Trust and compliance ยท 2026-09-19
Does EVREN keep logs? Terms of use, records and data privacy
Are the prompts you send to the EVREN LLM API recorded? We listed what public sources show and what they do not: terms of use that cannot be read without a key, a content-policy layer on generative endpoints, identity-bound requests and per-request status records.
The short answer
We do not know, and why we do not know is the real subject of this article. We found no public text explaining whether EVREN records prompts, how long it keeps them or whether it uses them in model development.
This is not a claim that it records them. It is a finding that no public commitment saying it does not record them exists either. In that situation the safe assumption is this: the provider may keep records.
To read the terms, first open the account that will accept them
EVREN manages its terms of use through the API: /v1/terms/status returns the current version and acceptance state, /v1/terms/text returns the text, and /v1/terms/accept records acceptance. The is_material field in the status response signals that a material change requires accepting the terms again.
Reading the terms of use first requires an API key. A request without one returns 401. In other words, you can read the terms once you have opened the account that will accept them. We found no public terms-of-use page. We suggest that anyone who can read the terms look for the sections on data retention, logging and model training.
Requests are tied to an identity
Whether or not records are kept, every request to EVREN belongs to the account of an identity-verified person: login goes through e-Devlet, the key is created in that account and the request is sent with that key. There is no anonymous API use.
That alone is not a privacy problem; many commercial services tie accounts to people too. The difference is that the tie is to a verified identity rather than an email address. If the content of a prompt is recorded, that record can be matched to an identity.
There is a content-policy layer on generative endpoints
The /v1/embeddings description in the OpenAPI schema says this endpoint has no guard or content_policy layer, and that the reason is that it is not generative. The same sentence implies that such a layer runs on generative endpoints such as chat.
Content moderation is ordinary practice in itself. What is missing is a public description of how this layer processes the request and where its results are kept.
A status record per request
The /v1/requests/{request_id} endpoint returns execution and charging state for each request: whether it completed, whether the charge is final, and the credit collected and outstanding. The schema states specifically that a completed response body is never returned from this endpoint.
This shows that a per-request record is kept. It says nothing about whether the body is stored anywhere else.
What is publicly known
The table below separates what we could verify about EVREN's data side from public sources from what we could not. If you turn on the evren_tools field, your request can also become input to server-executed live-data tools; it is off by default.
| Topic | Status | Basis |
|---|---|---|
| Terms of use text | Cannot be read without a key; the request returns 401 | OpenAPI schema and a keyless attempt |
| Identity | Login with e-Devlet; key in a personal account | University announcements |
| Content policy | A guard/content_policy layer implied on generative endpoints | OpenAPI schema, /v1/embeddings description |
| Request record | Execution and charging state kept per request | OpenAPI schema, /v1/requests/{request_id} |
| Server-side tools | Enabled with evren_tools, off by default | OpenAPI schema |
| Retention period | No public information found | - |
| Use in model training | No public information found | - |
What does LLMTR keep?
Let us ask ourselves the same question. LLMTR does not keep request or response content in its own database; the usage record holds the model, token counts, message count, cost and time. API keys are stored only as a SHA-256 digest.
However, the third-party model provider that processes the request may keep records. We state this plainly in the data note on every model card. Writing that sentence looks worse than leaving it out; but it is the accurate one. You should see where a model is processed, and what its provider may record, before you choose it.
Before sending sensitive data
This checklist is not specific to EVREN; it applies to any third-party LLM service.
- Read the data retention, logging and model training clauses in the terms of use.
- Mask or pseudonymise personal data before sending it.
- For data covered by Turkey's data protection law (KVKK), get the view of your organisation's legal team.
- For production use, ask the provider for a written commitment on retention and training.
- Start trials with test data, not real customer data.
Frequently asked questions
Does EVREN record my prompts?
We found no public text stating or denying it. The terms of use cannot be read without an API key. The safe assumption is that the provider may keep records.
Where can I read EVREN's terms of use?
From the /v1/terms/text endpoint, after opening an account with e-Devlet and creating an API key. We found no public terms-of-use page.
What does content policy mean on EVREN?
The OpenAPI schema says the embeddings endpoint has no guard or content_policy layer because it is not generative. That implies such a layer runs on generative endpoints. How the layer works is not publicly described.
Can I send personal data to EVREN?
We do not recommend it before reading the terms of use and getting the view of your organisation's legal team. The same advice applies to any third-party LLM service.
Does LLMTR record my prompts?
LLMTR does not keep request or response content in its own database. The third-party model provider that processes the request may keep records; the data note on every model card says so.