — where the obligation comes from Turkish law, for EU and UK law we rely on (f), our legitimate interest in complying with it; "legitimate interest" on (f); "explicit consent" on (a). Our legitimate interests are keeping the platform secure, being able to prove who did what, answering questions, fixing errors and seeing which parts of the platform are used so we can improve it. In the "Free allowance" row, our legitimate interest is stopping the free plan being used again by the same company through more than one account; for this we keep only the number's fingerprint and a count (§08).
• Your further rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20 — receiving data you provided, processed on contract or consent, in a machine-readable format), and objection to processing based on legitimate interest (Art. 21). You can leave the newsletter at any time. We answer within one month.
• Audit Log and erasure: we keep Audit Log entries for the period in §08 for the establishment, exercise or defence of legal claims (Art. 17(3)(e)).
• Where your data goes: we are a company in Türkiye; we process your data where §06 says, that is in Türkiye and, for the website and AI, in the USA.
• Complaints: you can complain to the data protection authority of the EU country where you live or work, or in the UK to the Information Commissioner's Office (ICO).