The less of your data
we hold, the better.

Data we process

Simply browsing the site asks nothing of you and writes no record about you into our own database. Processing begins when you fill in and submit the contact form yourself.

One exception we will not hide: like every website, this one is served through an infrastructure provider that keeps technical logs in order to run the service and fend off attacks. Your IP address may appear in them; those logs sit in the provider's system rather than our database, and their retention periods are set by the provider. We do not use them for visitor measurement, profiling or marketing.

The record created by the contact form consists of:

• Your name, email address and phone number (optional — you may leave it blank)
• The area of interest you selected and the text of your message, including anything you write inside it
• The time of submission
• A salted SHA-256 digest of your IP address — the raw IP address is never stored; the digest only serves to limit repeated submissions
• The outcome of the bot check: nothing more than "verified / not verified"

What we do not do

This section is the result of a deliberate choice, not an omission: no tracking tool has been added to this site.

• No visitor analytics — nothing is installed that measures page views, sessions or behaviour.
• No advertising, retargeting or social media pixels.
• No profiling and no automated decision-making; your data is not turned into a marketing segment.
• No browser fingerprinting for marketing. Our infrastructure provider's bot-detection script reads browser characteristics in order to tell human traffic from automated traffic; that data serves security, is not passed on to us and is not used for marketing.
• No sale or rental of personal data and no sharing with ad networks.
• Card details, national identity numbers and health data are never requested; the payment layer is off.

Purposes and legal grounds

Every item of data is processed for one of the purposes below, on the legal ground shown next to it. It is used for nothing else.

Answering your enquiry and conducting the quotation and project discussion

KVKK Art. 5(2)(c) — directly related to the conclusion or performance of a contract

Keeping track of the conversation history so a thread is not lost

KVKK Art. 5(2)(f) — legitimate interest

Protecting the form against bots and spam: IP digest, bot check, rate limit

KVKK Art. 5(2)(f) — legitimate interest

Statutory retention duties and proof in a potential dispute

KVKK Art. 5(2)(ç) and 5(2)(e) — legal obligation; establishment and exercise of a right

Transfers and processing abroad

The site and its database run entirely on Cloudflare infrastructure: the application on Cloudflare Workers, the records in a Cloudflare D1 database, the images in Cloudflare R2. This means your data is processed on servers outside Türkiye; the transfer falls under Article 9 of the KVKK, and the infrastructure provider acts as a data processor.

The notification email generated by the contact form is delivered to the company's mailbox through Cloudflare Email Routing. That mailbox is hosted on Google LLC's Gmail service; your name, email address, phone number and the full text of your message arrive there with that notification and are stored there. When you ask for your data to be erased, this copy is deleted too.

When you submit the form, a bot check is performed and your IP address is passed to the Cloudflare Turnstile service for that check. At this step the IP address is used only for verification; we do not store it in raw form.

Beyond this, no transfer is made to any third party. Requests from public authorities are met only on a duly issued, lawful, written decision; where such a request arrives, we prefer to inform the person concerned unless we are legally barred from doing so.

Use of artificial intelligence

The admin panel includes an AI assist that produces a draft reply to an incoming message. Drafting runs on Cloudflare Workers AI; during that step the text of your message is passed to the model as input.

The limits are fixed in the code: the generated text is never stored automatically and is never sent to you automatically. Every reply you receive has been read, edited and sent by a person. The feature can be switched off entirely with a flag.

AI is not used to infer anything about your personality, to score you, or to make an automated decision about you.

Retention and deletion

We keep your records until your enquiry is concluded and until the statutory retention and limitation periods relating to our commercial relationship have run. Data that no longer serves its purpose is deleted.

To be transparent: scheduled automatic deletion is not in place yet, deletion is performed manually. For that reason a deletion request is carried out on the strength of your application — without waiting for any scheduled job — within 30 days at the latest.

If a statutory retention duty prevents deletion, we tell you in writing which record must be kept and for how long.

Your rights and how to exercise them

Under Article 11 of the KVKK you may apply to the data controller and request:

• To learn whether your personal data is processed and, if so, to receive information about it
• To learn the purpose of processing and whether the data is used accordingly
• To know the third parties, in Türkiye or abroad, to whom the data has been transferred
• To have incomplete or inaccurate data corrected
• To have the data erased or destroyed within the conditions set by law
• To have correction, erasure and destruction notified to the third parties the data was transferred to
• To object to a result against you arising from analysis solely by automated systems
• To claim compensation for damage suffered through unlawful processing

Security measures we take

The principal technical and organisational measures in place are:

• All traffic is carried over HTTPS; HSTS causes plaintext connections to be refused.
• The admin panel is protected by Cloudflare Access; entry is locked to a single authorised account and sessions expire.
• The contact form has a bot check, a hidden trap field and a rate limit keyed to the IP digest (at most 3 submissions per 10 minutes).
• The raw IP address is stored nowhere; only a digest salted with a secret key is kept.
• A Content Security Policy, framing protection and resource-isolation headers are active; violations are reported to our own collector.
• Because no payment is taken on the site, no card data is collected at all — the best-protected data is the data never collected.

Residual risk

We do not say that any system is "completely secure"; that claim would not be true. The measures above lower the risk, they do not remove it.

The residual risks we know of and accept: a vulnerability not yet known in the infrastructure or libraries we use; the compromise of an authorised account; and the fact that email, by its nature, passes through third parties on its way to your mailbox. For that reason, please do not send highly sensitive material — identity documents, card details, passwords — by form or email.

If we determine that personal data has been unlawfully obtained, we notify the people concerned and the Personal Data Protection Board as soon as possible, under Article 12(5) of the KVKK.

Children

This site is not directed at people under 18 and does not knowingly collect children's personal data. If we notice that data belonging to a child has been submitted, we delete the record; you may also report such a case to us.

Updates to this text

This text is updated whenever the way the site processes data changes, and the date above is changed with it. Should a new processing purpose or a tracking tool be introduced, the change is not applied retroactively to existing records, and your explicit consent is requested in advance where required.