Data Protection Notice (KVKK)

1. Data controller

The data controller is Mersel Technology ("the Company"). Modelion.AI is a service operated by the Company.

2. Categories of personal data processed

The following categories of personal data are processed:

• Identity and contact data — name, work email, phone, company and role (to the extent you provide them through a form).
• Transaction security data — virtual key id, organization id, request id, region.
• Customer transaction data — token counts, latency, cost, the model selected and the decision trace.
• Request content — the prompts and variables you send to the gateway. This content may contain personal data; the guardrail pipeline detects patterns such as national identity numbers, card numbers, IBANs, phone numbers and email addresses, and masks them where your policy raises a redaction obligation.

3. Purposes and legal bases

Your personal data is processed to provide and maintain the service, to give technical support, for billing and collection, to measure and improve service quality, for security and abuse prevention, and to meet legal obligations.

The legal bases are those set out in Article 5 of KVKK: necessity for the establishment or performance of a contract, compliance with the Company's legal obligations, the establishment or protection of a right, and the Company's legitimate interests provided your fundamental rights and freedoms are not harmed. Where explicit consent applies — newsletter sign-up, for instance — it is obtained and you may withdraw it at any time.

4. Transfers — domestic and international

This section matters particularly given the nature of the service. Because Modelion is a hosted gateway, the request content you send is forwarded to the model provider your policy selects. Some of those providers are established outside Türkiye.

Transfers are made within the framework of Article 9 of KVKK. If you want to limit international transfer, you can enforce it at the policy level: rules can route specific data classes, or requests with detected PII, only to models in the Turkish region and close off fallback to candidates abroad. While such a rule is in force and no eligible candidate remains, the request is refused rather than transferred to another jurisdiction.

Your data may also be transferred to public authorities legally empowered to receive it, where legislation requires.

5. Method of collection

Your personal data is collected electronically, through the forms on this website, the operations you perform in the console, and the API requests you send to the gateway.

6. Retention

Data is retained for as long as the processing purpose requires and for the limitation periods prescribed by applicable legislation. Decision-trace retention varies by plan and is set contractually on enterprise plans. At the end of the period, data is deleted, destroyed or anonymised.

7. Your rights under Article 11 of KVKK

As a data subject you have the right to:

• Learn whether your personal data is being processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether the data is used in accordance with it,
• Know the third parties, in Türkiye or abroad, to whom the data has been transferred,
• Request rectification where the data is incomplete or inaccurate,
• Request erasure or destruction within the conditions of the law,
• Request that rectification, erasure and destruction be notified to the third parties the data was transferred to,
• Object to an adverse outcome reached solely through automated analysis,
• Claim compensation where you suffer loss from unlawful processing.

8. How to exercise your rights

To exercise your rights, send your request to kvkk@modelion.ai. Depending on its nature, your request is concluded free of charge as soon as possible and within thirty days at the latest; where the process incurs an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.