Privacy policy

Kelrova provides cloud security scans for code repositories through kelrova.com, the app at app.kelrova.com and the Kelrova MCP server (together, the “Service”). Kelrova is run by Sinan Büyükbayrak, an individual based in Istanbul, Türkiye (“Kelrova”, “we”, “us”), who is the controller of the personal data this policy describes and the data controller (veri sorumlusu) under Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”).

This policy covers personal data we process when you visit kelrova.com, create an account, use the app or the MCP server, buy a plan, open a support ticket or write to us. It does not cover services you connect to Kelrova, such as GitHub, GitLab, Bitbucket or Google; their own policies apply.

Repository content and workspace data that an organization brings to Kelrova can contain personal data about other people, such as names or email addresses in source code or commit history. We process that content on the organization’s behalf and on its instructions, as its processor, and only to provide the Service to it.

We have not appointed a representative in the European Economic Area or the United Kingdom. Wherever you are, you can reach us directly at info@kelrova.com.

We collect the categories below. Most of it you give us directly, or it is created as you and your organization use the Service.

• Account. Your name, email address and password. We store your password only as a salted hash. If you sign in with Google, we receive your Google account’s email address, name and account ID, and your profile photo when you link Google to an account you already have. We also keep your organization memberships and roles, and whether two-step verification is on.
• Sign-in sessions. For each session we record when it started, its IP address and your browser’s user agent, so you can review and end your sessions and so we can protect your account.
• Workspace. What your organization creates in Kelrova: projects and their connected sources with the paths excluded from each, scan settings such as instructions, threat model and report language, schedules, scan runs and their results, findings with their status, tags and history, the activity log, records of pull requests Kelrova opened for you, and the MCP clients you connect with their permissions and projects.
• Repository content. When a member starts a scan, re-check or fix, Kelrova downloads the selected branch of the repository, without the paths you excluded, into an isolated scan environment. Findings keep what you need to understand them, such as file paths, line references and short excerpts of code. Sections 5 and 6 explain how we keep and protect it.
• Source connections. The GitHub App installation you grant, or the GitLab or Bitbucket connection you approve, with the access tokens Kelrova needs to read your repositories and work on the pull requests you ask for. For GitLab and Bitbucket this includes the webhooks Kelrova registers on your repositories (section 6). They notify us of pull request activity in those repositories; from each notification we keep only the status of pull requests Kelrova opened, such as whether one is open, merged or closed and its latest commit, and we do not store the notification itself.
• Usage and billing. Your plan and trial dates, how much of the included usage you have used, your balance and top-ups, and the order, subscription and refund records we receive from Polar, our payment provider. Polar collects your payment details; we never see or store your full card number.
• Support tickets. The subject and messages you send, any images you attach (up to three per message) and who sent them.
• Email. A log of the emails we send you (sign-in codes, security notices, invitations, scan and schedule updates, trial, usage and billing notices, and support replies) with each email’s type, recipient and time. The log does not keep the email’s body.
• Website contact form. Your name, work email, company if you give it, the topic and your message, with a keyed hash of your IP address (never the address itself) and your browser’s user agent, which we use to prevent abuse. Before the form sends, Cloudflare Turnstile, a bot check, runs in your browser; our API then asks Cloudflare to confirm the check, passing its one-time token and your IP address.
• Website visits. Cloudflare Web Analytics counts visits to kelrova.com. When a page loads, its script reports the page address, the referring page, your browser type and how fast the page loaded. It is cookieless: it sets no cookies, uses no local storage and builds no profiles of individual visitors.
• Technical logs. Records of requests to our services kept by our hosting provider, and our own operating logs. We design our logs to leave out repository content, tokens, email addresses and IP addresses.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google account data only to sign you in and show who you are in the app.

We do not ask for special categories of personal data, such as health or religious beliefs. Please do not include them in scan instructions, support tickets or messages to us.

We use personal data only for the purposes below. The legal bases refer to Article 6(1) of the GDPR and Article 5(2) of KVKK.

Provide the Service

Create and secure your account, run the scans, re-checks and fixes your organization asks for, store findings, open pull requests a member requests and keep their status current, and connect MCP clients. Basis: performance of our contract with you or your organization (GDPR 6(1)(b); KVKK 5(2)(c)).

Billing

Set up trials and plans, measure usage, keep the balance and keep billing records. Basis: contract, and our legal duty to keep tax and accounting records (GDPR 6(1)(c); KVKK 5(2)(ç)).

Email about the Service

Send sign-in codes, security notices, invitations and billing notices (contract), and optional updates such as finished scans, which you can turn off under Settings → Notifications or with the unsubscribe link (our legitimate interest in keeping you informed; GDPR 6(1)(f); KVKK 5(2)(f)).

Support and enquiries

Answer support tickets (contract) and messages from the website contact form (our legitimate interest in answering people who write to us).

