Legal sign-off for the GDPR, KVKK and EU AI Act wording changed in pull request 1050 #1057

Summary

Pull request #1050 rewrote GDPR, KVKK and EU AI Act statements across the documentation, the CLI help and the site. The wording was checked against the code and against the official texts by the author and by independent reviewers, but nobody qualified to give legal advice has signed it off. This issue tracks that sign-off so the statements do not stay "reviewed by engineers" indefinitely.

Statements to confirm or correct

1. Article 17(3)(b) and (e) (guides, reference, manual, design note, forgelm purge --help, RetentionConfig): erasure is disapplied only to the extent a specific Union or Member State obligation (or a public-interest task) requires the processing, or to the extent needed for legal claims; keeping audit entries that name a data subject needs a documented basis; ForgeLM never edits or deletes an entry.
2. Pseudonymisation (Art. 4(5), recital 26): a salted SHA-256 of an identifier is a pseudonym, not anonymous, because the salt file sits next to the log; digests should be treated as personal data.
3. A complete Article 15 / 17 response (manual, guide): identity verification (Art. 12(6)), one month with a two-month extension and notice in the first month (Art. 12(3)), copy of the data and the 15(1)(a)-(h) information (Art. 15(3)), third-party data (Art. 15(4)), recipients (Art. 19, with the disproportionate-effort exception) and Art. 17(2) only where the controller made the data public, reasons and complaint right on refusal (Art. 12(4)). The statement that a zero-match scan does not answer an access request.
4. KVKK mapping (docs/usermanuals/{en,tr}/compliance/gdpr.md): erasure or destruction request under Art. 11(1)(e) and the Art. 7 conditions, thirty days (Art. 13(2)), security duties in Art. 12, no separate accountability principle.
5. EDPB Opinion 28/2024: a model trained on personal data is not always anonymous, so anonymity has to be assessed case by case.
6. EU AI Act: Art. 18 documentation retention is a separate duty from keeping personal data (QMS data-management and model-training SOPs); Art. 14(5) requires two natural persons to verify an identification only for Annex III point 1(a) systems (human-oversight page); application dates (Regulation (EU) 2026/1744).
7. Art. 87 (national identification numbers: Member States set the specific conditions) and Art. 32 as the basis for the PII tier table; Art. 25(2) as the basis for the include_eval_samples defaults.
8. Retention defaults (1825 / 7 / 90 / 90 days) described as ForgeLM choices and not legal periods; Art. 5(1)(e) sets no fixed period.

Acceptance criteria

• A qualified reviewer has confirmed or corrected each numbered statement; corrections are applied to the English and Turkish documents, the CLI help and the site strings together.
• The outcome (reviewer, date, changes) is recorded in the pull request that applies it.
• If a statement cannot be confirmed, it is softened or removed rather than left.

Context

Related: #362, #496, #498 (regulation items from the October review), the native-review issue for the site strings.