KVKK Disclosure Text

1. Data Controller

Under the Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Spiron Teknoloji A.Ş. ("Spiron") as data controller, within the scope described below.

Address: Reşitpaşa Mah. Katar Cad. Arı Teknokent 2 Binası B Blok No: 4/2 İç Kapı No: 5, Sarıyer / İstanbul, Türkiye
Legal name: Spiron Teknoloji Sanayi Ticaret Anonim Şirketi
Responsible person: Adil Karaküçük
Tax office and number: Sarıyer Tax Office · 781 117 1793
Trade registry no.: 1157818
Central Registration System (MERSİS) No.: 0781117179300001
Phone: +90 531 380 14 15
Email: info@spiron.io

2. Personal Data Processed

a) When you visit the website:

• Transaction security data: IP address, browser type, access time
• Preferences: language and theme (kept in your browser's local storage)

b) When you submit the access request form or correspond with us:

• Identity and contact data: name, surname, email address, company name, country and the content of any correspondence
• Transaction security data: a hashed value derived from your IP address and the times of your requests, used to prevent abuse of the form

c) When you sign in to SynVoi Web:

• Your email address (with Google sign-in, the verified email of your Google account)
• Identity and profile data: the full name and the company (organisation) in your profile
• Account data: account status (pending / approved / blocked), sign-in method, sign-up, approval, profile and last sign-in times, your analysis allowance and the number of analyses used, your requests for additional analyses (together with your optional short note and the outcome); with Google sign-in, also whether the account is an organisational (Google Workspace) account
• Sign-in security: if you use two-step verification, the authenticator-app secret is stored encrypted; recovery codes, session tokens and one-time sign-in codes sent by email are stored only as hashes; the number of failed attempts and any temporary lock-out time
• Session data: session and CSRF cookies, session start and last-activity times, IP address
• Audit records: sign-in/out, failed codes, profile updates, requests for additional analyses and their outcome, account deletion requests, approval and blocking actions; email addresses are written masked (e.g. k***@example.com)
• Consent record: the date-time of your consent and the version of the text you accepted

d) When you upload audio to SynVoi Web:

• The audio itself and its file name — processed for the analysis, then stored encrypted for 30 days so the analysis result can be reviewed, and deleted automatically after that. Only authorised Spiron staff can access it; it is never used for model training.
• Analysis output: synthetic-speech score, verdict, model version used, audio quality class, audio duration and processing time. This output is written to the server's operational log together with your masked email address and IP address; the log contains no audio.

e) When you use the SynVoi mobile app:

• Identity and contact data: your email address (with Google sign-in, the verified email address of your Google account); if you want to buy a business package, the name and phone number of the authorised person and, for sole proprietorships in Türkiye, the Turkish national identity number
• Customer transaction data: account status, sign-in method, registration and last sign-in times, analysis time (total and used), purchase records (product, time added, Google Play order number, purchase token hash, time)
• Company details (for business packages): company name and country; in Türkiye, tax office and tax identification number; in other countries, a tax or VAT number
• Transaction security data: hashes of one-time sign-in codes and device session tokens, the device's brand and model name, session times, IP address; an audit log in which the email address is masked
• Consent record: the date and time consent was given and the version of the text you accepted
• Audio recording: processed in memory only for the duration of the analysis and deleted from the server as soon as it ends; not stored on the server
• Analysis output: the output described in item (d), written to the operational log in the same way

Data that stays on your phone (analysis history and the playback copy of the audio, the encrypted session token) is not transferred to Spiron.

Your voice is not processed as biometric data. Under KVKK Art. 6, voice qualifies as biometric (special category) data only when processed to verify or identify a person. The purpose of SynVoi Web and the App is not to identify you but to measure whether the audio was artificially generated; no identity matching, voiceprint extraction or speaker recognition is performed.

3. Purposes of Processing

• Delivering the website and keeping it running and secure
• Opening and managing your SynVoi Web account; assessing your request for access to SynVoi Web and your requests for additional analyses; contacting you about your account
• Opening and managing your SynVoi App account and keeping track of your analysis time
• Verifying in-app purchases, adding the time to your account and preventing the same purchase from being processed twice
• Recognising the company account when selling business packages and contacting the authorised person when necessary
• Securing sign-in and operating two-step verification (where used)
• Analysing whether the audio you submit is synthetic and showing you the result
• Reviewing analysis results by listening to the stored audio and assessing whether the model works correctly (not for model training)
• Preventing abuse: rate limiting, analysis allowances (quotas), detection of unauthorised access attempts
• Responding to access requests and correspondence
• Meeting legal obligations and providing evidence in potential disputes

Your data is never sold or rented to third parties for marketing, and no automated profiling producing legal effects about you is carried out.

