← Back

Privacy Notice

Version 2.1 · Effective date: 25 October 2026

1. Data controller

Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed by SoftWorks Yazılım ve Bilgi Teknolojileri Limited Şirketi (the “Company”) as data controller, as described below. Kochi is an AI-assisted interview practice service for university students and recent graduates.

  • Name: SoftWorks Yazılım ve Bilgi Teknolojileri Limited Şirketi
  • Address: Workon Ofis, Küçükbakkalköy Mah. Selvili Sok. No: 4/20, 34750 Ataşehir / İstanbul
  • Tax office / Tax no. / MERSIS: Kozyatağı Vergi Dairesi / 6312005304 / 0631200530400001
  • Contact and data-protection requests: info@softworkstr.com

2. Categories of personal data we process

When you use the service, we process the following:

  • Identity and contact: full name, email address.
  • Profile and education: whether you are a student, graduate or working, university, major, year or graduation year, target role.
  • CV content: the CV file you upload (PDF or DOCX), text you paste, and the education, experience, project, skill and tool details extracted from them.
  • Interview content: company and position names, job posting text and requirements, interview settings (mode, duration, difficulty, language), the question-and-answer transcript, hidden evaluation notes, scores and the feedback report.
  • Voice: in a voice interview your recording is processed in real time to be transcribed and is NOT stored. What is stored is only the transcribed text and speech measurements (word count, speaking pace, long pauses and filler-word counts).
  • Preferences and consent records: interface and interview language, Kochi appearance preferences (character, outfit, theme and sound choices), and the time of your consents (privacy notice, AI processing, voice processing and commercial electronic messages).
  • Usage and security records: session information, AI call logs (type, model used, token/second/character counts, success status, time), daily-usage-limit counters; in voice interviews, diagnostic events (step name, duration, error code, browser and operating-system type; no text and no audio); during the closed test, demo sign-in records (email, IP address, browser information).
  • Email delivery records: the outcome of sending the sign-in code email (sent, delivered, delayed, bounced, complained, failed, code verified), only the domain of the recipient address (e.g. hotmail.com; the full address is not kept in this record), the email type, the message ID from the email delivery service and the time.
  • Acquisition and visit records: at sign-up, the country (where the request came from), the platform (web, Android, iOS), the interface language, the device and context information listed under “Device and context information” in this section, any campaign tags (utm_source, utm_medium, utm_campaign, utm_content), any install-source tags reported by Google Play about the link the app was installed from (utm_* fields only) and the time of first launch; and, for visitors who open our download page (kochi-indir), only the campaign tags, country, device type (Android, iOS, desktop) and time. To be able to mark a repeat visit from the same device within 30 minutes, the visitor’s IP address and browser information are summarised one-way with a secret key that changes every day, and only that summary is stored; the IP address and browser information themselves are not stored, and because the summary changes every day, visitors cannot be tracked across days. These records do not keep your email, name, IP address or the full browser information, and visit records are not linked to an account.
  • Usage event records: a record of the following events as you use the service: sign-in and setup steps; whether consent to AI processing and voice processing was given or declined (the outcome only); whether a CV was uploaded, entered by hand or skipped, and whether parsing succeeded; whether a job posting was added or skipped; whether an interview was set up, started, answered for the first time, completed or abandoned (with a reason code for abandonment); whether the daily usage limit was reached; whether a report was viewed, and the report scores (numbers only); whether a PDF report was shared; whether a content report was made; whether the payment screen was opened, a plan was selected, a purchase was started, succeeded or failed (the store’s error code on failure), purchases were restored, or subscription management was opened; client error types and response times; data export and account deletion (the selected option, if a deletion reason is offered). These records do not contain your email address, your name, your CV, job posting or interview text, transcripts, free-text error messages, your IP address or the full user agent (browser identification text) of your browser.
  • Pseudonymised user ID and device ID: your user ID is not written to event records directly; it is written only as a pseudonym generated with HMAC-SHA256 using a secret key, and this pseudonym cannot be reversed without the key. Pseudonymised data remains personal data and is processed under this Privacy Notice. So that events that occurred before you signed in can be matched to your account after sign-up or sign-in, a random anonymous device ID (kk-did) is generated on your device at first launch; the match between this ID and your account is kept on the server. A random session ID (kk-sid) is also used to tell your open session apart; it is removed when the tab closes.
  • Device and context information (on every event and on the acquisition record): platform (web, Android, iOS); operating system and version; on Android, the brand and model (to the extent the browser or in-app web view allows); on iOS, the version and device class (iPhone, iPad); the browser or in-app web view (WebView) and its version; app version and build number; screen size class (a coarse class, not the exact screen size); interface language; country (where the request came from); connection type; event time (UTC and Türkiye time); campaign tags and, where available, Google Play install-source tags.
  • Online presence record: a heartbeat sent every 60 seconds while the app or site is open and visible; the heartbeat contains the pseudonymised session ID, the platform, the country, the device class, the screen name, whether you are in an interview and the last-seen time. Users who sent a heartbeat within the last 2 minutes count as “online”.
  • Subscription status record: the product, type, store, country, currency, price, start date, period end, auto-renewal status, cancellation time and reason, billing issue, refund, plan change and total amount paid, derived from subscription and RevenueCat events as the current status per user. Card details are not part of this record.

