# Privacy Policy (KVKK & GDPR)

**Last Updated:** May 17, 2026  
**Effective Date:** May 19, 2026  
**Version:** v1.1.0

This Privacy Policy explains how personal data is collected, used, stored, transferred, and protected when you visit or use LenserFight websites, hosted applications, documentation, public arena surfaces, APIs, and related community services (collectively, the "Platform").

LenserFight is an experimental open-source AI evaluation and agent workflow project. The Platform may process AI prompts, model outputs, workflow traces, public community content, security logs, and usage signals. Please do not submit confidential, sensitive, unlawful, third-party, or unnecessary personal data unless the relevant feature explicitly requires it and you understand the risks.

This document is provided to fulfill transparency obligations under Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR").

---

## 1. Data Controller

**Data Controller:** OMER FARUK COSKUN ("LenserFight")  
**Address:** Nurol Tower, Izzet Pasa Mahallesi, Yeni Yol Cad. No: 3 Ic Kapi No: 303 Sisli / Istanbul, Turkiye  
**Email:** omer@chainabit.com  
**Contact Person:** OMER FARUK COSKUN - omer@chainabit.com

---

## 2. Scope

This Privacy Policy applies to:

- website and documentation visitors,
- registered users and Lensers,
- contributors, maintainers, API consumers, and self-hosting operators who interact with hosted LenserFight services,
- users who sign in through third-party providers such as GitHub or Google,
- users who participate in public battles, workflow runs, evaluations, comments, votes, feedback, or community content.

Open-source code use is governed by the repository license. This Privacy Policy applies to hosted services and data processing performed by or on behalf of LenserFight.

---

## 3. Categories of Personal Data Processed

Depending on how you use the Platform, we may process the following categories of personal data.

### 3.1 Account and Identity Data

- first name, last name, display name, username, handle, avatar, bio, profile links, and public profile metadata,
- email address,
- authentication identifiers and OAuth profile information received from GitHub, Google, or other configured providers,
- account status, deletion request status, moderation status, and administrative review records.

### 3.2 Community, Battle, Workflow, and AI Interaction Data

- lenses, prompts, workflow templates, agent settings, battle submissions, votes, evaluations, comments, run reports, and public posts you create or interact with,
- AI prompts, model inputs, model outputs, generated media, attachments, execution traces, tool-call metadata, memory configuration, approval decisions, and policy evaluation records,
- BYOK credential references, encrypted credential material where the feature requires storage, provider identifiers, quota/cost metadata, and key-rotation or revocation records,
- feedback, reactions, ratings, incident reports, moderation records, abuse reports, and safety signals.

### 3.3 Usage, Analytics, and Product Data

- pages visited, feature usage, session duration, referral source, campaign attribution, and interaction events,
- documentation search, route transitions, product analytics, aggregated benchmark signals, and performance metrics,
- error logs, crash logs, availability logs, and diagnostics.

### 3.4 Device and Technical Data

- IP address,
- browser, operating system, device type, viewport, language, timezone, and user-agent data,
- cookie identifiers, session identifiers, local storage records, device/session hashes, and authentication state,
- approximate location inferred from IP address for security, abuse prevention, analytics, and service reliability.

### 3.5 Contact and Support Data

- messages sent through feedback, support, waiting-list, contact, or issue-reporting channels,
- screenshots, reproduction details, diagnostic records, and correspondence needed to investigate a request.

### 3.6 Billing and Commercial Metadata

If paid hosted features, sponsorship, credits, or subscriptions are enabled, we may process plan, billing status, invoice reference, payment-provider reference, usage quota, and credit balance metadata. LenserFight does not store full payment card details; those are handled by the relevant payment provider.

---

## 4. Purposes of Processing

Personal data may be processed for the following purposes:

1. providing, operating, and improving the Platform,
2. creating and managing accounts, sessions, profiles, and authentication,
3. enabling lenses, battles, agents, workflows, approvals, evaluations, and public community surfaces,
4. routing prompts, attachments, outputs, and metadata to selected AI model or infrastructure providers when a user requests AI-enabled functionality,
5. maintaining security, fraud prevention, abuse prevention, rate limiting, incident response, and platform integrity,
6. enforcing Terms of Service, Acceptable Use, moderation rules, and OSS contributor policies,
7. measuring product quality, debugging failures, monitoring performance, and improving user experience,
8. handling support, feedback, deletion requests, contributor communications, and legal notices,
9. complying with legal obligations and responding to lawful requests from authorized authorities,
10. producing aggregated or anonymized analytics, benchmarks, or reports where individual users are not identified,
11. **sharing public platform content, operational telemetry, metadata, benchmark results, analytics signals, newsletter submissions, and community interactions with Chainabit, ConectLens, and other ecosystem partners** for platform operations, security, infrastructure reliability, AI benchmarking, analytics, commercial research, discovery systems, ecosystem integrations, recommendations, newsletters, and related platform services, as described in the Terms of Service.

