Privacy Notice (KVKK)
Version 2026-11-06 · Effective 6 November 2026
This notice is given under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Obligation to Inform. It explains how your personal data is processed when you use the Viyu app and website and when you join the waitlist. It is information, not consent. The texts for processing that needs your explicit consent are separate: Consents. The Turkish version prevails if the two differ.
Viyu is an independent private company. We are not affiliated with any government, embassy, consulate or visa application center. Only the relevant authorities decide on applications.
1. Data controller
- Name: Neuros Studio
- E-mail: viyu@neuros.com.tr
The company's registered trade name is provided by e-mail on request for formal applications.
2. First: data we do not process
- Your documents. Documents you add to the app (passport page copy, bank statement, payslip, social security record, criminal record, medical report and the like) are kept only in the encrypted vault on your phone and checked only on your phone. The document, its image, its text and anything read from it are never sent to our servers or to the AI provider. Documents are deleted from your phone automatically 30 days after your goal ends; we remind you 3 days before.
- ID numbers. We never ask for or store passport numbers or Turkish national ID numbers. We don't scan your passport (no MRZ, NFC or photo reading) and don't connect to e-Devlet.
- Your name. Your name and your family members' names stay on your phone.
- Location and contacts. We don't access your location or contacts; you choose your province yourself.
- Biometric data. Not processed.
3. Categories, purposes and legal bases
| Data category | Examples | Purpose | Legal basis (KVKK) |
|---|---|---|---|
| Identity and contact | E-mail address; Apple or Google account ID | Opening your account, verifying sign-in, service messages | Establishing and performing the contract (Art. 5/2-c) |
| Profile and plan | Stage, goals and countries, dates, province, birth year, work status, social security type, income band, ties, languages; family members' relationship and birth year | Your personal plan, checklist, timeline and reminders | Performing the contract (Art. 5/2-c) |
| Travel and visa details | Passport type, issuing country, issue and expiry dates; visa types and dates; application stage, center, appointment date; refusal country, date and ticked standard grounds; trips (dates, countries, cities) | Day Ledger (90/180), expiry reminders, travel log, application tracking | Performing the contract (Art. 5/2-c) |
| Document status | Document type, ready or not, issue and validity dates, deletion day (not the content) | Freshness and deletion reminders | Performing the contract (Art. 5/2-c) |
| Customer transactions | Plan bought, period, renewal status, store transaction ID; support messages; "This is wrong" reports | Unlocking your plan, managing the subscription, support, correcting the rule base | Performing the contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| Transaction security | IP address, session and device data, access logs, content-free error logs | Protecting your account and the service, preventing abuse, fixing errors; duties under Law No. 5651 | Legitimate interest (Art. 5/2-f); legal obligation (Art. 5/2-ç) |
| AI processing | Your question, the chat's latest messages, letter note; destination country, visa type, date range by month, stage, experience level | Assistant answers and letter drafts | Explicit consent (Art. 5/1); Art. 9 for the transfer abroad |
| Community contributions | Slot radar observation (center, visa type, date, waiting time); Türkiye's Route board row | User-reported slot radar and anonymous board | Explicit consent (Art. 5/1) |
| Usage statistics | Pseudonymous usage events: the app opening, going to the background and time spent, screens opened, button taps, fixed keys of first-run choices (purpose, destination country code, timing), account, Premium screen and purchase steps, errors seen; random install ID, app and operating system version, platform, device model, phone language; crash reports; on Android, the Google advertising ID read by Firebase and Meta. No document content, ID numbers, names, e-mail, location or typed text | Understanding and improving how the app is used (linked to your account if you are signed in), fixing crashes, measuring which ad campaigns (Google Ads, Instagram and Facebook) bring installs that reach these steps | Legitimate interest (Art. 5/2-f); can be turned off in Profile › Privacy & data |
| Install source | The channel and campaign an install came from: Apple Ads campaign, ad group and keyword numbers (Apple AdServices); Google Play campaign codes and whether there was a Google Ads click; an encrypted digest of the random install ID. No advertising ID | Aggregate measurement of our ad and promotion campaigns; when you use the app signed in, association with your account together with your usage events | Legitimate interest (Art. 5/2-f); the account link can be turned off with the Usage statistics switch |
| Marketing | Consent and preferences for commercial messages | Offer notifications, campaign e-mails | Explicit consent (Art. 5/1) and consent under Law No. 6563 |
| Waitlist | E-mail address, language, optional destination, campaign codes, consent record | Launch e-mail, e-mail verification, aggregate campaign measurement | Explicit consent (Art. 5/1); legitimate interest for measurement (Art. 5/2-f) |
| Legal records | Consent records (which text version, when), deletion records (content-free) | Proving consent and compliance | Establishing, exercising or protecting a right (Art. 5/2-e); legal obligation (Art. 5/2-ç) |
Special categories of data. If you want to add a document such as a criminal record or a medical report, the app first asks for a separate explicit consent (Art. 6). Such documents also stay only in the encrypted vault on your phone and are never sent to our servers or to AI. The app never asks about religion, ethnicity or political opinion.
