KVKK Notice — Puw
Last updated: 9 November 2026
English translation of the KVKK Aydınlatma Metni. The Turkish text governs.
In short
- The controller is Luvi Technologies, Inc. (Delaware, US). You can reach us at support@luvi.io.
- Your cameras' footage, event descriptions, reports and alert history stay on your PC; Luvi never receives them. The business owner is the controller of that data.
- Luvi processes only trial and license (including acceptance of the Terms), purchase, e-mail, support and @puw_bot link records, website server logs, website visit and ad measurements with your consent (Google Analytics, Google Ads) and, without it, the cookieless signals without a visitor ID that reach Google.
- For alerts passing through @puw_bot, Luvi is a processor on the business owner's behalf and does not store the content.
- None of this processing relies on explicit consent; we rely on contract, legal obligation, protection of a right and legitimate interests.
- We collect data directly from you and process it in the US. Under the Authority's guide, this is not a transfer abroad under KVKK Art. 9; we still follow KVKK's core principles.
- You can use your rights under KVKK Art. 11 by writing to support@luvi.io; we answer free of charge within 30 days at the latest.
This notice is prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It covers people who visit Puw's website, try or buy Puw, set up phone alerts with @puw_bot, or write to us for support. More detail is in the Privacy Notice.
1. Data controller
Luvi Technologies, Inc. ("Luvi") is a Delaware corporation in the United States. It develops, sells and licenses Puw. Luvi is the controller of the personal data described in this notice.
- Address: 651 N Broad St Suite 206, Middletown, DE 19709, USA
- E-mail: support@luvi.io
- Requests by post: the address above, marked "Attn: Privacy"
- Website: https://puw.ai
Data Luvi does not process
Puw watches the business's own cameras and describes events in text with an AI that runs on the PC. Footage, clips, event descriptions, reports and alert history are processed and stored only on the business's PC; Luvi never receives, sees or stores them. Puw does not recognize faces and records no audio.
The business owner using Puw is the controller of the data of the people the cameras record; Luvi is neither controller nor processor of that data. Informing those people, putting up visible signs and having a legal basis for the processing are the business owner's duties. The Shop-owner Kit explains how.
2. For what purposes do we process your personal data?
| Whose data | What data | For what purpose |
|---|---|---|
| Website visitors | IP address, date and time, page requested, browser details (server logs) | Serving the site and keeping it secure |
| Website visitors who accept analytics | Pages viewed, the page they came from, device and browser, approximate location (country and city) and a random visitor ID in Google Analytics cookies | Measuring how the site is used, to improve it |
| All website visitors, including those who reject | Cookieless signals without a visitor ID: the page viewed and when, browser and device type, approximate location | Estimating the number of visits |
| Website visitors who allow advertising | Google's advertising cookies (_gcl), the click ID of the ad they came from, the visit | Measuring whether our ads bring visitors; showing our ads to people who visited the site |
| People who try or use Puw | A one-way hash of the PC's Windows ID (the server stores a hash of that hash), the app version, the version of the Terms of Use and License accepted and when, the license key's hash, the plan, trial and license dates, the time of the last check; the e-mail address if a license was bought | Running the trial and the license; stopping repeat trials on one PC and key sharing; proving the Terms were accepted; announcing new versions |
| Customers | E-mail address, whether "I'm purchasing as a business" was ticked and the tax ID given, Stripe customer and subscription IDs, plan, purchase, renewal and end dates | Making the sale; delivering the license key; running the subscription, renewal reminders, cancellations and refunds; telling business customers from consumers; keeping accounting records; sending license and service e-mails |
| Business owners who set up @puw_bot and people who write to the bot | Telegram chat number, chat language, a message counter, the record linking the install to the chat, the last heartbeat (whether Puw is running, the time zone, when), any block set with /report | Delivering alerts to the right chat; telling the business owner when Puw goes silent; preventing abuse |
| People who write to us for support | Name, e-mail address, message content; the support bundle if sent (app logs, settings with passwords masked, system information; it may contain camera names, the cameras' network addresses and event times, but no video, frames or event descriptions); for those who write in the website's chat, also their IP address, browser, the page they write from and an approximate location | Solving the problem |
We do not process special categories of personal data. We process data only as far as the purpose needs. For example, the license check receives only a one-way hash of your PC's ID, not the ID itself, and we keep only a hash of the license key, not the key.
Content passing through @puw_bot: Luvi is a processor
Phone alerts are off by default and are sent only through Telegram. If a business owner turns them on with easy setup (@puw_bot), the alert text, camera name and time, and a photo or clip if chosen, pass through Luvi's server on their way to Telegram. Questions asked to Puw from Telegram, and Puw's answers, go the same way.