LenserFight does not sell individual personal data.

---

## 5. Legal Bases for Processing

### 5.1 KVKK Article 5

Personal data may be processed under the following legal grounds:

- explicit consent where required,
- necessity for establishing or performing a contract,
- compliance with legal obligations,
- establishment, exercise, or protection of a right,
- legitimate interests, provided that fundamental rights and freedoms are not harmed.

AI-assisted workflows, security logs, moderation records, and abuse-prevention signals may be processed under contract, legitimate interest, legal obligation, or explicit consent depending on the feature and applicable law.

### 5.2 GDPR Article 6

For users located in the EU/EEA, processing may rely on:

- contract,
- legal obligation,
- legitimate interests,
- consent, especially for optional analytics, marketing, or non-essential cookies.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred before the withdrawal.

---

## 6. AI Features, Autonomous Agents, and User Responsibility

LenserFight is experimental. AI agents, model providers, workflow runners, public battle systems, scoring logic, and automation features may produce inaccurate, incomplete, unsafe, delayed, costly, or unexpected results.

You are responsible for reviewing prompts, inputs, attachments, agent permissions, generated outputs, workflow actions, publication decisions, and any downstream use of AI-generated content. LenserFight does not provide legal, financial, medical, security, or other professional advice.

For safety and debugging, LenserFight may process AI interaction metadata, tool-call records, policy checks, approval events, incident reports, and output references. Do not use the Platform to upload secrets, private keys, regulated data, confidential business information, or third-party personal data unless you are authorized to do so and have assessed the risk.

---

## 7. Third-Party Services and Processors

To provide the Platform, LenserFight may use third-party service providers, including:

### 7.1 Infrastructure and Security

- **Cloudflare:** CDN, SSL, DDoS protection, traffic management, bot protection, and security services.
- **Supabase:** authentication, database, storage, realtime, row-level security, and related backend services where configured.

### 7.2 Analytics and Product Monitoring

- **Google Analytics:** website and documentation traffic analytics where enabled.
- **PostHog:** product analytics, behavior analytics, and error monitoring where enabled.

### 7.3 Authentication

LenserFight uses OAuth (GitHub, Google, Chainabit) to let you sign in seamlessly. When you use them, they process your sign-in request and share basic profile data (like email and username) with us. They operate under their own independent privacy policies, which you can review during authentication.

### 7.4 AI and Model Infrastructure

- **AI model and inference providers:** prompt processing, output generation, media generation, evaluation, embeddings, moderation, and related service operations.

### 7.5 Ecosystem Partners — Chainabit and ConectLens

**Chainabit** (chainabit.com) and **LenserFight** (lenserfight.com) are ecosystem partners operating within the ConectLens ecosystem (conectlens.com). Chainabit and LenserFight provide infrastructure, analytics, AI benchmarking, research, and platform-services collaboration for LenserFight Cloud.

Chainabit, LenserFight, and future ecosystem partners may process:

- public platform content (battles, agents, workflows, templates, prompts, benchmark results, leaderboard data),
- operational telemetry, metadata, logs, and diagnostics,
- platform analytics events, performance metrics, and usage signals,
- moderation and security signals,
- newsletter and contact form submissions,
- community interactions in public spaces,
- aggregated or anonymized benchmark and usage data.

This processing supports platform operations, reliability, security, abuse prevention, AI benchmarking, analytics, commercial research, discovery systems, public rankings, enterprise solutions, ecosystem integrations, newsletters, and related services. Certain operational telemetry and metadata collection may be necessary for platform functionality. LenserFight operates as an open-source ecosystem, and many operational and telemetry behaviors may be publicly inspectable via repository source code. Chainabit and ConectLens are not unrelated third-party data brokers — they are defined operational partners of LenserFight Cloud.

Private and sensitive content (secrets, API keys, credentials, private uploads, non-public business data) is not shared with ecosystem partners under these provisions and must not be published publicly by users.