3. Purposes of processing

  • Creating your account, authenticating you (one-time code sent by email) and managing your session,
  • Reading your CV and preparing interview questions that fit you,
  • Running the written or spoken interview simulation and producing your feedback report, scores and progress line,
  • Transcribing your speech in voice interviews and computing speech measurements,
  • Presenting your report and data to you and enabling your rights such as download and deletion,
  • Managing the purchase of a paid plan, payment, billing and the subscription, and concluding refund and cancellation requests,
  • Keeping the service secure and preventing abuse and excessive use (daily limits),
  • Meeting legal obligations and establishing, exercising or defending legal claims,
  • Monitoring whether sign-in code emails arrive and fixing delivery problems (for example bounced or delayed emails) (legitimate interest; Art. 5/2-f),
  • Measuring product and acquisition activity in aggregate, detecting errors and performance problems, and improving the service (legitimate interest; Art. 5/2-f). This data appears on the management dashboard as totals only, not per person; it is not used to build advertising profiles, no user data is sent to advertising platforms, and it is not transferred to any new third party for these purposes (the data is hosted only with the infrastructure providers the service already uses). Because this processing relies on legitimate interest, you may object to it through the means described in the section of this notice on your rights,
  • If you consent, sending you electronic messages about news and updates.

4. Legal bases

Your data is processed on the following grounds under Article 5(2) of KVKK:

  • It is directly related to the formation or performance of a contract (providing the account, interview and report service; purchase and subscription transactions) — Art. 5/2-c,
  • Compliance with a legal obligation — Art. 5/2-ç,
  • Establishment, exercise or protection of a right — Art. 5/2-e,
  • Our legitimate interests, provided they do not harm your fundamental rights and freedoms (service security, abuse prevention) — Art. 5/2-f.
  • Processing your CV and interview content with AI, transferring it to service providers abroad for that purpose, voice processing and commercial electronic messages are based on your explicit consent; details are in the Consent Notice.

5. Recipients and transfers abroad

The service is delivered through the providers below. Because all of them are located abroad, your data is transferred abroad on the basis of your explicit consent and in line with the conditions of Article 9 of KVKK:

  • AI processing (CV parsing, interview questions, hidden notes, report): Anthropic — your CV, job posting and interview answers are sent for this purpose.
  • Voice processing: Fish Audio for speech recognition; ElevenLabs for generating the coach's voice (backup: Fish Audio; OpenAI only if enabled) — your spoken answers are sent to be transcribed and the coach's sentences (including your name, if used) to be spoken aloud.
  • Database, authentication and file storage: Supabase — data is kept on infrastructure in the European Union (Frankfurt) region.
  • Hosting and content delivery: Vercel.
  • Delivering the sign-in code by email: an email delivery service (through the authentication infrastructure).

Your data is not sold or shared for advertising, profiling or training AI models. Your evaluation reports are shown only to you and are not shared with third parties, employers included.

How service providers process and retain the data sent to them, and whether they use it for model training, is governed by each provider's own terms and privacy policy.

The recipients with whom data is shared for payment and subscription transactions (iyzico, Apple, Google, RevenueCat) and the basis for the transfer are explained separately in section 5/A.

5/A. Processing of payment and subscription data

If you purchase a paid plan, data is shared with the following groups of recipients to complete the purchase, bill you and manage your subscription:

  • Payments on the website — the payment service provider iyzico (a payment institution established in Türkiye): your card details are sent directly to iyzico on the payment page and are not received or stored by us. We receive only the result of the payment, its amount, the transaction ID and the information needed for billing.
  • Mobile app payments — Apple (App Store) and Google (Google Play): payment, taxation, billing and refunds are handled by the relevant store; your payment details are not passed to us. The store reports purchase information (product, amount, date and status) to us and to our subscription infrastructure provider.
  • Subscription management — RevenueCat: your user ID and purchase status (plan, period, renewal and cancellation status) are shared; your email address is not shared.

Purposes of processing: completing the purchase and payment security, billing, reflecting your subscription status in your account, concluding refund and cancellation requests, and meeting legal obligations.

Legal grounds: establishing and performing a contract (Art. 5/2-c), complying with a legal obligation (Art. 5/2-ç) and establishing, exercising or defending a legal claim (Art. 5/2-e). Because Apple, Google and RevenueCat are located abroad, this sharing is carried out in line with the conditions of Article 9 of KVKK.

Retention: subscription and payment records are kept until your account is deleted, subject to the retention obligations required by billing and financial legislation. Copies held by service providers are subject to the relevant provider's own retention policy.

5/B. Advertising measurement (Android app)

In our Android app we use the Meta Platforms software development kit (SDK) to measure advertising performance. If you have given your permission, the advertising ID and app interactions (install, app open, registration, checkout start and purchase amount) are shared with Meta through this SDK. Identity details such as your name or email address, your CV, your voice recordings and your interview content are not shared.

