GPU Sharing Program Privacy Notice (KVKK)

Version 1.0 — effective date: 22.09.2026 Onysoft GPU Sharing Program Applies to individual and corporate applications

This English version is provided for convenience only. The Turkish text is authoritative; in case of any discrepancy the Turkish version prevails.

In short This notice explains which of your personal data we process within the Onysoft GPU Sharing Program, why and how. Your application details, confirmation records, your device's hardware and connection information, your IP address and records of the jobs run on your device (including the content of your own requests and their responses) are processed. Participation does not depend on explicit consent; only the optional commercial message permission is based on your explicit consent. Model and runtime files are downloaded to your device directly from Hugging Face and GitHub servers; during this, your IP address reaches those services. To exercise your rights you can contact info@onysoft.com.

This summary is only meant to make reading easier; the numbered clauses below are binding.

1. Data Controller

1.1

This privacy notice has been prepared by Onysoft Veri Merkezi Sistemleri Yazılım Sanayi ve Ticaret A.Ş. (“Onysoft”) as data controller, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1.2

Contact details of the data controller:

Item	Value
Name	Onysoft Veri Merkezi Sistemleri Yazılım Sanayi ve Ticaret A.Ş.
Address	İTOB OSB Mah. 10032 Sk. No: 2 İç Kapı No: Z13, 35470 Menderes / İzmir
Tax office and number	Menderes Vergi Dairesi — 6440947328
E-mail	info@onysoft.com
Phone	0850 302 3021
Website	https://api.onysoft.com

2. Scope

2.1

This notice covers natural persons who apply to and participate in the Onysoft GPU Sharing Program, authorised persons and technical contacts acting on behalf of organisations in corporate applications, and persons who use the Onysoft AI Gateway Node program.

2.2

Personal data processing relating to the general use of Onysoft AI Gateway services is described in the Privacy Policy at https://api.onysoft.com/privacy. This notice is a supplementary notice describing processing specific to the Program.

3. Categories of Personal Data Processed

3.1

The following personal data is processed within the Program:

Category	Data	Source
Identity	Name, surname; in corporate applications, the authorised person's position or title	Application form, Onysoft AI Gateway account
Contact	E-mail address, phone number; address and city if given in the application; in corporate applications, contact details of the technical contact	Application form, account details
Organisation details (corporate applications)	Organisation name, type, tax number and tax office, website, address; authorised persons and contacts associated with them	Application form; e-invoice registration lookup when a tax number is entered
Application details	Application type, number of devices and hardware declaration, intended use, remarks, application status, correspondence, review notes	Application form, Dashboard, e-mail
Legal transaction and consent evidence	Identifier and version of confirmed documents, date and time of confirmation, IP address, browser information (user-agent)	Automatically during application
Device and hardware	Computer name, operating system and architecture, processor model and features, number of cores, total memory, graphics card name, vendor, memory and driver version, free disk space, hardware tier	Automatically from the device by the Onysoft AI Gateway Node program
Program status	Program and runtime version, installed models and their status, sharing status and intensity, last connection time, number of completed jobs	Automatically by the Onysoft AI Gateway Node program
Network and connection	IP address; speed test results (download and upload speed, latency)	Connection between the program and our servers
Transaction security	Irreversible hash of the device access key, pairing code records, failed code attempts, event records (registration, connection, error and security events with the related IP address)	Server logs
Job and usage records	Content of your own requests and Onysoft test requests run on your device (including prompt and response texts), model name, token counts, durations, status and error codes; for your own requests, the IP address and client information of the sender	Onysoft AI Gateway web chat and API, server logs
Customer transactions	Support requests and related correspondence	Dashboard, e-mail
Marketing (only if you gave permission)	Whether you have given commercial electronic message permission, when it was given and withdrawn, and the evidence of permission (document version, IP address, browser information)	Optional checkbox on the application form

3.2

The Onysoft AI Gateway Node program does not access documents, photos or similar personal files on your device and does not send them to Onysoft. The program only reads the hardware and system information it needs to operate.

3.3

No special categories of personal data are requested within the Program. We recommend that you do not include special categories of personal data in the content of your own requests; if you do, that content is processed in the same way as other content, solely to carry out and record your request.

