Personal Data Protection Disclosure
Last updated: March 2026 · Under Law No. 6698 (KVKK)
1. Data Controller
Your personal data within the EVRE platform is processed by EVRE in its capacity as data controller under the Personal Data Protection Law No. 6698 ("KVKK").
Contact: [email protected]
2. Personal Data We Process
The following categories of personal data are processed as part of your use of the platform:
Identity and Contact
Name, surname, email address
Training Performance
Simulation scores, XP points, level, achievements, scenario history
Simulation Content
Conversation flows from training simulations (fictional scenario dialogues, not real communications)
Voice Data(sensitive / özel nitelikli)
Only when you opt into voice mode. Processed in real-time for speech-to-text conversion; not stored, not used for identification
Technical Data
Session duration, scenario used, difficulty level, platform mode
Employee personal information such as real names, titles, or internal company data is never collected, transmitted, or shared with any third party through the platform. Only the data categories listed above are processed.
3. Processing Purposes and Legal Basis
Account creation and authentication
Performance of contract (Art. 5/2-c)Delivery of training simulation service
Legitimate interest (Art. 5/2-f)Training performance measurement and reporting
Legitimate interest (Art. 5/2-f)Voice mode (speech-to-text conversion)
Explicit consent (Art. 5/1, sensitive data)Platform security and error tracking
Legitimate interest (Art. 5/2-f)Internal service quality improvement
Legitimate interest (Art. 5/2-f)4. Voice Data Notice
Voice mode is entirely optional and only activates when you explicitly enable it. Voice audio is processed in real-time solely for speech-to-text conversion; it is not stored, not used for biometric profiling, and not retained after the session ends. You can withdraw your consent at any time by simply disabling voice mode.
Voice data is considered sensitive personal data under KVKK. Processing is based on your explicit consent (KVKK Article 6). Depending on your preference and subscription tier, speech-to-text conversion may be handled by different providers. EVRE offers and continues to develop options that minimize international data transfers. When a provider based outside Turkey is used, voice data is transmitted only during the active session and is not stored by the provider. If you do not use voice mode, no audio data leaves Turkey.
5. Simulation Data and Content
Simulation conversations are entirely fictional: you interact with AI-generated characters in scripted training scenarios. No real personal or business communications take place. Conversation histories are retained only for the purpose of generating training performance metrics and debrief reports. They do not contain real employee communications, internal company information, or any data that could identify individuals outside the platform context.
6. Data Processors and International Transfers
Your data may be shared with the following categories of service providers for the stated purposes. Transfers to providers outside Turkey qualify as international data transfers under KVKK Article 9 and are based on your explicit consent.
Cloud infrastructure providers
Database hosting, authentication, and application deployment (EU and international servers)
AI service providers
Simulation engine powering AI-driven training conversations (international servers)
Voice processing providers
Speech-to-text and text-to-speech conversion, only when voice mode is enabled by user preference (provider location varies)
Error monitoring providers
Platform stability and error tracking; no personal data is transmitted to these providers
Data Processing Agreements (DPA) are in effect with all providers. A detailed list of sub-processors is available in our Privacy Policy.
7. Data Protection Agreements
EVRE maintains Data Processing Agreements (DPA) with all service providers listed above. These agreements define the scope, purpose, and duration of data processing, require sub-processors to implement appropriate technical and organizational measures, and prohibit them from using your data for any purpose other than the services they provide to EVRE.
No employee personal information, real company data, or internal business communications are ever transmitted to these providers. Only the minimum data necessary for the simulation service is shared.
8. Internal Model Improvement
Anonymized and aggregated simulation data (such as overall performance patterns and scenario effectiveness metrics) may be used to improve EVRE's own internal service quality. This data cannot be traced back to individual users. Your data is never shared with, sold to, or used to train third-party AI models. Third-party AI providers (such as Google Gemini and ElevenLabs) process your data only in real-time during active sessions and do not retain or use it for their own model training.
9. Data Retention
Your personal data is retained for the duration of your active account. When you delete your account, all personal data is permanently removed from the platform. You can delete your account at any time from Settings. Specific retention periods:
Account data
Until account deletion
Simulation history
Until account deletion
Voice audio
Not stored (real-time processing only)
Error logs
90 days
10. Your Rights (KVKK Article 11)
As a data subject, you have the following rights:
- Learn whether your personal data is being processed
- Request information about processing activities
- Learn the purpose of processing and whether data is used accordingly
- Request correction of your data
- Request deletion or destruction of your data
- Learn about third parties to whom your data has been transferred
- Object to decisions made solely by automated systems that produce adverse effects
- Withdraw consent given specifically for voice mode
To exercise your rights, contact [email protected] or apply to the Personal Data Protection Authority (kvkk.gov.tr).
11. Security
EVRE implements appropriate technical and organizational measures to protect your personal data, including: encryption in transit (TLS 1.3) and at rest (AES-256), row-level security policies on every database table, rate limiting on all API endpoints, strict content security headers, and access controls based on organizational roles.
12. Contact
For questions about this disclosure or to exercise your KVKK rights:
KVKK Requests: [email protected]
General Privacy: [email protected]
This disclosure has been prepared under Article 10 of the Personal Data Protection Law No. 6698.