In Turkey this sharing takes place only with your explicit consent; consent is optional and declining it does not limit any feature of the app. In other countries measurement is on by default and can be turned off in Settings. You can withdraw your permission at any time under Settings → Account, and the sharing stops immediately. You can also delete or reset your advertising ID in your Android system settings.

6. How we collect data

Your data is collected through the forms you fill in the app, the CV you upload, the written or spoken answers you give during an interview, and automatically through your device and browser.

7. Retention periods

  • Account details, profile, CV (file and parsed content), interviews, transcripts, reports, AI call logs and consent records: kept until you delete your account.
  • Voice recordings: not stored; processed in memory only while being transcribed. The synthesized audio of the coach's fixed template sentences (which contain no personal data and are the same for everyone) may be cached to play faster.
  • Voice-interview diagnostic events (step name, duration, error code; no text and no audio): deleted automatically after 30 days.
  • You can delete your account at any time under Settings > Account; at that moment all your data in the app (CV files included) is permanently deleted. Copies in the hosting provider's backups disappear after a limited period under the provider's backup retention policy.
  • Copies held by service providers and hosting logs are kept for a limited period under each provider's own retention policy.
  • Demo sign-in records from the closed test (email, IP address, browser information): deleted automatically after 30 days, and immediately if you delete your account.
  • Email delivery records (domain, outcome, message ID, time): deleted automatically after 90 days; if you delete your account, the link to your account is removed from the record.
  • Acquisition record (country, platform, language, device and context information, campaign tags): until you delete your account; if you delete your account the record is deleted too. Download page visit records: deleted automatically after 90 days. Daily totals produced from these records contain no personal data and may be kept indefinitely.
  • Usage event records (pseudonymised): deleted automatically after 13 months; if you delete your account, the event and online presence records written under your pseudonym are deleted as well (events recorded before sign-in under the anonymous device ID alone cannot be linked to you once your account is deleted and may remain anonymously for up to 13 months). Online presence records: records older than 24 hours are deleted. Subscription status record and the match between the device ID and your account: kept until you delete your account; deleted if you delete your account.

8. Data security

Your data is encrypted in transit; row-level access control is applied in the database so you can reach only your own data. Necessary technical and organizational measures are in place against unauthorized access.

9. Your rights under Article 11 of KVKK

As a data subject you have the right to:

  • Learn whether your personal data is processed,
  • Request information if it has been processed,
  • Learn the purpose of processing and whether it is used accordingly,
  • Know the third parties to whom it is transferred in Türkiye or abroad,
  • Request correction if it is incomplete or inaccurate,
  • Request deletion or destruction under the conditions of Article 7 of KVKK and request that these actions be notified to the third parties to whom the data was transferred,
  • Object to a result against you arising from analysis of your data exclusively by automated systems,
  • Claim compensation if you suffer damage due to unlawful processing.

You can exercise some rights directly in the app: under Settings > Account you can download your data as a single file, delete your account and data, and withdraw your consents; you can correct your CV details on the CV screen.

10. How to apply

You can send requests about your rights, together with information that verifies your identity, by email to info@softworkstr.com or in writing to Workon Ofis, Küçükbakkalköy Mah. Selvili Sok. No: 4/20, 34750 Ataşehir / İstanbul. Your application is concluded free of charge within 30 days at the latest, depending on the nature of the request; if the process requires a separate cost, a fee at the tariff set by the Personal Data Protection Board may be charged.

If you find the response inadequate or no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of KVKK.

11. Children and changes

The Service is not offered to anyone under 16. If we learn that personal data of a person under 16 is being processed, we close the account and delete the data.

People aged 16–17 may use the Service only with the approval of their parent or legal guardian. When creating an account, they declare that they are under 18 and that their parent or guardian approves their use of the Service and their acceptance of the Terms of Use and this notice. A date of birth or identity document is not requested; only an age group (under 18, or 18 and over) and the date of the declaration are recorded on your account. This record is kept to show that the age condition was met (legal obligation and legitimate interest; KVKK Art. 5/2-ç and f) and is deleted together with the account.

For users under 18, the explicit consents given for AI processing and voice processing (Consent Notice) are treated as given together with the approval of the parent or guardian. A parent or guardian may exercise their child’s rights under KVKK Art. 11 through the route described in Section 10 and may withdraw the approval at any time.

This notice is updated when necessary; the current version is published on this page and the “Last updated” date at the top changes.

12. Using the mini interview without an account (3 minutes)

If you try the 3-minute mini interview without creating an account, we process: the role group you choose, the app language, your written or spoken answers (as transcribed text), the score and tip, an anonymous device identifier and a daily digest of your IP address (the IP address itself is not stored). We ask for your separate explicit consent for AI processing and, in voice mode, voice processing; audio recordings are not stored.

  • Retention: if you do not sign in and link it to an account, this data is deleted automatically after 7 days.
  • If you sign in, the trial result is linked to your account, kept like your other account data and deleted when you delete your account.
  • Purpose: running the trial, preventing abuse (limits per device and IP) and improving the service.