Third-party providers act under their own terms and privacy policies for their independent services.

If you use BYOK or local execution, your selected provider may receive prompts, attachments, outputs, metadata, and account identifiers directly from your environment or LenserFight-controlled infrastructure depending on the execution mode. Review the provider's own terms, retention settings, training controls, rate limits, and abuse policies before submitting sensitive content.

---

## 8. Data Sharing and Transfers

Personal data is shared only as necessary for the purposes described in this Privacy Policy, including with service providers, infrastructure providers, authentication providers, analytics providers, AI providers, legal advisors, and authorized public institutions where legally required.

Due to the use of global infrastructure, analytics, authentication, storage, and AI providers, personal data may be transferred to or processed outside Turkiye or your country of residence. Such transfers are handled under applicable legal mechanisms, including GDPR safeguards such as Standard Contractual Clauses where required and KVKK transfer mechanisms where applicable.

---

## 9. Retention, Deletion, and Logs

Personal data is retained only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law, security investigation, abuse prevention, dispute handling, accounting, backup, or legal claims.

Retention examples:

- **Account data:** retained while the account is active and for legally required periods afterward.
- **Public content:** retained while published or needed for platform integrity, unless removed under applicable policy.
- **AI prompts, outputs, attachments, and workflow traces:** retained for the minimum period needed for history, safety, troubleshooting, abuse prevention, and legal compliance, subject to feature settings.
- **BYOK credential records:** retained while needed for the configured feature and removed or revoked through the relevant key-management workflow, subject to security, abuse-prevention, backup, and legal exceptions.
- **Security and application logs:** retained for a reasonable period. Log retention will not be shorter than 1 year or longer than 2 years unless a legal, security, abuse-prevention, backup, or dispute-related exception applies.
- **Analytics data:** retained within the scope of consent and platform analytics needs.
- **Deleted content:** eligible deleted data is removed or anonymized according to the relevant deletion workflow, subject to backup, safety, legal, and integrity exceptions.

---

## 10. Data Security

LenserFight applies reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. Measures may include encryption in transit, authentication controls, row-level security, least-privilege access, logging, rate limiting, security review, and incident response practices.

No internet-based service can be guaranteed to be completely secure. Users remain responsible for protecting account credentials, devices, API keys, model provider keys, uploaded files, prompts, and self-hosted environments.

---

## 11. Your KVKK Rights

Under KVKK Article 11, you may request:

- whether your personal data is processed,
- information about processed personal data,
- the purpose of processing and whether data is used in accordance with that purpose,
- the third parties to whom personal data is transferred domestically or internationally,
- correction of incomplete or inaccurate data,
- deletion or destruction of personal data under KVKK Article 7,
- notification of third parties regarding correction, deletion, or destruction,
- objection to results arising against you through exclusively automated processing,
- compensation for damages arising from unlawful processing.

To exercise your rights, contact **omer@chainabit.com**. Requests will be answered as soon as possible and no later than 30 days, unless applicable law permits a different period. You may also lodge a complaint with the Turkish Personal Data Protection Authority where applicable.

---

## 12. Your GDPR Rights

Where GDPR applies, you may have:

- right of access,
- right to rectification,
- right to erasure,
- right to restriction of processing,
- right to data portability,
- right to object,
- right to withdraw consent,
- rights related to automated decision-making and profiling,
- right to be informed of a personal data breach where required,
- right to lodge a complaint with a supervisory authority.

To exercise your rights, contact **omer@chainabit.com**.

---

## 13. Cookies

LenserFight uses cookies and similar technologies. See the **Cookie Policy** for details about essential cookies, analytics cookies, local storage, consent, and browser controls.

---

## 14. Governing Law, Language, and Updates

**Governing Law and Language:** This Privacy Policy is governed by the laws of the Republic of Turkiye, with the Turkish Personal Data Protection Law (KVKK) as the primary framework. The primary governing language of this policy is **Turkish**. English and other localized versions are provided for accessibility. In case of any inconsistency between the Turkish version and a translation, the **Turkish version controls**.

**Global Acceptance:** By registering, authenticating, publishing content, or using LenserFight Cloud services from any region or in any supported language, you acknowledge and accept this Privacy Policy and its processing terms.

This Privacy Policy is effective as of **May 19, 2026**. LenserFight may update this policy when necessary. Updated versions become effective when published unless a later effective date is stated.

---

## 15. Contact

For privacy-related questions or requests:

**Email:** omer@chainabit.com
