Privacy and Cookie Policy

الإصدار 5 · تاريخ السريان: ٢٩ سبتمبر ٢٠٢٦

هذه ترجمة؛ وعند التعارض يُعتمد النص التركي.

Version 5 · Effective date: 29 September 2026

This policy explains how privacy is protected on the EVOS website (evos.noniux.com) and in the EVOS application provided by Noniux ("Noniux"), which cookies and browser storage entries are used, and which third-party services are involved.

The data Noniux processes as data controller, the purposes, legal grounds and your rights are set out in detail in the KVKK Privacy Notice. For the data customer companies enter into their EVOS workspace, Noniux is a data processor; that relationship is governed by the Data Processing Agreement.

1. In short

We do not use advertising, analytics, tracking or social media cookies.
All cookies we use are first-party: strictly necessary cookies that keep you signed in, and preference cookies written only when you make a choice.
The website has no forms; no cookie is written on your first visit.
Your card details never reach Noniux; payment is made in iyzico's form.
Each customer company's data is kept in a separate database.
Conversations with the workspace assistant are stored for 1 year, masked and pseudonymised, to improve the assistant; only Noniux platform administrators can see them.

2. Website

When you first open the website, it is shown in English and no cookie is written for this. When you choose a language, your choice is saved in the language cookie.
The contact links take you to WhatsApp or to your e-mail app. The website does not collect information from you through these links; the conversation takes place on WhatsApp or by e-mail as you start it.
Fonts are served from our own server; no request is sent to an external font service such as Google Fonts.
The website loads no external scripts, advertising, analytics or tracking tools.
EVOS assistant: Questions you type into the assistant on the website are sent to the AI service provider (section 6) to generate an answer. Noniux does not store the conversation on its servers; it is kept only in your browser for at most 24 hours so you can pick up where you left off (section 4.3). To prevent misuse, only a count of requests tied to your IP address is kept briefly in server memory. Do not type personal data into the assistant.
Technical records such as IP address, browser information and request time may arise at the server and network layer for security; these records are used only for security and troubleshooting.

3. Application

3.1 Whose data, whose responsibility

Account, sign-in, security, subscription and payment data: Noniux is the data controller (KVKK Privacy Notice).
Data a customer company enters into its workspace (visitors, buyer delegations, participants, institutions, employees, messages, files): the customer company is the data controller and Noniux is the data processor (Data Processing Agreement).
Workspace assistant improvement records (section 3.3): the customer company is the data controller and Noniux is the data processor; the records are kept on the customer company's instruction under Article 4(4) of the Data Processing Agreement, solely to improve the assistant, and are not used to train artificial-intelligence models..

3.2 Hosting and separation

The application, databases, files and backups run in Hetzner Online GmbH's data centres in the European Union.
A separate database is created for each customer company; a user of one company cannot access another company's data.
Files are kept in an object store running on the same server.
Databases are backed up every night, every backup is verified, and backups are deleted after 14 days.

3.3 Integrations enabled by the customer company

The following services only come into play when the customer company or its users use the relevant feature, and only run on that company's instructions. Details are in the Data Processing Agreement.

WhatsApp Cloud API (Meta): sending and receiving messages on the customer company's official WhatsApp number.
WhatsApp connection server: middleware running on Noniux's server that connects to WhatsApp.
E-mail delivery service (Resend): booking confirmations, announcements and institutional e-mails; used only if e-mail sending is enabled.
AI service provider (chosen by Noniux; e.g. Ollama): drafting messages and extracting information from documents; runs only when Noniux configures a provider.
Workspace assistant: What you type into the assistant in the application, the address of the screen you are on and that screen's map (field names, the options of selection lists and button names) are sent to the AI service provider to generate answers and fill forms. Values typed into fields are not sent; selection lists may contain the options shown on screen (e.g. fair or employee names). To answer, the assistant may read the name, company, country and status of records you are allowed to see, never phone, passport, e-mail or address; the conversation is kept in this browser for 24 hours, separately for each company and user; approval tokens and quota counters are technical data only. The assistant works only on screens you can open and with your permissions, and fills fields at your request; it applies a change only after you approve it on an approval card, and each such change is recorded in an audit log that contains no personal data; deleting is always done by you. To improve the assistant, the questions you type into the workspace assistant, the assistant's answers and the tools it used (tool name, result, duration) are also stored on Noniux servers for 1 year: your company and your user account are recorded only as irreversible pseudonyms; phone numbers, e-mail addresses, passport, national ID (TCKN), IBAN and card numbers are masked before storage; names and your wording are kept as written so that we can study how requests are phrased. Any thumbs-up/thumbs-down rating you give an answer and your optional short note are added to the same record. Only Noniux platform administrators can see these records; your company, including its administrators, cannot. They are used only to improve the assistant (finding inconsistencies, frequent requests and failing behaviour, and preparing test scenarios) and are deleted automatically after 1 year (sections 4.3, 8).

