Data controller / Service provider: HNK Tech
Application: Çiftçi AI (com.ciftciai.app)
Effective date: 14.08.2026 · Version: 1.0
Article 5/1 of Law No. 6698 on the Protection of Personal Data (KVKK) provides that
certain personal data may only be processed with your explicit consent. Under the
law, explicit consent must be "related to a specific subject, based on information,
and declared with free will." In practice:
checkbox that approves everything at once (bundled consent) is unlawful.
what it is used for, and who receives it. This document is that information.
keep using the application; only the feature tied to that consent will not work.
For this reason Çiftçi AI has three separate consents. Each is approved on its own
screen with its own button. Approving one does not mean you approved another, and
withdrawing one does not affect the others.
> Important: The core functions of the application (registration, weather, community,
> classified ad board, messaging, field journal) depend on none of these consents.
> They rest on the legal grounds of the establishment and performance of a contract and
> legitimate interest (KVKK art. 5/2). The three headings below cover additional features
> only.
This document should be read together with the Çiftçi AI Privacy Notice. The Privacy
Notice answers "what we process and why" as a whole; this document details only the three
consent-based subjects.
| # | Consent heading | Who it concerns | If you decline |
| 1 | Identity verification data | Users applying for the worker or trader role | The worker or trader role is not opened; you continue using the app as a farmer |
| 2 | Location and field boundary | Anyone who registers a field | Satellite, weather and fire alerts do not work |
| 3 | Transfer abroad (artificial intelligence) | Users of the AI advisor and disease detection | Your questions go only to the local model on our server; some questions may go unanswered |
> Who this concerns: Only users applying for the worker role or the trader
> role. If you use the application as a farmer, this consent is not requested from you.
document (national ID card) (worker role only)
1. To verify that the identity you present is genuinely yours. We need to be able to
tie timesheet and wage records to a real person, and to know that a trader account
belongs to a genuine commercial identity.
2. To prevent fake accounts, fraud and identity theft. The only thing protecting
farmers and their co-workers is that the other party has been verified.
It is transferred to no third party. Identity document images are stored
on HNK Tech servers and are viewed only by personnel authorised for
verification, only for the duration of the verification process. These images are not
sent to artificial intelligence models, are not passed through the disease detection
system, and are not shown to other users.
Transfer may occur in the event of a judicial request or a lawful written request from a
competent public authority; this rests on a legal obligation rather than on explicit
consent (KVKK art. 5/2-a).
| Situation | Retention |
| Your application was approved | As long as the role is active + 6 months after the account closes (objection period) |
| Your application was rejected | 6 months from the rejection notice, then destroyed |
| You withdrew your consent | Destroyed within 30 days at the latest |
Once verification is complete, identity document images may be destroyed so that only
the verification result (approved / rejected) is retained. We keep the result, not
the image.
to a verified identity.
community, ad board, messaging, disease detection and the AI advisor all remain open.
only for the "verified" badge and worker/trader features.
You can withdraw it with a single tap from **Profile > Legal > My Consents > Identity
verification data**. When you withdraw:
left aggrieved; no new ones can be created.
> Who this concerns: All users who register a field or use satellite analysis,
> weather or fire alerts.
only if you grant location permission
yourself on the map (GeoJSON)
weather records
1. Satellite analysis. We send your field boundary to Google Earth Engine to compute
the satellite imagery and crop development indices for that area.
2. Weather forecasting. We send the centre coordinate of your field to the weather
service to obtain a forecast specific to that point.
3. Fire alerts. To warn you if there is a satellite-detected fire source near your
field, we compare your coordinate against a fire data service.
4. Showing content near you. Ads, farm labour listings and community posts in the
same district.
5. Tying the field journal and soil analysis to a location.
| Recipient | What is sent | What is not sent |
| Google LLC — Google Earth Engine (USA) | Coordinates of the field boundary polygon and a date range | Your name, phone number, e-mail, account identifier |
| Open-Meteo (Germany, EU) | Only a latitude/longitude pair | Field boundary, identity information |
| NASA FIRMS (USA) | Only a latitude/longitude pair | Field boundary, identity information |
| Stadia Maps (EU) | The region of the map tile being displayed | Field boundary, identity information |
Your identity information is not sent to these services. On the service side the
request amounts to the question "what is at this coordinate"; it cannot be associated
with you.
Google LLC and NASA FIRMS are based in the USA; this transfer therefore constitutes a
transfer abroad and is subject to your explicit consent under KVKK art. 9.
> **Location data is under no circumstances sold, used for advertising, or transferred to
> data brokers. Your field boundaries are not shown to other users** — only you and the
> people you share the field with can see them.
forecast is retrieved); it is not stored permanently.
that you can make historical comparisons; if you delete the field they are deleted with it.
This is the consent that affects the largest number of features. We will say it plainly:
Will not work:
Continues to work:
You can create a field without consenting; you simply cannot draw a boundary on the map
or use the satellite and weather services.
You can withdraw it from Profile > Legal > My Consents > Location and field boundary.
You can also turn off the application's location permission in your device's operating
system settings — this immediately stops the collection of instantaneous location.
When you withdraw consent:
data** option on the same screen.
> Who this concerns: All users of the AI advisor and plant disease detection features.
