AI-built apps and Turkey's KVKK: a guide for anyone collecting user data
If an app a prompt wrote collects names, emails or payment details from Turkish users, KVKK applies to it the same way it applies to hand-written code. Here is the operational checklist, not a legal opinion.
An app a prompt generated collects personal data the same way one a developer typed by hand does: a name, an email, a phone number, a payment detail, sometimes a health answer on an intake form. Turkey's data protection law, KVKK (Law No. 6698), does not ask who or what wrote the code. It asks whether personal data is processed, and if the answer is yes, three obligations follow: publish a disclosure notice, collect explicit consent wherever the law requires it, and answer a user's data request inside the legal deadline. This is an operational walkthrough of those three, written for the owner of an AI-built app, not a legal opinion.
TL;DR
KVKK applies regardless of who built the app. The three gaps that show up most often in AI-generated codebases: no disclosure text, no logged consent, and no process to answer a data-deletion or data-access request inside the 30-day legal window. None of these get added automatically by a prompt that never asked for them. This is not legal advice; it is the operational baseline before you call a lawyer.
This matters specifically for Turkey because the market has its own authority, its own law, and its own enforcement pattern, distinct from GDPR even where the two overlap. Treating KVKK as "basically GDPR" is exactly the kind of shortcut that gets a Turkey-facing product in trouble.
Does your app actually process personal data
Start with an inventory, not a guess. Open the signup form, the checkout flow, the booking form, and any admin table that stores user rows. Anything identifying a real person is personal data under KVKK: name, email, phone, address, a payment reference, an IP address logged on a server, a photo, a health answer on an appointment form. An app with a login and a database almost always clears this bar on day one.
Two categories raise the bar further. Payment data and health data are treated as more sensitive, and in KVKK's own category system, health data is "special category" personal data (Article 6) with a narrower legal basis than ordinary data. An AI-built booking or clinic app that stores a treatment note or a diagnosis sits in this category from the first row it saves.
What the KVKK Authority's own generative AI guide says
The Turkish Personal Data Protection Authority (KVKK Kurumu) published a dedicated guide on generative AI on 24 November 2025 (Yayın No. 113), titled "Üretken Yapay Zekâ ve Kişisel Verilerin Korunması Rehberi" (15 soruda). It frames the content-generation lifecycle, the use cases and risks of generative AI tools, and evaluates personal data processing activity around them under Law 6698, with separate sections of daily-use guidance for individuals and parental recommendations for child users. A companion document, "İş Yerlerinde Üretken Yapay Zekâ Araçlarının Kullanımı," addresses a specific workplace problem: employees adopting generative AI tools on their own, without an institutional policy governing how they're used, which makes the resulting data flows hard for any single person to manage or audit later.
Neither document is written for the case this guide covers: an app that an AI coding tool wrote, which itself collects personal data from end users. That gap, between "using AI tools at work" and "shipping an app an AI tool built for you," is exactly where this guide sits. Read the regulator's guide for the generative-AI-usage side; treat this one as the missing operational half for app owners.
Where the data actually sits: Supabase, Vercel, and the cross-border question
Most apps that come out of Lovable, Bolt, Cursor, v0 or Replit share a backend pattern: Supabase or a similar Postgres-as-a-service for the database, Vercel or Netlify for hosting, and often a third-party AI API in the request path for a chat feature or a generated summary. Each of those is, by default, a server outside Turkey, commonly in the US or the EU depending on the project's configured region.
Where a vibe-coded app's data actually travels
1. User
Fills a form in Turkey: name, email, a payment field.
2. The app
AI-generated frontend and API routes, no data residency choice made.
3. Database
Supabase/Postgres, default region usually US or EU, not Turkey.
4. AI API (if used)
A chat or summary feature calling OpenAI or Anthropic, almost always a US endpoint.
Every arrow in this diagram is a cross-border transfer question under KVKK Article 9, which was amended in 2024 to tighten how a data controller justifies sending personal data outside Turkey. The current routes are an adequacy decision, an undertaking (taahhütname) approved by the Authority, or binding corporate rules, each with its own paperwork. Which one applies to a given vendor is a question for a lawyer or the Authority's current guidance, not a default a coding agent picks for you.
None of this means an AI-built app cannot use Supabase or Vercel. It means the transfer has to be accounted for in the disclosure text and justified under one of the lawful transfer grounds, the same as it would for a hand-coded app using the same vendors. A prompt that never mentions KVKK does not add this paperwork on its own.