3.4 Processing in your browser

Document and ticket reading (OCR): ticket or receipt images are read in your browser without being sent to the server. The open-source library files needed for this are downloaded from the jsDelivr content delivery network at the moment you use the feature; your IP address and browser information reach jsDelivr at that time. The image itself does not leave your device.
TOBB company directory screen: site icons of companies are requested from Google's site icon service; your IP address and the domain being displayed reach Google at that time.

3.5 Payment pages

On subscription and payment link pages, iyzico's payment form and script are loaded. Card details are entered directly into iyzico; Noniux neither sees nor stores them. When its form loads, iyzico may use cookies or similar technologies from its own domain; these are governed by iyzico's own policies.

4. Cookies

A cookie is a small text file a website saves in your browser. EVOS uses only the first-party cookies below.

4.1 Strictly necessary cookies

Without these cookies you cannot sign in and the session cannot be kept secure.

aseel_session

Purpose: keeps an EVOS user signed in. Contains a signed token: user identifier, company, role, name and e-mail.
Duration: 7 days; deleted when you sign out.
Type: first-party, strictly necessary. Not readable by browser scripts (HttpOnly), sent only over secure connections (Secure), restricted on cross-site requests (SameSite=Lax).

evos_platform

Purpose: keeps a Noniux platform administrator signed in. Sent only to the platform administration screens.
Duration: 8 hours; deleted when you sign out.
Type: first-party, strictly necessary. HttpOnly, Secure, SameSite=Strict.

evos_platform_step

Purpose: remembers that a platform administrator has passed the password step until the two-factor code is entered.
Duration: 10 minutes; deleted when sign-in completes.
Type: first-party, strictly necessary. HttpOnly, Secure, SameSite=Strict.

4.2 Functional preference cookies

These cookies only remember a choice you made. They contain no personal data, only the chosen value.

aseel_locale

Purpose: remembers the interface language you chose (Arabic, Turkish or English).
Duration: 1 year.
Type: first-party, functional preference. Written only when you choose a language. SameSite=Lax.

aseel-theme

Purpose: remembers the appearance you chose in the application (light, dark or system) so the page does not flash in the wrong colours when it opens.
Duration: 1 year.
Type: first-party, functional preference. SameSite=Lax.

aseel-density

Purpose: remembers the screen density you chose (comfortable or compact).
Duration: 1 year.
Type: first-party, functional preference. SameSite=Lax.

aseel-ui

Purpose: remembers the menu layout you chose (classic or flow).
Duration: 1 year.
Type: first-party, functional preference. SameSite=Lax.

aseel_event

Purpose: remembers the active fair you selected in the top bar (a single fair, all fairs or "My fairs").
Duration: 1 year.
Type: first-party, functional preference. SameSite=Lax.

Appearance, density and layout preferences are also stored in your account; the cookie only makes the page open with the right look, and on a new device it is written again from your account preference.

4.3 Browser storage (localStorage)

The entries below are kept only in your browser and are not sent to the server automatically.

evos-assistant:[type]:[user]

Purpose: remembers your conversation with the EVOS assistant, whether its window is open, and where the assistant orb sits on screen, so you can pick up where you left off after closing and reopening the tab. It contains what you typed into the assistant and is kept separately for each company and user. A masked, pseudonymised copy of workspace assistant conversations is also stored on Noniux servers for 1 year (section 3.3).
Duration: 24 hours; deleted at once with "New chat" in the assistant.
Type: local storage, functional.

aseel.draft.[form].[user]