4. Purposes of Processing

4.1

Your personal data is processed for the following purposes:

(a)receiving and reviewing applications, notifying the outcome and communicating with applicants;
(b)verifying the organisation and the authorised person in corporate applications;
(c)concluding and performing the participation agreement; proving the confirmed document versions and the moment of confirmation;
(d)downloading the Program Software, checking versions and updates, and enforcing the minimum supported version;
(e)pairing the device with your account, authenticating it and preventing unauthorised access to it;
(f)determining the hardware tier, suggesting suitable models and assessing eligibility for sharing;
(g)relaying your own requests to your device, delivering responses to you and keeping usage records;
(h)sending test requests, verifying that the program and infrastructure work correctly, and detecting and fixing faults;
(i)ensuring information security and preventing and investigating misuse and breaches of the Acceptable Use Policy;
(j)answering support requests;
(k)only if you give permission, sending product, campaign and program announcements by e-mail and SMS;
(l)carrying out aggregate and statistical analyses to improve the Program;
(m)fulfilling legal obligations and responding to requests of competent authorities;
(n)establishing, exercising and protecting rights in legal disputes.

5. Legal Grounds

5.1

Your personal data is processed on the following legal grounds under Article 5(2) of KVKK:

(a)Processing is directly related to the conclusion or performance of a contract (Art. 5(2)(c)): reviewing the application, pairing, processing device and program status information, and carrying out and recording your own requests.
(b)Processing is necessary for the data controller to comply with a legal obligation (Art. 5(2)(ç)): record-keeping and retention obligations under legislation and requests of competent authorities.
(c)Processing is necessary for the establishment, exercise or protection of a right (Art. 5(2)(e)): keeping consent evidence and transaction records as evidence in case of dispute.
(d)Processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms (Art. 5(2)(f)): information security, misuse prevention, test requests, speed tests, error logs and statistical analyses.

5.2

None of the processing necessary for participation relies on explicit consent, and participation is not conditional on giving explicit consent.

5.3

Sending product, campaign and program announcements by e-mail and SMS relies solely on your explicit consent under Article 5(1) of KVKK and on the commercial electronic message approval you give under Law No. 6563 on the Regulation of Electronic Commerce. This permission is requested on the application form with a separate, unticked box under the Explicit Consent and Commercial Electronic Message Permission; not giving or withdrawing it does not affect the review of your application or your participation in the Program.

5.4

If any other processing based on explicit consent becomes necessary in the future, it will be presented to you in a separate, optional text.

6. Method of Collection

6.1

Your personal data is collected, partly or fully by automated means, through:

(a)the application form in the Dashboard and your account details, electronically;
(b)hardware and system information read on your device by the Onysoft AI Gateway Node program and the encrypted connection between the program and our servers;
(c)requests you send through the Onysoft AI Gateway web chat and API;
(d)event and access logs kept on our servers;
(e)e-mail, phone and support requests.

7. Transfer of Personal Data

7.1

Your personal data may be transferred, limited to the purposes above and in accordance with Articles 8 and 9 of KVKK, to the following groups of recipients:

(a)public institutions and judicial authorities legally authorised to request it: to fulfil legal obligations and respond to requests;
(b)our legal, financial and technical advisers bound by confidentiality: to protect rights and obtain advice;
(c)our hosting, e-mail and technical infrastructure suppliers: as data processors and only to the extent necessary to provide the service.

7.2

In corporate applications, when a tax number is entered, the organisation's e-invoice registration status and name may be looked up in the Revenue Administration records through the integrator we use.

7.3

Onysoft does not transfer the application, device and job records processed within the Program to recipients abroad. If such a transfer becomes necessary, it will be carried out in accordance with the conditions of Article 9 of KVKK and this notice will be updated.

7.4

When pages of our website and the Dashboard are viewed, the fonts and icons used on them are loaded from a font service located abroad. In doing so, your browser's IP address and technical information about your browser reach that service's servers; your name, e-mail address or application details are not sent to this service.

7.5

Requests of Onysoft customers are not routed to any participant device today; accordingly, participants' data is not shared with other customers and other customers' data is not shared with participants. If this changes in the future, a separate additional protocol and prior notice will be provided.

8. Downloads Made Directly from Your Device

8.1

The Onysoft AI Gateway Node program downloads the open-source llama.cpp runtime needed to run models from GitHub (github.com) and model files from Hugging Face (huggingface.co). These downloads do not pass through Onysoft servers; your device connects to these services directly.

8.2

During these connections, your device's IP address and technical information about the connection (for example the time of the request, the address of the downloaded file and the program's client information) reach the servers of the relevant service. These services process this information under their own privacy policies and on their own responsibility; their servers may be located outside Türkiye.