For this content, Luvi is a processor acting on the business owner's behalf and instructions. In plain words, Luvi is a courier here. The business owner decides what is sent and to which chat. Luvi uses the content only to pass it on: it does not store it, log it or use it for anything else. The content is never written to disk; while waiting for delivery, including a question waiting for Puw to pick it up, it is held only in memory, for at most 10 minutes, and is then dropped. The services Luvi uses for this are Heroku (server) and Telegram (delivery). Having a legal basis for this content and informing the people recorded are the business owner's duties.
For the link record, the heartbeat and block records, Luvi is the controller (see the table above).
Remote management: if the business owner turns it on, their own computers use Puw on the business's PC through Luvi's server. The content passing through (pages, pictures, clips) is encrypted end to end with keys only the business owner's computers have; Luvi cannot read it and does not store it, and is a processor for it. The receipts Puw writes for its clips and alerts also arrive sealed; Luvi sees only their numbers, keeps the receipts 30 days and Puw's random ID and any chain breaks until asked to delete them, and is the controller for these (KVKK Art. 5(2)(c) and (f)).
If the business owner uses their own Telegram bot, the data goes from their PC directly to Telegram; Luvi has no access to any of it.
3. To whom and for what purpose do we transfer your personal data?
| Recipient | Data transferred | Purpose | Country |
|---|---|---|---|
| Heroku (Salesforce) | Trial, license, purchase and Terms acceptance records; @puw_bot records; alerts passed on (not stored) | Hosting the license server and @puw_bot, as our processor | US |
| Stripe, Inc. and Stripe Payments Europe | E-mail address, plan and subscription details; Stripe collects your name, billing and card details directly from you | Taking payment and running the subscription; Stripe is a controller in its own right for payment data | US, Ireland |
| Postmark | E-mail address and the e-mail's content | Sending license and service e-mails, as our processor | US |
| Vercel | Visitor server logs | Hosting the website, as our processor | US |
| Google (Google Analytics, Google Ads) | Website visit measurements (only after the visitor accepts); cookieless signals without an ID from all visits, including those who reject; ad data of visitors who allow advertising | Measuring and estimating visits, as our processor; measuring and showing our ads, for advertising also as a controller in its own right | US, Ireland |
| Crisp (Crisp IM SAS) | Chat messages and the details above, only if the visitor opens the website's chat | Running the website's chat, as our processor | EU (the Netherlands, Germany) |
| Telegram | Alerts, questions and answers (only if the business owner turns them on) | Delivering the messages | Outside Türkiye |
Support messages are held by the e-mail provider that hosts our support@luvi.io mailbox, and chat conversations by Crisp. Public authorities and courts receive information only where the law requires it.
Luvi transfers no data to the following providers; your device connects to them directly and they see your IP address. When you open the website, your browser loads fonts from Google Fonts and animation code from jsDelivr. At first setup and for updates, Puw downloads files from GitHub and the Ollama model registry (US). These providers process the data under their own policies.
Processing abroad
Luvi is a controller established in the US and collects your personal data directly from you. The data is processed in the US by Luvi and the providers above; some of Stripe's processing takes place in Ireland.
According to the Guide on the Transfer of Personal Data Abroad published by the Personal Data Protection Authority in January 2025, a controller established abroad that collects personal data directly from people in Türkiye is not making a transfer abroad under KVKK Art. 9. We still follow KVKK's general principles (Art. 4): we process data lawfully and fairly, keep it accurate and up to date where needed, process it for specified, explicit and legitimate purposes, keep it relevant, limited and proportionate to those purposes, and keep it only as long as needed. With this notice we fulfil our duty to inform (Art. 10).
Note for business owners: if you choose a photo or clip for phone alerts, images of the people recorded go abroad: with @puw_bot to our server in the US and from there to Telegram, with your own bot directly to Telegram. This is a transfer abroad made by you as the controller, and you are responsible for it being lawful. Where you can, use text-only alerts, and mention phone alerts in your camera notice.
