How we protect your data

FlyingPapers is the data controller for the personal data described in this policy.

For anything about this policy or your personal data, write to contact@flyingpapers.app. People in Turkey can send their KVKK applications to the same address.

We act in one of two roles, depending on the data:

• Controller (KVKK: veri sorumlusu) for data about our customers and website visitors: account and contact details, billing, use of the website and app, enquiries and demo uploads.
• Processor (KVKK: veri işleyen) for documents that business customers, such as translation agencies, upload on behalf of their own clients. For those documents the customer is the controller: it decides what is uploaded and why, informs its clients and needs its own legal basis. We process them only on the customer's instructions and only to provide the service.
• The Qualitaly student portal shows its own KVKK notice before documents are uploaded; this policy also applies to it.

• Identity and contact: name, e-mail address, phone number if you give it, company or agency name.
• Account: role, team membership, language and plan settings. Passwords are stored only as secure hashes; we never store them in readable form.
• Document content: the files you upload and their translations. Documents can contain sensitive information such as identity documents, diplomas and transcripts, health reports or criminal record certificates (special categories of personal data).
• Payment: billing contact, plan, invoices and payment status. Card details are entered on the payment provider's secure page and held only by the payment provider.
• Usage and technical: IP address, browser type, pages and features used, error reports, security and audit logs.
• Referral programme (when active): who referred whom, the referral status, and for fraud checks the e-mail domain, one-way hashes of IP addresses and a card fingerprint provided by the payment provider.
• Communications: messages you send us through the contact form or by e-mail.

We process personal data only for the purposes below. Each purpose has a legal basis under KVKK (Articles 5 and 6) and the UK GDPR (Articles 6 and 9).

• Creating your account and providing the service, including translating your documents

  KVKK

  Art. 5(2)(c): necessary for a contract

  UK GDPR

  Art. 6(1)(b): contract

• Billing, accounting and tax records

  KVKK

  Art. 5(2)(ç): legal obligation

  UK GDPR

  Art. 6(1)(c): legal obligation

• Security, abuse prevention, support and fixing faults

  KVKK

  Art. 5(2)(f): legitimate interest

  UK GDPR

  Art. 6(1)(f): legitimate interests

• Running the referral programme (when active) and preventing referral fraud

  KVKK

  Art. 5(2)(f): legitimate interest

  UK GDPR

  Art. 6(1)(f): legitimate interests

• Improving the product with usage analytics

  KVKK

  Art. 5(2)(f): legitimate interest

  UK GDPR

  Art. 6(1)(f): legitimate interests

• Answering enquiries and demo requests

  KVKK

  Art. 5(2)(c) and (f)

  UK GDPR

  Art. 6(1)(b) and (f)

• Special categories of data in documents uploaded to the Qualitaly student portal, where we are the controller

  KVKK

  Art. 6: explicit consent, collected before upload

  UK GDPR

  Art. 9(2)(a): explicit consent

Where we act as processor, the customer (the controller) determines the legal basis for its clients' documents.

We do not sell personal data, use it for advertising or build marketing profiles.

Translations are produced by the translation system FlyingPapers has built, which runs on models from enterprise AI service providers. Only the document content needed for the translation is sent to those providers.

• No training: under the business terms of the AI services we use, your documents and translations are not used to train or improve AI models.
• Provider retention: to prevent abuse, the providers may keep requests for up to 55 days, after which they are deleted unless the law requires longer.
• No automated decisions: AI output is a translation draft. We make no decisions about you with legal or similarly significant effects based solely on automated processing. Please review translations before relying on them.
• Quality feedback: if you rate a translation as poor, the source document and the translation are copied to a restricted archive so that our team can investigate. You can ask us to delete that copy at any time.

To provide the service we work with service providers (sub-processors) in the groups below. Each receives only the data it needs for the purpose shown and is bound by data protection terms.

• Cloud infrastructure providers

  Purpose

  Hosting, database, sign-in, encrypted file storage, abuse protection

  Data

  Account data, documents, translations, IP address

• AI service providers

  Purpose

  Producing translations within our translation system

  Data

  Document content

• E-mail delivery provider

  Purpose

  Service e-mails

  Data

  Name, e-mail address, project and file names

• Payment provider

  Purpose

  Payments and invoicing

  Data

  Billing contact, payment details (card data is held only by the payment provider)

• Monitoring and analytics services

  Purpose

  Error monitoring; product analytics in the app and its sign-in pages (document views are masked in session replays)

  Data

  Technical error details, user ID, e-mail address, usage events

• Support and internal tools

  Purpose

  Fault tickets when a translation fails; internal notifications to our team

  Data

  File and project names, error details, a copy of the source document of a failed translation

You have the right to know the third parties your data has been transferred to; ask for our current list of sub-processors at contact@flyingpapers.app.

We disclose data to courts, regulators or other public authorities only when the law requires it. If our business is sold or reorganised, data may pass to the successor, which remains bound by this policy; we will tell you beforehand.

