Privacy Policy

Last updated: 3 October 2026

This notice explains what personal data AIFORUM processes, why, where it goes and what your rights are. It is our information notice under the Turkish Personal Data Protection Law No. 6698 (KVKK) and our privacy notice under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The data controller is Osman Hacıoğlu, who builds and runs AIFORUM. For any question or request about your data, write to info@aiforum.cloud.

2. What we process, why, and on what legal basis

  • Account details — email address (or phone number), nickname, password, and the two-factor secret if you turn 2FA on. Why: to create your account, sign you in and keep it secure. Basis: performance of our contract with you (KVKK art. 5/2-c, GDPR art. 6(1)(b)). Passwords are stored only as Argon2id hashes.
  • Acceptance records — the date and version of the Terms and of this notice that you accepted or acknowledged. Why: to prove the agreement between us. Basis: contract and our legal obligations (KVKK art. 5/2-ç).
  • Your workspace — groups, agents, messages, files, generated media and results you create or upload in the cloud workspace. Basis: contract.
  • API keys and provider sign-ins you add — stored encrypted and used only to call the provider you choose. Basis: contract.
  • Usage records — token counts per agent and provider. Why: to show your usage and apply your budgets and plan limits. Basis: contract.
  • Subscription details — your plan, its status and renewal date, and your Lemon Squeezy customer ID. We never see or store your card details. Basis: contract.
  • Device and connection details — names and status of the devices you link (for Remote Control and for running jobs on your own PC), and the app version. Basis: contract.
  • Support messages — what you send through the support form or by email. The in-app support email is pre-filled with your account and your device/browser details; you see them and can remove them before sending. Basis: contract and our legitimate interest in helping you (KVKK art. 5/2-f, GDPR art. 6(1)(f)).
  • Technical logs — IP address, time, requested address and browser type in our web server logs, and short service logs in which account emails are masked. Why: security, abuse prevention and fixing errors. Basis: legitimate interest.

We do not use your data for advertising, we do not sell it, we do not build marketing profiles and we make no automated decisions that have legal effects on you. We send only service emails (such as verification and security notices); we will not send marketing emails without your separate consent, and if you ever give it you can withdraw it at any time with the link in the email or by writing to us.

3. How we collect it

Most of it you give us directly: through the sign-up form, the app, the support form or email. Some is created automatically while you use the service (usage records, logs, device status). Your subscription status comes from Lemon Squeezy when you buy, and agent replies come from the AI providers you connect. All of it is collected electronically.

4. Features that handle data in special ways

  • Remote Control — the connection between your devices is set up through our server. The screen image, keyboard and mouse input and transferred files then flow directly between your devices, encrypted (WebRTC). A public Google STUN server helps your devices find each other and sees their IP addresses. We do not record your screen.
  • Jobs on your own PC — when the cloud workspace sends a job (for example image generation or a command) to a PC you linked, the job and its result pass through our server.
  • AI agents and tools — agents can read and write files and run commands in the folders and devices you allow. What they read can be sent to the AI provider that runs them.
  • MCP — if you connect an external MCP server or client, the data you send to it is processed by that service under its own terms.
  • Voices and faces — voice samples you use for voice cloning and photos you enhance can be personal data. We use them only to produce the result you ask for, never to identify anyone. Cloning or editing someone else's voice or face needs that person's permission.

5. Personal data of other people in your content

If you upload or process other people's personal data (for example photos, voices, documents or messages), you are responsible for having a lawful basis for it; for that data you act as the controller and we process it on your behalf only to run the service.

6. Who receives your data

  • Hostinger — hosts our server in Frankfurt, Germany, where your account and cloud workspace are stored, and delivers support-form messages to our inbox.
  • AI providers you connect (for example OpenAI, Anthropic, Google, NVIDIA) — when an agent uses a cloud model, the prompt and the context it needs are sent to that provider with your key or subscription, and the provider's own terms apply. With a local model, prompts are processed on your own computer.
  • Lemon Squeezy — sells and bills our subscriptions as the merchant of record and processes your payment.
  • Resend — delivers account emails such as email verification.
  • Google — reCAPTCHA protects the support form from spam, the STUN server helps Remote Control connect, Google Fonts serves this website's fonts and YouTube plays the launch video in privacy-enhanced mode.
  • Authorities — only when the law requires it.

7. International transfers

Because our server is in Germany and several of the services above are based in the United States, your data is transferred outside Türkiye (to Germany and the United States) and, for EU users, outside the EU (to the United States). These transfers are made on the basis of the appropriate safeguards provided in Article 9 of the KVKK and Chapter V of the GDPR, such as standard contractual clauses.

8. How long we keep it

  • Account, workspace, keys, devices and usage records: for as long as your account exists. When you delete your account they are removed from our server.
  • Acceptance records: for as long as your account exists and afterwards for the period in which claims can be brought (up to 10 years).
  • Support messages: up to 2 years after our last exchange with you.
  • Technical logs: up to 14 days.
  • Payment records: kept by Lemon Squeezy for as long as tax and accounting law requires.

9. Cookies and browser storage

  • This website sets no cookies of its own and runs no analytics or tracking scripts. It remembers your language and theme choice in your browser's local storage.
  • The web app uses one essential, HttpOnly session cookie to keep you signed in, and local storage for your preferences. No advertising or analytics cookies.
  • Third parties: the YouTube video sets no cookies until you press play; Google reCAPTCHA on the support page may set cookies and read device information to tell people from bots.

Because only essential storage is used, we do not show a cookie banner.

10. Your rights

You can ask whether we process your data; access it and receive a copy; learn why it is processed and whether it is used for that purpose; learn who it was shared with, in Türkiye or abroad; have it corrected; have it deleted or destroyed and have those you shared it with informed; object to a result that goes against you and comes only from automated analysis; and claim compensation for damage caused by unlawful processing (KVKK art. 11). Under the GDPR you can also restrict processing, object to it and receive your data in a portable format (arts. 15–22).

You can export all of your data or delete your account at any time from Settings in the app. For anything else, write to info@aiforum.cloud; we answer free of charge within 30 days. You can also complain to the Turkish Personal Data Protection Board or, in the EU, to your local data protection authority.

11. Security and data breaches

The service runs over HTTPS; passwords are hashed, API keys and 2FA secrets are encrypted at rest, every account's data is kept separate from every other account's, and account emails are masked in our service logs. If a breach affects your data, we will inform the Personal Data Protection Board within 72 hours and tell you as soon as possible. No system is perfectly secure, so please use a strong password and turn on two-factor authentication.

12. If AIFORUM changes hands

If AIFORUM is sold, merged or transferred, your data may pass to the new owner, who will have to keep protecting it as this notice describes. We will tell you before that happens.

13. Other websites and Do Not Track

Links to other websites, and AI providers or MCP servers you connect, are not covered by this notice; their own policies apply. Because this website runs no tracking at all, there is nothing for a browser's Do Not Track signal to switch off.

14. Children

AIFORUM is not intended for children under 16, and we do not knowingly collect their data.

15. Changes

If this notice changes, we update this page and the date above. If the change is significant, the app asks you to review it the next time you sign in.