4. How and on what legal basis do we collect personal data?
We collect personal data by automated means (through the Puw app, the website, our servers and the Telegram bot) and through the e-mails you send us. Stripe collects payment data directly from you.
| Process | Collection method | Legal basis (KVKK Art. 5/2) |
|---|---|---|
| Website server logs | Automatically, by Vercel's server when you open the site | (f) legitimate interests: serving and protecting the site |
| Website analytics and advertising | Automatically, by Google cookies in your browser, only after you allow them in the cookie banner ("Accept all" or "Cookie settings") | Your explicit consent (KVKK Art. 5/1), which you can withdraw at any time with "Cookie settings" at the bottom of the page |
| Cookieless visit signals | Automatically, by Google's tag when you open a page, also without your consent; nothing is written to your device and there is no ID | (f) legitimate interests: estimating the number of visits |
| Trial and license check | Automatically, when Puw connects to the license server | (c) entering into and performing the contract; (e) establishing, exercising or protecting a right, to prove the Terms were accepted; (f) legitimate interests: preventing trial abuse and key sharing |
| Purchase | Automatically, through Stripe's payment page | (c) entering into and performing the contract; (ç) legal obligation: accounting and tax records |
| License and service e-mails | Automatically, on purchase and subscription events, through Postmark | (c) performing the contract; (ç) legal obligation: notices required by subscription and consumer law |
| @puw_bot link record, heartbeat and block records | Automatically, when you write to the bot in Telegram and when Puw connects to the server | (c) performing the contract: the service the business owner turned on; (f) legitimate interests: preventing abuse |
| Support | Through the e-mail, the website's chat and the support bundle you send us | (c) performing the contract; (f) legitimate interests: solving the problem |
We do not rely on explicit consent for any of this processing. Where we rely on legitimate interests, we take care not to harm your fundamental rights and freedoms, and we keep the data to a minimum. Luvi makes no decisions about people based solely on automated processing.
5. Retention
- Trial and license records: while the license or trial is active, plus 2 years
- The record of acceptance of the Terms in Puw (Terms version, time, PC hash): the term of the contract, plus 10 years after it ends
- Purchase and accounting records: 10 years
- Support messages (e-mail and chat) and support bundles: 90 days after the case is closed
- Content passing through @puw_bot: not stored and never written to disk; while waiting for delivery it is held only in memory, for at most 10 minutes, and is then dropped
- @puw_bot link record and heartbeat: until the business owner unlinks or sends /stop in Telegram; then deleted within 30 days
- Block records set with /report: as long as the block applies
- Website server logs: for Vercel's own short period; Luvi does not use them
- Website analytics: cookies up to 2 years, the data in Google Analytics (cookieless signals included) at most 14 months; advertising cookies (
_gcl) up to 90 days; your cookie choice (puwConsent) 12 months
When the period ends, the data is deleted, destroyed or anonymized.
6. Your rights under KVKK Art. 11
By applying to Luvi, you may:
- (a) learn whether your personal data is processed,
- (b) if it is, ask for information about it,
- (c) learn the purpose of processing and whether the data is used for that purpose,
- (ç) know the third parties in Türkiye or abroad to whom your data is transferred,
- (d) ask for incomplete or wrong data to be corrected,
- (e) ask for your data to be deleted or destroyed under the conditions in KVKK Art. 7,
- (f) ask for the actions under (d) and (e) to be notified to the third parties to whom the data was transferred,
- (g) object to a result against you that arises from analysing the processed data solely by automated systems,
- (ğ) claim compensation if unlawful processing caused you damage.
7. How to apply
You may send your request, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- by e-mail to support@luvi.io from the e-mail address you used to buy Puw and that is registered in our system,
- by e-mail to support@luvi.io signed with a secure electronic signature or a mobile signature,
- or by post, with a wet-ink signature, to: Luvi Technologies, Inc., Attn: Privacy, 651 N Broad St Suite 206, Middletown, DE 19709, USA.
Your request must include: your name and surname, and your signature if it is in writing; your Turkish ID number if you are a citizen of Türkiye, otherwise your nationality and passport number or, if you have one, ID number; your residential or business address for notices; your e-mail address and phone number for replies, if any; and what you are asking for.
We also consider requests from people with no e-mail address registered with us (for example, if you only tried Puw or visited the site). We may ask for more information to verify your identity and find your records; trial records carry no name or e-mail, so to find them we may ask for information about your PC.
We conclude your request as soon as possible according to its nature, and free of charge within 30 days at the latest (KVKK Art. 13). We answer in writing or by e-mail. If we refuse a request, we explain why.
8. Complaints to the Board
If your request is refused, you find our answer insufficient, or we do not answer in time, you may complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your application (KVKK Art. 14; https://www.kvkk.gov.tr). You must apply to us before complaining to the Board.
9. Changes to this notice
We update this notice when the data we process, or the way we process it, changes. The date at the top shows the latest version. We tell customers about an important change by e-mail or in Puw before it takes effect.
Contact
Luvi Technologies, Inc. · 651 N Broad St Suite 206, Middletown, DE 19709, USA · support@luvi.io · https://puw.ai