Security and abuse prevention

Protect accounts, detect misuse, keep bots away from the contact form, limit abusive traffic and investigate incidents. Basis: our legitimate interest in keeping the Service and its users safe, and legal duties where they apply.

Operate and improve

Measure how the Service runs, such as scan durations and error rates, count visits to the website in aggregate, and fix faults. When we investigate a specific failed scan, staff look only at what the investigation needs. Basis: our legitimate interest in a reliable Service.

Legal matters

Comply with the law, answer lawful requests from authorities, and establish, exercise or defend legal claims. Basis: legal obligation and legitimate interests (KVKK 5(2)(e)).

We do not sell personal data, share it for cross-context behavioural advertising, or use it for advertising of any kind. We do not send marketing newsletters; if we ever do, we will ask for your consent where the law requires it. We do not make decisions about people based solely on automated processing; scans analyse code, not people.

Account data is needed to provide the Service. Without it, we cannot create your account.

We use the categories of providers below to run Kelrova. Processors among them act on our instructions under contracts that require them to protect the data, and each receives only what its work needs.

Hosting and network

Cloudflare runs our websites, API and network edge, and stores files such as support images and encrypted database backups. It handles the data that passes through or is stored in the Service. Cloudflare also provides the contact form’s bot check (Turnstile) and the website’s visit counts (Web Analytics).

Server infrastructure

Our database and scan runtime run on servers located in Istanbul, Türkiye. They hold account, workspace and billing data, and repository content while a scan runs.

Analysis

Third-party model providers perform the analysis in scans, re-checks and fixes. They receive the repository content a scan or fix reads and the scan settings it needs, not your account or billing details. We send this content to them under their commercial API terms. Under those terms they do not use it to train their models, and they keep it only for a limited period, at most 30 days, to monitor abuse, unless the law requires them to keep it longer.

Email delivery

An email delivery provider sends our emails. It receives your email address and the email’s content.

Payments

Polar is our merchant of record. It sells the subscription to you, processes payments, handles tax and issues invoices, as an independent controller under its own privacy policy. We share your organization’s identifier and the billing contact’s name and email address with it.

Source hosts

GitHub, GitLab and Bitbucket, when you connect them. We exchange data with them at your direction: to read repositories, to open and manage the pull requests you ask for, and to receive the notifications they send us about those repositories.

Google

Only if you choose to sign in with Google.

We may also disclose personal data when the law requires it, to protect the rights and safety of our users, the public or Kelrova, or to a successor in a merger, acquisition or sale of assets, in which case we will tell you first. A current list of our subprocessors is available on request at info@kelrova.com.

We keep personal data only as long as we need it for the purposes in section 3.

Repository content

The working copy downloaded for a scan is destroyed when the scan ends. Paths, line references and code excerpts in findings stay with the finding.

Account and workspace

For as long as the account or organization exists. When you ask us to delete them, we delete them from our live systems within 30 days of your request.

Source connections

Until you disconnect the source, which deletes the stored credentials. GitHub App access tokens are created when needed and expire within an hour. Disconnecting a GitLab or Bitbucket connection, or removing a repository from it, also deletes the webhook Kelrova registered on each repository. If the provider refuses, or our access was already revoked, the webhook stays on the repository until you delete it, but Kelrova no longer accepts its notifications. For each notification we keep only a one-way digest of its delivery identifier for 7 days, so repeats are ignored.

Billing records

For as long as tax and commercial law requires. Polar keeps its own records under its policy.

Support tickets

For as long as the organization exists, then deleted with its workspace.

Contact form

12 months after we receive the message, then deleted.

Email log

90 days.

Sign-in codes

Codes expire after 10 minutes and are deleted within 24 hours.

Technical logs

Our hosting provider’s log retention period. IP addresses used to limit abusive traffic are kept for the limit window plus one hour.

Backups

Encrypted database backups roll over within about three weeks, so deleted data leaves them on that cycle.

We may keep data longer where the law requires it, or to establish, exercise or defend legal claims.

We protect personal data with technical and organizational measures suited to the risk. In plain words:

