Privacy Notice

Last updated: 2026-09-09

This notice explains how your personal data is processed when you use Sorvel. The data controller is the operator of Sorvel, established in Türkiye; processing is subject to the Turkish Personal Data Protection Law (KVKK).

What data goes where

• Your email address and account id — processed in our own database and authentication infrastructure for account management.
• Your prompts and conversation history — sent to our service provider Anthropic (USA) to generate code, and stored in our systems. Prompts are free text: we recommend not putting personal data in prompts (for example real people's names, phone numbers or addresses).
• Generated code — stored in our systems and executed for validation on our own infrastructure; it is not transferred to a third party for that purpose. It is pushed to your own GitHub or Expo account only when you start that action yourself.
• Payment details — payments are taken by a merchant-of-record provider. Your card details never reach Sorvel; the invoice is issued by the provider.
• Integration tokens (Expo/GitHub) — stored encrypted (AES-GCM), never logged in plain text, and used only for actions you start. You can remove them in settings at any time.
• Usage and cost records (tokens/credits per generation) — kept in our own database for billing and abuse prevention.
• Documents you index (API documentation, backend notes and similar text you paste in settings) — split into pieces and made searchable by a model running on our own server, and stored as plain text in our database; during a generation only the relevant pieces are sent to Anthropic (USA) together with your prompt. They are visible only to your own account's searches, and you can delete each one in settings.

Purposes and legal basis

Data is processed to establish and perform the service contract (account, code generation, publishing) and for billing and abuse prevention (legitimate interest). The cross-border transfers listed above are subject to the transfer regime of KVKK article 9.

Cookies

Sorvel only uses cookies the service needs to work; there are no advertising, tracking or third-party analytics cookies, which is why no cookie consent is requested.

• Session cookie — written when you sign in, required to recognise you; removed when you sign out.
• Language and theme preference — written only when you change the language or theme, kept for one year and not linked to your identity.
• Checkout — purchases are completed on the merchant-of-record's own site; the cookies there are governed by that provider's policy.

Retention

Your account, projects and conversation history are kept while your account is open. Conversation content that has seen no activity for more than a year is anonymised on a regular schedule. On a deletion request, your data is deleted except where retention is legally required (for example financial records); what remains is anonymous.

Your rights

You have the right to access, correct and delete your data, to object to processing, and to be informed about transfers. Contact us with the account id shown on your settings page: hello@sorvel.dev.