Privacy Policy

Last updated: 19 October 2026

This policy explains what personal data DocRevisa handles, why, on what legal basis, for how long, who helps us, and your rights. It is our privacy notice under the EU and UK GDPR and our information notice (aydınlatma metni) under Türkiye's Personal Data Protection Law No. 6698 (KVKK). Questions: privacy@docrevisa.com.

Who is responsible for your data

DocRevisa is run by its two founders, individuals based in Türkiye, who decide how the data described here is used and are the data controller. Before we take payments, this section will give the full legal name and address of the business. Contact: privacy@docrevisa.com.

What we never do

• We never receive or store your documents. Documents and photos you add to a check are read on your own device, in your browser. The files are never sent to DocRevisa or to anyone else.
• We never sell your data, show you advertising, or use your information to train AI models.
• We never store names, birth dates, document numbers or account numbers read from your documents. The reader uses them only on your device, for example to check that the name on a booking matches your passport.

What we collect, why, and on what basis

• Your route and answers. The countries and purpose you choose and your answers to the situation questions, used to build your checklist. Basis: providing the service you ask for (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). Not stored unless you are signed in.
• Saved checks (signed in). Your route, answers, trip dates and each line's result, so you can come back and re-check. Basis: providing the service. Kept until you delete them or your account.
• Facts from your documents, only if you choose to keep them. If you are signed in and tick the box, we store what you confirmed from each document: its type, dates, amounts, yes or no facts (for example "mentions repatriation cover") and the check results. Basis: your explicit consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)), which you can withdraw at any time. Deleted automatically after 30 days, or sooner from My Account.
• Account. Your email address, a securely hashed password (never the password itself), the date you accepted our terms, whether you have confirmed your email, and your 2-step login setting. One-time codes are stored only as hashes and expire after 10 minutes. Basis: providing the service. Kept until you delete your account.
• Optional profile. Your name, nationality and country of residence, if you add them, to pre-fill your checks. Basis: your consent. Kept until you clear them or delete your account.
• The application buddy. When you use the AI chat, your messages, route, answers and check results (never your documents) are sent to the AI provider we use for the buddy, OpenAI or Google (Gemini), to generate an answer. We don't store the conversation; it disappears when you close or reload the page. Basis: providing the service.
• Payments. Our payment provider collects your payment details; we never see your card. We receive the order details (email, amount, country, order number). Basis: providing the service and our legal obligations. Kept as long as tax and commercial law require (up to 10 years).
• Messages you send us. Emails to our addresses, to answer you. Basis: our legitimate interest in replying, or the service. Kept as long as needed to deal with your request.
• Security and technical data. To protect accounts, we count failed log-ins per email address (stored as a hash; a lock lasts 15 minutes and the record is deleted within a day). Used and expired one-time codes and password-reset links are deleted within a day too. If something on a page breaks, we record the error message and the page (nothing about you) for 30 days. Our hosting provider keeps standard server logs, including IP addresses, for a short time. Basis: our legitimate interest in keeping the service secure and working.
• Analytics. Aggregate visitor counts (pages, referrers, device type) from a privacy-first analytics tool that sets no cookies and can't identify you. Basis: our legitimate interest in improving the site.

Cookies

We use only cookies that are strictly necessary: one keeps you signed in (up to 30 days), one tells our pages to show "My Account", a 10-minute one links a 2-step login code to your browser, and one remembers the language you chose (up to a year). No advertising or tracking cookies, so no cookie banner is needed.

Who handles data for us

Each provider gets only what its job needs and may not use it for its own purposes:

• Vercel (USA): hosts the website, which runs in Frankfurt, Germany.
• Neon (USA): hosts our database, stored in Frankfurt, Germany.
• Resend (USA): sends account emails such as confirmation codes and password-reset links.
• ImprovMX and Google (Gmail): forward and store the emails you send us.
• OpenAI (OpenAI API): generates the application buddy's answers, under API terms that don't allow OpenAI to use the content to train its models.
• Google (Gemini API): generates the application buddy's answers when we use Gemini instead of OpenAI, under paid terms that don't allow Google to use the content to train its models.
• Our payment provider: processes payments (named here once payments are live).
• jsDelivr, Hugging Face and Google: deliver the open-source reading tools and models your browser downloads for the document and photo checks. Like any site your browser loads files from, they see your IP address, but never your documents.

International transfers

Some providers are based outside Türkiye and the EU, mainly in the United States. When personal data is transferred abroad, we rely on the safeguards the law requires, such as standard contractual clauses, or the EU-US Data Privacy Framework where a provider is certified under it.

Automated results

Your document-check results and grades are produced automatically, to inform you. We make no decision about you with legal or similarly significant effects. If you disagree with a result, you can correct what the reader found, or contact us.

Security

Data is encrypted in transit (HTTPS). Passwords are stored with a slow, salted hash; sign-in tokens and one-time codes are stored only as hashes; you can turn on 2-step login; and access to our systems is limited to the founders.

Children

Accounts and purchases are for people aged 18 or over. A parent or guardian can run a check for a child.

Your rights

You can ask us to tell you whether we process your data and give you a copy, correct it, delete it, restrict it, transfer it to you in a portable format, object to how we use it, or object to a result produced only by automated processing, and you can withdraw consent at any time (rights under GDPR Articles 15 to 22 and KVKK Article 11). You can delete your account and everything in it yourself from My Account, Settings. For anything else, email privacy@docrevisa.com; we reply within 30 days. You can also complain to Türkiye's Personal Data Protection Authority (KVKK) or, in the EU or UK, to your local data protection authority.

Changes to this policy

If this policy changes in an important way, we will update the date at the top and tell account holders by email.