• Encryption in transit. Connections to Kelrova and between our services use TLS.
• Scoped repository access. Kelrova reaches only the repositories you connect: through GitHub App tokens limited to the repositories you grant and valid for at most an hour, or through the GitLab or Bitbucket connection you approve. Scans only read. Kelrova writes to a repository in two cases. When a member asks for a fix, it creates a branch and opens a pull request; its later writes stay on that pull request and its branch, and it merges or closes the pull request only when a member asks. When you grant a GitLab or Bitbucket repository, Kelrova registers a webhook in that repository’s settings that notifies us of pull request activity. We use those notifications only for Kelrova’s own pull requests: to keep their status current and, when one changes, to run the merge gates your organization has turned on. On GitHub, notifications come through the Kelrova GitHub App itself, and no webhook is added to your repositories.
• Isolated scan runtime. Each scan runs in its own isolated environment in our cloud runtime, separate from other scans, with its own resource limits and a working copy that is destroyed when the scan ends. Scan environments cannot reach our database.
• Access control. Organization roles decide who can run scans, view findings and manage billing. Within Kelrova, access to production systems and customer data is limited to the people who need it to run and support the Service.
• Account protection. Email verification, optional two-step verification with an emailed code, short-lived sign-in tokens, and passwords stored only as salted hashes.
• Protected secrets and backups. Stored source connection tokens and webhook secrets are encrypted, and so are our database backups.
• Careful logging. Our logs are designed to leave out repository content, tokens, email addresses and IP addresses.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires. To report a security issue in Kelrova, use the contact page or email info@kelrova.com.

Our database and scan runtime are in Istanbul, Türkiye, and Cloudflare serves our websites and API from its global network. We and our providers therefore process personal data in several countries, which can include countries outside your own, such as the United States.

When we transfer personal data out of the European Economic Area, the United Kingdom or Türkiye, we use a transfer mechanism the applicable law recognises, such as the European Commission’s standard contractual clauses, the UK addendum to them, or standard contracts under Article 9 of KVKK, or we rely on another lawful ground for the transfer. You can ask us about the safeguards we use.

Depending on where you live, you have rights over your personal data. We honour the following for everyone, within the limits the law sets:

• Access. Ask what personal data we hold about you and get a copy.
• Correction. Ask us to correct inaccurate or incomplete data. You can change most account details yourself in the app.
• Deletion. Ask us to delete your personal data, including your account.
• Restriction. Ask us to limit how we use your data while a concern is resolved.
• Portability. Get data you gave us in a structured, machine-readable format.
• Objection. Object to processing based on our legitimate interests.
• Consent. Withdraw consent at any time where we rely on it, without affecting earlier processing.

To use these rights, email info@kelrova.com from the address on your account. We may need to confirm your identity, and we answer within 30 days. For workspace content that an organization controls, we may refer your request to that organization’s owners.

European Economic Area and United Kingdom

You can complain to the data protection authority where you live or work, or where you believe an infringement happened. We would appreciate the chance to address your concern first.

Türkiye (KVKK)

Under Article 11 of KVKK you can ask whether your personal data is processed and for information about it; learn the purpose of processing and whether the data is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; ask for correction, deletion or destruction, and for those actions to be notified to the recipients; object to a result against you that arises exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

Send your request in writing to Sinan Büyükbayrak (Kelrova), Istanbul, Turkey, or by email to info@kelrova.com from the address registered on your account. If we reject it, or do not answer within 30 days, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

United States

If a US state privacy law applies to you, you have the rights it gives you, including to know, correct and delete your personal information. We will not treat you differently for using them.

kelrova.com, the website you are reading, sets no cookies of its own and uses no advertising or cross-site tracking scripts. When it loads public figures from our API or sends the contact form, it sends no cookies or credentials.

Two Cloudflare scripts run on it. Cloudflare Web Analytics counts visits without cookies or local storage and builds no personal profiles (section 2). On the contact page, Cloudflare Turnstile checks that a person, not a bot, is sending the form, and may set a Cloudflare cookie for that purpose only. Because the check protects the form, we do not ask for consent to it.

The app at app.kelrova.com uses only the cookies below, which it needs to sign you in and keep your account secure. Because they are strictly necessary, we do not ask for consent to them.

kelrova_at

Signs in your requests to the app. Lasts 15 minutes.

kelrova_rt

Keeps you signed in by renewing the cookie above. Lasts up to 30 days.

kelrova_mfa

Holds a sign-in while you enter a two-step verification code. Lasts as long as the code is valid.

kelrova_oauth

Protects Google sign-in against forged requests. Lasts 10 minutes.

Connection cookies

Protect the steps where you connect an MCP client, GitLab or Bitbucket against forged requests. Short-lived.

The sign-in cookies are set for the kelrova.com domain, so a browser signed in to the app may also send them with requests to kelrova.com. The website does not read or use them.

The app keeps preferences and unsent drafts in your browser’s local storage. It does not keep sign-in tokens there.

Kelrova is a service for software teams and is not directed to children. You must be at least 18 to create an account. We do not knowingly collect personal data from children; if you believe a child has given us personal data, contact us and we will delete it.

We update this policy when our practices or the law change, and show the new effective date at the top. If a change materially affects how we use your personal data, we will tell account holders by email or in the app before it takes effect. Earlier versions are available on request.

For questions, requests or complaints about privacy, write to us:

• Email. info@kelrova.com
• Post. Sinan Büyükbayrak (Kelrova), Istanbul, Turkey
• Web. The contact page