Data Protection Notice (KVKK)

Under Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is FAST AI LABS LTD, registered in England and Wales under company number 16054440. The Company processes personal data for the XPatla service as described below.

Registered office: 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF, United Kingdom

Web: fastailabs.com

Email: [email protected]

The personal data we process includes:

• Identity and Contact: Name, username and email address
• Social Media: Connected X username, public profile and posts, and granted OAuth scopes
• Content: Prompts, sources, style data and generated drafts
• Transaction Security: IP address, device, cookie preferences, access and error logs
• Financial Transaction: Subscription and payment metadata; card data is processed by Stripe
• Usage and Support: Credit activity, feature usage and support communications

Your personal data is processed for the following purposes:

• Providing and maintaining our services
• Processing membership transactions
• Performing style analysis for AI-powered content generation
• Managing payment and billing processes
• Customer relationship management
• Improving service quality
• Fulfilling legal obligations
• Managing information security processes

Your personal data is processed based on the following legal grounds under KVKK Article 5:

• Processing necessary to establish or perform a contract
• Processing necessary to comply with a legal obligation
• Processing necessary to establish, exercise or protect a right
• Processing necessary for legitimate interests without harming fundamental rights
• Separate explicit consent for specific processing where consent is required by law

Your personal data may be shared with:

• Clerk for authentication
• Supabase for database and infrastructure services
• Stripe for payment services
• X for user-authorised account connections
• OpenRouter, relevant model providers and Google AI where used for AI processing
• Resend for transactional communications and Cloudflare for network security
• Authorised public bodies where legally required

for the purposes stated above.

Important: International transfers are made only where an applicable mechanism under KVKK Article 9 is available, such as an adequacy decision, appropriate safeguard, standard contract or another mechanism permitted by law. Where a specific transfer requires explicit consent, it is requested separately and freely; merely using the service is not treated as consent.

Your personal data is collected:

• Through our website and application
• Through email and other communication channels
• Through cookies and similar technologies
• Through the Twitter/X API (publicly available data)

through automatic and non-automatic means.

Under Article 11 of KVKK, you have the following rights:

• To learn whether your personal data is being processed
• To request information about your personal data if it has been processed
• To learn the purpose of processing your personal data and whether it is used in accordance with its purpose
• To know the third parties to whom your personal data has been transferred domestically or abroad
• To request rectification of your personal data if it has been incompletely or incorrectly processed
• To request deletion or destruction of your personal data within the framework of conditions set forth in KVKK Article 7
• To request notification of rectification, deletion, and destruction operations to third parties to whom your personal data has been transferred
• To object to any result that is against you through the analysis of your processed data exclusively by automatic systems
• To claim compensation for damages incurred due to unlawful processing of your personal data

You can use one of the following methods to exercise your rights stated above:

• Email: Apply to [email protected] with documents verifying your identity
• In-App: Data deletion request through account settings

Your applications will be concluded within 30 days at the latest. If the process requires an additional cost, the fee schedule determined by the Personal Data Protection Board will apply.