Some of our service providers are located in other countries, so personal data may be transferred abroad.

• Under KVKK: transfers are made under Article 9, using the standard contracts published by the Personal Data Protection Board.
• Under the UK GDPR: transfers rely on adequacy regulations, the International Data Transfer Agreement or Addendum, or the UK–US Data Bridge where the provider is certified.

You can ask us for details of the relevant safeguards at contact@flyingpapers.app.

• Encryption in transit (TLS) and at rest (AES-256).
• Private file storage: download links issued to you expire within 60 minutes.
• Row-level security in the database, so each customer account can reach only its own data.
• Role-based access for our team; two-factor sign-in is available for administrator accounts.
• Rate limiting and security headers against automated attacks.
• In the session replays we use for product analytics, document viewers and editors are masked.
• Staff access: our team opens your documents only when you ask us to (for example for support) or when needed to fix a failed translation.

If a personal data breach occurs, we notify the KVKK Board and the Information Commission (ICO) where required, within 72 hours of becoming aware of it, and inform affected customers without undue delay.

• Account data

  Retention

  While your account is active; deleted within 30 days of a closure request, except billing records.

• Documents and translations

  Retention

  Until you delete the project or close your account; you can ask us to delete them at any time. When a translation passes your plan's availability period it is hidden but its files stay in storage until we delete them at your request or when the account is closed.

• Files sent through a client upload link

  Retention

  Kept as part of the receiving customer's project, as above.

• Demo uploads

  Retention

  The original file is deleted as soon as the demo pages are extracted. The demo result and files from attempts that do not complete are deleted on request.

• Unfinished uploads

  Retention

  Removed automatically within 24 hours.

• Copies at AI service providers

  Retention

  Up to 55 days, for abuse prevention only.

• Fault tickets for failed translations

  Retention

  Until the fault is resolved, at most 90 days.

• Archive of translations rated as poor

  Retention

  Until you ask us to delete it. It is not removed automatically when the project is deleted.

• Referral records (when the programme is active)

  Retention

  While either account exists. IP addresses are kept only as one-way hashes; the referrer sees only a masked list of sign-ups.

• Audit logs

  Retention

  30 days (default setting).

• Error reports and product analytics

  Retention

  Up to 90 days for error reports; up to 12 months for pseudonymous analytics.

• Billing records

  Retention

  6 years, as required by tax and accounting rules.

• Contact-form messages

  Retention

  Up to 2 years after the enquiry is closed.

When a period ends, the data is deleted or anonymised. Backups are overwritten as part of the regular backup cycle.

Under KVKK Article 11 you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether the data is used accordingly;
• know the third parties in Turkey or abroad to whom it is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for your data to be deleted or destroyed under Article 7;
• ask for these corrections and deletions to be notified to the third parties who received the data;
• object to a result against you that arises solely from automated analysis;
• claim compensation for damage caused by unlawful processing.

Under the UK GDPR you have the rights of access, rectification, erasure, restriction, data portability and objection, and you may withdraw consent at any time without affecting earlier processing.

How to apply: write to contact@flyingpapers.app from the e-mail address registered with us, or send us a signed letter. We may ask you to confirm your identity. Applications are free of charge and answered within 30 days (KVKK) or one month (UK GDPR).

Complaints: if you are unhappy with how we handle your data, please write to us first. We acknowledge complaints within 30 days and tell you the outcome. You can also complain to a regulator:

• Turkey: Personal Data Protection Board (KVKK), https://www.kvkk.gov.tr, within 30 days of our reply and in any case within 60 days of your application.
• United Kingdom: Information Commission (ICO), https://ico.org.uk

The public website uses only essential and functional cookies, plus cookieless visit statistics. Product analytics cookies are used only in the app and on its sign-in pages.

• Sign-in session cookies

  Purpose

  Keep you signed in (essential)

  Duration

  Session, or 30 days with “stay signed in”

• fp-stay-signed-in

  Purpose

  Remembers your “stay signed in” choice (essential)

  Duration

  30 days

• fp_marketing_locale

  Purpose

  Remembers your language choice (functional)

  Duration

  1 year

• fp_ref

  Purpose

  Remembers the referral link you arrived from, when the referral programme is active (functional)

  Duration

  30 days

• Product analytics cookies

  Purpose

  Usage statistics in the app and its sign-in pages (not the public website)

  Duration

  Up to 1 year

• Payment security cookies

  Purpose

  Fraud prevention on the payment page (essential)

  Duration

  Up to 1 year / 30 minutes

You can delete or block cookies in your browser settings. Essential cookies are needed to sign in.

FlyingPapers is a service for businesses and adults and is not directed at children. Documents about minors, such as school records, may be uploaded only by a parent, guardian or customer entitled to do so, who is responsible for having a legal basis.

We update this policy when our services or the law change. The version and date at the top show the current text. If a change materially affects how we use your data, we tell registered customers by e-mail before it takes effect.

Questions, requests and complaints: contact@flyingpapers.app. A one-page summary for your clients is available at Data security.