4. How we collect it
Electronically and by automated means: when you enter it into the app or the website forms, when you sign in with Apple or Google (the account ID and e-mail they pass to us), when you buy a plan (purchase records via Apple, Google and RevenueCat) and when you use the app (security records, the install source on first launch and, unless you turned off Usage statistics, usage events and crash reports; part of these go directly to Google through the Firebase software in the app, and to Meta through the Meta software).
5. Who receives it and why
| Recipient | Purpose | Data | Location |
|---|---|---|---|
| Our own server | Providing the service | The data this notice says we process | Türkiye |
| Resend (e-mail delivery) | Sign-in code and waitlist e-mails | E-mail address, e-mail text | USA |
| Apple | Sign in with Apple, App Store purchases, push delivery (APNs), Apple Ads install measurement (AdServices) | Account ID, purchase record, device token, notification text without sensitive details; the install's one-time AdServices code | USA, Ireland |
| Sign in with Google, Google Play purchases, push delivery (Firebase Cloud Messaging) | Account ID, purchase record, device token, notification text without sensitive details | USA, EU | |
| Google: Google Analytics for Firebase and Firebase Crashlytics (Google LLC / Google Ireland Ltd.; can be switched off) | Product statistics, fixing crashes, measuring Google Ads campaigns | Some usage events (first open, first-run start and finish, goal created, sign-up and sign-in, Premium screen, trial and purchase), crash reports (stack trace, device model, operating system, app version), the Viyu account number as a pseudonymous ID; on Android, the Google advertising ID | USA, EU |
| Meta: Meta SDK (Meta Platforms Ireland Ltd.; can be switched off, off in the EEA, UK and Switzerland) | Measuring our Instagram and Facebook ads | Install and app opens, a few usage steps (first-run finish, sign-up, first alarm follow, goal created, Premium screen), App Store / Google Play purchases and trials, device model, operating system, app version; on Android, the Google advertising ID. No account number, name or e-mail | USA, EU |
| RevenueCat | Syncing purchases with the stores | Pseudonymous user ID, purchase records, device platform | USA |
| DeepSeek (only with your consent) | Assistant and letter drafts | Question, the chat's latest messages, letter note, plan basics (destination country, visa type, date range by month, stage, experience) | People's Republic of China |
| Authorised public bodies and courts | Legal obligation | Only the data legally required | Türkiye |
- We never sell your data or share it with data brokers. The app shows no ads. Usage events sent to Google are used only for product statistics, crashes and measuring our own Google Ads campaigns; ad personalisation signals are turned off. On iPhone no advertising identifier (IDFA) is read and no tracking permission is asked.
- These providers act as data processors on our instructions. Apple and Google also process data under their own policies for sign-in and payment services.
6. Transfers abroad
Transfers to recipients outside Türkiye in the table above are made under Article 9 of the KVKK: standard contracts announced by the Board are signed with these providers and notified to the Personal Data Protection Authority within 5 business days of signing.
The transfer to the AI provider (DeepSeek, servers in the People's Republic of China) additionally depends on your explicit consent. Without it, nothing is sent to the AI provider and the rest of the app keeps working. The provider may retain this data and use it to improve its service under its own terms; that is why documents, ID and account details are never sent to the assistant, and our server does not forward any text containing such patterns.
7. Retention
| Data | Period |
|---|---|
| Documents on your phone (not on our servers) | Deleted automatically on your phone 30 days after the goal ends; reminder 3 days before |
| Account, profile, plan, document status, travel log | While the account is open; on deletion immediately, from backups within 35 days |
| Slot radar observations | 180 days; then only identity-free totals |
| Türkiye's Route board rows (identity-free) | 18 months; then only totals |
| Usage statistics events (Viyu's server) | 180 days; those linked to an account are deleted with it |
| Usage events in Firebase (Google Analytics) | 14 months |
| Crash reports (Firebase Crashlytics) | 90 days |
| Install source record | 24 months |
| AI usage records (content-free) | 13 months |
| Support messages | 2 years after closing |
| Consent records | 10 years |
| Purchase and invoice records | 10 years |
| Access and security logs | At least 1, at most 2 years (Law No. 5651) |
| Waitlist record | Until consent is withdrawn; at most 12 months after Viyu launches |
| Deletion and destruction records (content-free) | 3 years |
When a period ends, data is deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Full list: Privacy Policy.
8. Your rights (KVKK Art. 11)
You can apply to us to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties it is transferred to, in Türkiye or abroad,
- ask for it to be corrected if incomplete or inaccurate,
- ask for it to be deleted or destroyed under the conditions of Article 7,
- ask for corrections, deletions and destructions to be notified to third parties it was transferred to,
- object to an outcome against you that results solely from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
You can withdraw any explicit consent at any time, with effect for the future: Profile → Privacy & data. You turn off usage statistics, which rest on legitimate interest, with the Usage statistics switch on the same screen.
9. How to apply
E-mail viyu@neuros.com.tr from the address registered in the app, with "My personal data" in the subject line.
Include your name, the e-mail address linked to your account and your request. We reply free of charge within 30 days at the latest; our target is 7 days. If the request involves an extra cost, a fee may be charged under the Board's tariff. If you find our reply insufficient or receive none in time, you can complain to the Personal Data Protection Board.