Legal review for projects built with AI

← All guides 4 min read

15 legal checks before launching a SaaS product

On launch day a SaaS product processes personal data, takes payments, sends emails and usually relies on infrastructure abroad. The list below brings together the legal points most often missed before launch under Turkish law. Most are covered in detail in the site's 12-question check.

15 checks

1. Imprint detailsThe provider's trade name, address, contact and tax details must be accessible on the site (Law No. 6563).
2. Data inventoryWrite down which personal data is collected for what purpose, where it is stored and who receives it.
3. Privacy noticePrepare a project-specific KVKK privacy notice based on the inventory.
4. ConsentOnly for processing that genuinely needs it, separate from the notice and with unticked boxes.
5. Cookie consentNon-essential cookies and analytics must not run before the user consents.
6. Cross-border transferPut an Art. 9 safeguard (e.g. standard clauses notified to the Authority) in place for hosting, database, email and AI providers.
7. Provider agreementsHave a data processing agreement with every service that processes data on your behalf.
8. VERBİSAssess whether registration with the data controllers' registry is required and register if so.
9. Retention and destructionSet a retention period for each data type and define what happens to data when an account is deleted.
10. Security measuresCheck under KVKK Art. 12 that secret keys are not in the code, database access rules are set, and encryption and permissions are in place.
11. Breach planWrite down in advance who does what in a leak and how the Authority is notified within 72 hours.
12. Terms of useConsumer vs business customers, limitation of liability and account suspension should be set out under Turkish law.
13. Distance sales and subscriptionsPre-contract information, the distance sales contract, the right of withdrawal and easy cancellation must comply with consumer law.
14. Commercial electronic messagesObtain separate consent for marketing emails and SMS and keep records in the Message Management System (İYS).
15. Intellectual propertySecure ownership of the code and design through the developer agreement, check open-source licences and consider trademark registration.

Not every point carries the same weight for every project. The quickest way to set priorities is to take the 12-question check or have your AI assistant review the project.