> This is the section that should be read most carefully.
conversation
(at province level), season information
Çiftçi AI first asks your question to the **local artificial intelligence model on its
own server** (Ollama). If the local model cannot produce an answer, or the confidence
level of the answer it produces is low, the question is **forwarded to an artificial
intelligence provider located abroad. So not every question goes abroad — but you
cannot know in advance which question will.** Because of this uncertainty we ask for your
consent to cover the possibility that it may.
| Provider | Headquarters | Transferred |
| Google LLC (Gemini) | USA | Question text, plant photograph |
| OpenAI, L.L.C. | USA | Question text, plant photograph |
| Anthropic, PBC | USA | Question text, plant photograph |
Not sent:
Sent: Only the question itself, the plant photograph, and the agricultural context
needed for the answer to be correct. The request is not associated with you by name.
> Take care when uploading a plant photograph: If your face, your identity document,
> your vehicle plate or the sign of your home or business happens to appear in the photo,
> that image will also have gone abroad. We recommend photographing only the diseased part
> of the plant. Location metadata (EXIF) is stripped from photographs before they are sent.
Under KVKK art. 9, personal data may be transferred abroad only if (a) the data subject
has given explicit consent, (b) the destination country provides adequate protection, or
(c) safeguards such as a written undertaking or standard contract have been provided.
The USA has not been declared a "country with adequate protection" by the Personal
Data Protection Board. We therefore base this transfer on your explicit consent.
What this means in concrete terms: your data is processed on the servers of a company
subject to US law. There is a possibility that US authorities may, within the framework of
their own legislation, request access to that data. Exercising the rights KVKK grants you
against these companies may not be as straightforward as it is in Türkiye.
Contracts have been concluded with the providers at the enterprise / API level so that
your data is not used for model training. However, HNK Tech **cannot
physically audit** the implementation on those companies' own servers and cannot present
this to you as an absolute guarantee. We state this openly in the interest of honesty.
or close your account.
policy for abuse monitoring (typically up to 30 days), then deleted. That period is under
the provider's control.
warning **"This question requires a provider abroad; it cannot be answered because you
have not given consent"** — it does not silently return an empty answer.
where the external models are strongest.
satellite, weather, community, ad board, messaging, timesheets.
You can withdraw it from Profile > Legal > My Consents > Transfer abroad. From the
moment you withdraw, no new question or photograph is sent abroad. Requests already sent
cannot be recalled — this is not technically possible; the provider's own deletion period
applies.
None of these consents contains any undertaking as to the accuracy of the agricultural
advice given by the artificial intelligence. Information produced by Çiftçi AI is **for
informational purposes**; it does not replace the advice of an agricultural engineer, a
veterinarian, or an official authority. Always consult a qualified expert for your
decisions on pesticide application, fertilisation and animal health. This warning is also
displayed inside the application.
Profile > Legal > My Consents
On this screen you see each of the three consents separately:
Under KVKK, explicit consent can be withdrawn at any time. However, withdrawal of
consent operates prospectively: processing carried out up to the date of withdrawal
was based on a valid consent at the time and is therefore lawful, and does not become
unlawful retrospectively.
A concrete example: you gave consent for transfer abroad on 1 March and withdrew it on
1 June. Questions that went abroad between March and June were processed lawfully. After
1 June no new question is sent.
| Operation | Time |
| Stopping the consent-based processing | Immediately (the moment you press the button) |
| Destruction of the relevant data from the system | Within 30 days at the latest |
| Response to a written application | Within 30 days at the latest (KVKK art. 13) |
If you cannot access the application, you can send a request to
[email protected] from the e-mail address or phone number registered to your
account.
Under our legal obligation we must be able to prove that you gave and withdrew consent
(KVKK art. 12). We therefore record the following for every consent action:
This record is the evidence of the consent itself; even if you withdraw the consent, **the
record itself is not deleted** — because if it were, we could not prove that we obtained
the consent properly and stopped processing on time. The record is kept on the basis of a
legal obligation (KVKK art. 5/2-a) and retained for the duration of the limitation period.
If the scope of this text expands (a new data type is added, or transfer to a new recipient
begins), your existing consent is not deemed valid for that new scope. You will be
informed again inside the application and a new consent will be requested. If you do not
approve it, only the new feature stays closed; your existing use is unaffected.
For updates that do not change the scope — such as a typographical correction or a clearer
explanation — consent is not requested again; the version number and date are updated.
Çiftçi AI is intended for users aged 18 and over; it is not directed at anyone under 18.
If you are found to be under 18, your account is closed and your data is destroyed.
In relation to your personal data, you have the right to:
the data was transferred,
You can submit your applications to [email protected] or to the registered
electronic mail (KEP) address —. Your application will be concluded within
30 days at the latest (KVKK art. 13). If you are not satisfied with the outcome, you
retain the right to lodge a complaint with the Personal Data Protection Board (KVKK art. 14).
Data controller: HNK Tech
E-mail: [email protected]
Registered e-mail (KEP): —
Address: Akyurt / Ankara, Türkiye
MERSİS No: —
Tax Office / Number: —
VERBİS Registration No: kayıt yükümlülüğü bulunmamaktadır
Sürüm 1.1 · Çiftçi AI