8.3

Onysoft does not transfer your personal data to these services. Onysoft's role is limited to specifying which file the program downloads from which address and the SHA256 hash used to verify it. We share this so that you know, by installing the program, that model and runtime downloads take place this way.

8.4

For the program's model suggestion feature, a summary of your device's hardware (operating system, graphics card type and acceleration method, memory sizes and the selected sharing intensity) is evaluated with a language model. This text does not include your name, e-mail address, IP address, device name or any other information that identifies you.

9. Retention Periods

9.1

Your personal data is kept for as long as necessary for the purpose for which it is processed. The periods applied today are:

Record	Retention period
Event records (device registration, connection, error and security events with the related IP address)	90 days; records older than this are automatically deleted on a regular basis.
Detailed speed test records	7 days
Failed pairing code attempts	1 day
Model suggestion cache and request counters	1 to 2 days
Request and response content in job and usage records	During participation; deleted or anonymised within 1 year at the latest after participation ends.
Device records, pairing code records, and the non-content details of job and usage records (time, model, token count, duration, result)	During participation and, after participation ends, for the retention and limitation periods set out in the relevant legislation
Application details and consent evidence	During participation and, after participation ends, for the limitation periods applicable to disputes that may arise from the agreement; for rejected applications, for the period necessary for possible objections and disputes after the application is concluded

9.2

Personal data whose retention period has expired is deleted, destroyed or anonymised. Onysoft reserves the right to delete request and response content earlier than the periods above.

9.3

When you sign out of the program, your device access key is deleted from your device and its invalidation on the server side is requested (if there is no connection at the time of sign-out, you can ask us in writing to remove the device); when your participation ends, the key is invalidated; past records relating to your device continue to be kept for the periods above.

9.4

On your device, the program's own folder holds settings, downloaded files and a rotating program log of up to 5 MB; this log contains no secret keys and stays on your device. These files are removed from your device when you uninstall the program or delete the folder.

10. Your Rights under Article 11 of KVKK

10.1

Under Article 11 of KVKK, by applying to the data controller you have the right to:

(a)learn whether your personal data is processed;
(b)request information if your personal data has been processed;
(c)learn the purpose of processing and whether it is used in line with that purpose;
(d)know the third parties in Türkiye or abroad to whom your personal data is transferred;
(e)request correction if your personal data is incomplete or inaccurate;
(f)request deletion or destruction of your personal data under the conditions of Article 7 of KVKK;
(g)request that correction, deletion or destruction be notified to third parties to whom your personal data was transferred;
(h)object to a result against you arising from analysis of processed data exclusively through automated systems;
(i)claim compensation if you suffer damage due to unlawful processing of your personal data.

11. How to Apply

11.1

You can submit requests regarding your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to İTOB OSB Mah. 10032 Sk. No: 2 İç Kapı No: Z13, 35470 Menderes / İzmir, signed with a secure electronic signature or mobile signature, or by e-mail to info@onysoft.com from the e-mail address registered in your Onysoft AI Gateway account.

11.2

Your application should include your name, surname, signature if the application is in writing, Turkish ID number for Turkish citizens (nationality and passport or ID number for foreigners), address for notifications, e-mail address if any, phone number and the subject of your request. Additional information may be requested to verify your identity.

11.3

Your request will be concluded free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the process involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

11.4

If your application is rejected, you find the response insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 of KVKK.

12. Updates

12.1

This notice may be updated in line with changes in the Program or legislation. The current version is published on this page with its version number and effective date; material changes are announced to participants by e-mail and in the Dashboard.

Data controller and contact Onysoft Veri Merkezi Sistemleri Yazılım Sanayi ve Ticaret A.Ş.
Address: İTOB OSB Mah. 10032 Sk. No: 2 İç Kapı No: Z13, 35470 Menderes / İzmir
Tax office and number: Menderes Vergi Dairesi — 6440947328
E-mail: info@onysoft.com
Phone: 0850 302 3021

Other program documents

Individual Participation Agreement (version 1.0)
Corporate Participation Agreement (version 1.0)
Acceptable Use Policy (version 1.0)
Technical Conditions and Security Policy (version 1.0)
Explicit Consent and Commercial Electronic Message Permission (version 1.0)

This document is confirmed electronically in the dashboard during application. At the moment of confirmation, the document identifier, version, date and time, IP address and browser information are recorded. You can keep a copy of the version you confirmed as a PDF using the Print button on this page.

how_to_regApply memoryAbout the program