The disclosure notice and consent: the two documents a prompt skips
Article 10 of Law 6698 requires a data controller to run an aydınlatma (disclosure) process at or before the point of collection: who is collecting the data, for what purpose, on what legal basis, who it might be shared with, and how a user exercises their rights. Article 5 sets out when explicit consent is the legal basis required, versus when another ground (performing a contract, a legal obligation, a legitimate interest) already covers the processing without it.
An AI coding tool will draw a signup form that looks complete, with a checkbox next to "terms and conditions." It has no reason to draft disclosure text naming your actual purposes and vendors, or to log consent in a way you can later prove to an auditor or a user who disputes it. Both of those are product decisions a prompt was never given, not something the tool forgot.
What Kavcar's data-request flow actually does
Lumiasoft built an online course and one-on-one lesson platform for Kavcar from scratch: course and module management, tiered packages, a coupon engine, Shopier-based payments reconciled through a signature-verified webhook plus a five-minute polling job as a second layer, and content protection hardened well past the usual checklist, signed video embeds, a single-viewer lock, a moving identity watermark, PDF stamping. Inside that build sits a KVKK data-request flow: when a student asks for their data, the request routes through a package that even the platform's own admin account cannot open directly.
That single design choice answers the hardest part of Article 11 in practice: proving that a data subject's access and portability rights are honored without a staff member becoming an unlogged extra point of access to the same data the request is about. It is also the kind of answer a generic checklist never surfaces, because it depends on actually building the access-control boundary, not describing one.
How many days you have once a user files a request
Article 13 sets the clock: a data controller answers a data subject's application as soon as possible, and no later than 30 days, free of charge as a rule. The 30-day line is fixed; what varies by app is whether anyone can actually locate every table a user's data sits in before that deadline arrives.
Article 13's response clock
Day 0: request received, in writing or through a registered channel.
Day 15: realistic internal target if the data lives across more than one table or vendor.
Day 30: the statutory deadline under Article 13; past it, the request is a compliance failure regardless of workload.
If deletion, correction and export were never designed into the data model, an admin ends up hand-writing SQL against production to answer a single request, under a 30-day clock, for every request that arrives. That is the operational cost of skipping this step at build time.
Checklist: how ready is the app your prompt wrote
Each item below is something to check against the actual running app, not against what the prompt was told to build.
If more than one or two rows above are missing, this isn't a prose fix. For the technical half of this list, before even getting to the legal paperwork, see the eight-point security checklist for AI-built apps first: an exposed database or an unverified webhook makes the data-protection question moot.
This is not a legal opinion, and here's where it stops being enough
Everything above is the operational layer: what to check, what the law's deadlines are, where data actually travels. It is not a substitute for a lawyer reviewing your specific processing activity, your contracts with Supabase or your payment provider, or your VERBİS registration status if your processing volume requires one. Health data, biometric data, or any flow involving minors crosses into territory where a generic checklist stops being a safe guide and a compliance lawyer becomes the next call, not an optional one.
If the checklist above turned up real gaps and the codebase needs someone to close them, that is a handover, not a rewrite. Our AI project completion service starts with a free code review before any scope is quoted, specifically so you know what's actually open before paying to close it.
Frequently asked questions
Does KVKK apply if my app's users are outside Turkey?
KVKK governs processing of personal data belonging to people in Turkey and processing carried out by data controllers established in Turkey, regardless of where the app's servers sit. An app with Turkish users needs to comply even if every server is abroad.
Is a cookie banner enough for consent?
No. A cookie banner covers tracking technologies, not the broader disclosure and consent obligations under Articles 5 and 10 for account data, payment data, or anything collected through a form.
Do I need to register with VERBİS?
VERBİS (the Data Controllers' Registry) is required above certain employee-count and data-volume thresholds set by the Authority, with some exemptions. Whether a given app crosses that line is a question for the current Authority criteria, not a blanket yes or no.
Can I just copy another company's disclosure text?
No. A disclosure notice has to name your actual purposes, your actual vendors and your actual legal basis. A copied notice that doesn't match what the app actually does creates its own liability if a user or the Authority checks it against reality.
What's the fastest way to know how exposed my app is?
Run the checklist in this guide against the live app and its database schema, not against the original prompt. Where an item fails, that is the actual gap, independent of how complete the app looked in the demo.