Purpose: keeps unfinished form content so that what you typed is not lost if the page reloads. It may contain the information you typed into the form.
Duration: 24 hours; deleted when the form is submitted.
Type: local storage, functional.

aseel.chatDraft.[conversation]

Purpose: keeps a message draft you typed but have not sent.
Duration: treated as expired after 14 days; deleted when the message is sent.
Type: local storage, functional.

aseel-survey:[link]

Purpose: keeps your survey answers until you submit them.
Duration: deleted when the survey is submitted; otherwise kept until browser data is cleared.
Type: local storage, functional.

aseel.view.[screen]

Purpose: remembers whether you chose list or card view on a screen.
Duration: until browser data is cleared.
Type: local storage, functional preference.

aseel.tour.[tour].v[version]

Purpose: remembers that you have seen the guided tour so it does not restart every time.
Duration: until browser data is cleared.
Type: local storage, functional preference.

aseel.clients.exportColumns

Purpose: remembers the columns you chose for Excel export.
Duration: until browser data is cleared.
Type: local storage, functional preference.

If you work on a shared computer, we recommend signing out and clearing browser data when you finish.

According to the Turkish Personal Data Protection Authority's guidance on cookie practices, explicit consent is not required for cookies that are strictly necessary to provide the service. EVOS has no analytics, advertising or third-party cookies; the strictly necessary cookies are needed for sign-in and security, and the preference cookies are written only after an explicit choice of yours and hold only that choice. For this reason no cookie consent banner is used, and information is provided through this policy. If an analytics or similar cookie is added in the future, your consent will be obtained in advance.

4.5 Managing cookies

You can view and delete cookies and local storage in your browser settings. If you delete the session cookie, you will be signed out. If you delete preference cookies, language and appearance return to their defaults.

5. Analytics

EVOS does not perform visitor or user analytics. The application code contains a Vercel Analytics component; however, it is only activated when the application runs on Vercel's infrastructure. Because EVOS runs on a Hetzner server, this component is not added to pages and no analytics data is sent to Vercel.

Hetzner Online GmbH: hosting, databases, files and backups; Hetzner Online GmbH's data centres in the European Union. Abroad.
iyzico: subscriptions and payments. Türkiye.
Meta (WhatsApp): WhatsApp correspondence; the WhatsApp integration enabled by the customer company. Abroad.
Resend: e-mails sent by the customer company; only if e-mail sending is enabled. Abroad.
AI service provider (chosen by Noniux; e.g. Ollama): drafting and document reading features used by the customer company, and questions typed into the EVOS assistant on the website and in the application; only when Noniux configures a provider. Abroad if a cloud service is used; no transfer abroad for an installation running on the Noniux server.
jsDelivr and Google: the browser-side requests described in 3.4 above. Abroad.
Vercel (transition-period redirect): redirecting old addresses to evos.noniux.com; requests passing through this bridge pass through Vercel's infrastructure. Abroad.
GitHub: source code and software images; they contain no personal data.

Transfers abroad that Noniux makes to its service providers are made under KVKK Article 9 by concluding the standard contract announced by the Board, and the standard contract is notified to the Authority. Details are set out in the KVKK Privacy Notice.

7. Security

A separate database for each customer company.
Passwords stored as one-way hashes.
Temporary lock per account and per IP address after failed sign-in attempts.
Two-factor authentication: optional for users, mandatory for platform administrators.
Two-factor secrets, identity numbers and integration keys encrypted with AES-256-GCM.
Sensitive actions written to an audit log.
Daily, verified database backups.

8. Retention

Retention periods for the data Noniux controls are in the KVKK Privacy Notice. Workspace data is kept and deleted according to the customer company's instructions and the Data Processing Agreement.

Workspace assistant improvement records (section 3.3) are kept for 1 year from the date they are recorded and are then deleted automatically.

9. Your rights and how to apply

Your rights under Article 11 of the KVKK and how to apply are described in the KVKK Privacy Notice. Requests are concluded free of charge within 30 days at the latest. For your data in a customer company's workspace, you need to apply to that company.

10. Children

EVOS is a service for businesses and is not directed at persons under 18.

11. Changes and contact

When this policy is updated, the new version is published on this page; earlier versions are kept. For questions: info@noniux.com. Other business details are provided by e-mail on request.

In case of conflict, the Turkish version prevails.