Membership and Account Privacy Notice
Last updated: 2026-09-11
This notice explains how personal data about your account is processed when you create an account at account.youreply.com.tr, sign in, join a team and use the YouReply Survey application. YouReply is the data controller for this data.
1. Data controller
| Trade name | YouReply Teknoloji Ticaret Eğitim Danışmanlık Araştırma Organizasyon A.Ş. |
|---|---|
| Address | Hacettepe Üniversitesi Teknoloji Geliştirme Bölgesi, Beytepe Kampüsü, 6. Ar-Ge Binası C Blok, Çankaya / Ankara |
| Phone | +90 532 317 20 23 |
| info@youreply.com.tr | |
| Data protection requests | kvkk@youreply.com.tr |
| MERSIS No | 0982 1041 0030 0001 |
| Trade Registry No | 495271 |
| Tax Office / No | Doğanbey / 9821041003 |
2. Data processed, purposes and legal bases
| Data | When it is collected | Purpose | Legal basis (KVKK Art. 5) |
|---|---|---|---|
| First name, last name, email address | When you create an account; if you are invited to an organization account, your email address is entered by the account admin | Opening the account, sign-in, account and service notices | Art. 5(2)(c) conclusion or performance of a contract |
| Password hash | When you create an account and when you change your password; the password itself is not stored | Authentication | Art. 5(2)(c); Art. 5(2)(ç) data security obligation |
| Phone number (optional) | When a phone number is saved to your account | Sign-in with your phone number and a 6-digit code sent by SMS | Art. 5(2)(c) |
| One-time verification codes | When you request a password reset or phone sign-in | Authentication | Art. 5(2)(c); Art. 5(2)(ç) |
| Organization name | When you create an organization account | Creating and displaying the organization account | Art. 5(2)(c) |
| Enterprise single sign-on (SSO) data: user identifier and email address sent by the identity provider | If your organization has set up SSO via SAML 2.0 or OIDC and you sign in that way | Enterprise authentication | Art. 5(2)(c); Art. 5(2)(f) for applying your organization's access policy |
| Session cookies: yr_session (7 days), auth_token in the survey application (30 days) | When you sign in | Keeping you signed in | Art. 5(2)(c) |
| Last sign-in IP address and time | At every sign-in | Account security, detecting unauthorized access, applying the inactivity rule | Art. 5(2)(ç) data security obligation; Art. 5(2)(f) legitimate interest |
| Audit log (administrative actions in the account; sensitive fields such as passwords are not logged) | When an administrative action is taken in the account | Traceability of actions in the account and security | Art. 5(2)(ç); Art. 5(2)(f) |
| Team membership, account and product roles, workspaces, invitations | When you join an organization account or are assigned a role | Authorization and team management | Art. 5(2)(c); Art. 5(2)(f) |
| Email delivery records (recipient, email type, time, result; content is hidden for code, invitation and password reset emails) | When an email is sent to you | Tracking and evidencing deliveries | Art. 5(2)(c); Art. 5(2)(f) |
In an organization account, the account owner and admins can see members' names, email addresses, roles and the audit log. Personal accounts have no team or workspace management.
3. Who receives it
- Hosting provider: Hosting Dünyam Bilişim Teknolojileri Tic. Ltd. Şti. (Türkiye),
- Email delivery: Amazon Web Services, Amazon SES (Germany),
- SMS sign-in codes: VatanSMS (Türkiye), phone number and code only,
- In organization accounts, the account owner and admins; if SSO is used, your organization's identity provider,
- Competent public authorities on request, as required by law.
The international transfer via Amazon SES relies on one of the transfer mechanisms provided for in Article 9 of the KVKK (for example, a standard contract). Full list: Sub-processor List.
4. Retention and deletion
- Account data is kept for as long as your membership continues.
- You can delete your account from the "Privacy" page in the account application. Steps and conditions: Account and Data Deletion.
- When deletion is completed, first and last name, email, phone, date of birth, identity and address details are anonymized; the password is removed; sign-in IP records, session tokens and account settings are deleted.
- A hashed value of your email address and phone number is kept on a block list for 1 month and then deleted.
- Order and invoice records are kept for 10 years as required by law, even if the account is deleted (Customer and Subscription Privacy Notice).
- Product data such as surveys, responses and uploaded files is not deleted by account deletion; its deletion must be requested separately.
- Inactivity: accounts with no sign-in for 2 years (counted from the sign-up date if there has never been a sign-in) receive a notice email. If there is no sign-in within 30 days, a deletion request is opened and the account is frozen; after a 7-day waiting period, deletion is completed with our team's approval.
5. Your rights
To exercise your rights under Article 11 of the KVKK, apply using the methods on the Data Subject Request Form page or send your questions to kvkk@youreply.com.tr.