4. Legal Bases

The legal basis relied upon for each category (KVKK Art. 5):

• Analysing audio (and, in SynVoi Web, storing and reviewing it): Art. 5/1 — your explicit consent. Analysis cannot start, in SynVoi Web or in the App, before you tick the consent box; you may withdraw consent at any time.
• Account, profile (full name, company), allowance request, sign-in and two-step verification data: Art. 5/2-c — directly related to establishing and performing the SynVoi Web service relationship
• App account, analysis time, purchase and company details: Art. 5/2-c — directly related to the conclusion and performance of a contract
• Website connection data, audit and operational logs, IP and rate-limit data: Art. 5/2-f — our legitimate interest in information security and in preventing abuse
• Preventing purchases from being processed twice and detecting abuse: Art. 5/2-f — our legitimate interest
• Access request form and correspondence data: Art. 5/2-c — directly related to entering into a contract, and Art. 5/2-f — our legitimate interest in responding to requests
• Statutory retention: Art. 5/2-ç — compliance with a legal obligation
• Use of records in potential disputes: Art. 5/2-e — establishing, exercising or defending a right

Where processing relies on consent, withdrawing it stops that processing from the moment of withdrawal.

5. Transfers, Including Abroad

This disclosure covers the spiron.io website, the access request form, the SynVoi web app (“SynVoi Web”) and the SynVoi mobile app. The SynVoi product is deployed on the customer's own infrastructure (on-premise); in those deployments audio, analysis and records never leave the customer's network, no data is transferred to Spiron, and Spiron is not the data controller.

Audio recordings are used only for the analysis and for reviewing its result, and are never shared with any third party; they are processed only on our servers on Amazon Web Services, by us.

The SynVoi Web and App infrastructure runs on Amazon Web Services in the Germany (Frankfurt) region, on a server with no external IP address. Your SynVoi Web and App data (account, session, security and analysis data; audio during the analysis) is therefore processed on infrastructure of a data processor located abroad within the meaning of KVKK Art. 9. Amazon Web Services acts as a data processor and its access is limited to what the hosting service requires.

Our website hosting and corporate email are also provided by service providers located abroad. The full list of providers and their locations, and information on the safeguards we rely on for international transfers, are set out in Sections 6 and 7 of our Privacy Policy.

If you use "Continue with Google", authentication is performed by Google and the information shared with Google during that step is subject to Google's own privacy policy. Using this option is not mandatory — SynVoi Web also offers sign-in with a one-time code sent to your email address.

In-app purchases are made through Google Play; your payment details are processed by Google and are not transferred to Spiron. To match a purchase with your account, an account hash that does not reveal your identity is passed to Google. In this operation Google is a separate controller subject to its own privacy policy.

Your personal data may additionally be shared with competent public authorities only where legislation requires it.

6. Method of Collection

Your personal data is collected electronically and by partly automated means through website forms, the SynVoi Web sign-in screen, technical information sent by your browser, audio you upload to SynVoi Web, and through the sign-in, purchase and company details screens of the SynVoi mobile app, the audio files you upload or share to the App and the purchase information received from Google Play.

7. Retention Periods

All retention periods are listed in Section 8 of our Privacy Policy.

8. Data Security

• All traffic is encrypted with TLS; HTTP requests are redirected to HTTPS
• The SynVoi mobile app communicates with the server only over an encrypted connection; the session token on the phone is encrypted with Android Keystore and excluded from backups
• The server has no external IP address and is reachable only through the load balancer and a web application firewall
• No passwords are used: you sign in with a one-time code sent to your email or with your Google account. Two-step verification with an authenticator app is mandatory for administrator accounts; for other accounts, depending on SynVoi Web's registration mode, it is either mandatory or can be turned on optionally from the profile
• Authenticator-app secrets are stored encrypted; session tokens and recovery codes are stored only as cryptographic hashes
• Accounts are temporarily locked after repeated wrong codes; per-IP rate limits and a per-user analysis allowance apply
• Stored audio is encrypted on the server with AES-256; only authorised administrators can listen to or download it, every access is logged, and the audio is deleted automatically after 30 days
• Access and security logs are kept; administrative actions are logged

9. Your Rights as a Data Subject

Under KVKK Art. 11 you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether it is used accordingly; know the third parties to whom data is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure or destruction under Art. 7; request that correction/erasure be notified to third parties; object to results produced solely by automated analysis; and claim compensation for damage arising from unlawful processing.

10. How to Apply

You may send your requests, together with information sufficient for us to verify your identity, in the following ways: to info@spiron.io from the email address registered in our system or using a secure electronic signature or mobile signature; or by a signed letter to the address in Section 1. Depending on its nature, your request is concluded free of charge within 30 days at the latest; if the action involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If you find our response insufficient or receive none in time, you may lodge a complaint with the Personal Data Protection Board.

To withdraw your consent or request deletion of your SynVoi Web or App account, writing to the same address is sufficient. You can also delete your App account immediately within the App.