KVKK Information Notice
Version: 2026-10-draft-1 · Status: Draft
This notice is meant to fulfil the information duty of the data controller under article 10 of the Personal Data Protection Law No. 6698 (KVKK). It follows the five elements of that article.
This notice informs you. Reading it is not a consent, and the service does not depend on any consent beyond what you tick separately.
1. Identity of the data controller
Data controller
The details below are configured by the operator. Nothing here is invented: an empty value means it has not been provided yet.
- Legal name
- [Not set — to be completed before publication]
- Trade name
- [Not set — to be completed before publication]
- Address
- [Not set — to be completed before publication]
- MERSIS no.
- [Not set — to be completed before publication]
- KEP (registered e-mail) address
- [Not set — to be completed before publication]
- Contact e-mail
- [Not set — to be completed before publication]
- VERBİS registration
- [Not set — to be completed before publication]
- Representative
- [Not set — to be completed before publication]
2. Purposes of processing
- Creating and operating your account
- Account and platform security, fraud and abuse prevention
- Meeting legal obligations
- Publishing and showing content
- Moderation and enforcing the Community Rules
- Answering support requests
- Processing payments
- Keeping evidence of choices and requests
Processing for optional marketing, analytics and advertising is separate from processing needed to run your account, and is based only on your explicit consent, which you can withdraw at any time without affecting the service.
3. To whom and why data may be transferred
- Hosting and infrastructure providers
- E-mail delivery provider
- SMS provider
- Payment provider
- Authorised public bodies, where the law requires
Third-party services
Status shows what is configured on this installation today. A service that is not configured processes nothing.
| Role | Data involved | Status | |
|---|---|---|---|
| Hosting / server provider | Runs the servers where data is stored. | All data stored by the platform. | Planned, not active |
| Cloudflare | DNS, CDN and traffic protection in front of the site. | IP address and request metadata. | Planned, not active |
| Cloudflare Turnstile | Bot check on sensitive forms. | Browser signals and IP address during the check. | Not configured |
| E-mail service provider | Delivers verification, reset and notice e-mails. | E-mail address and message content. | Not configured |
| SMS provider | Would deliver phone verification codes. No SMS provider is connected. | Phone number and code. | Not configured |
| Payment provider | Would process card payments for paid plans. Not active. | Order data; card data goes to the provider only. | Planned, not active |
| Analytics tool | None active. Would run only with your consent. | Usage data. | Planned, not active |
| Advertising technology | None active. Would run only with your consent. | Advertising identifiers and usage data. | Planned, not active |
4. Method of collection and legal basis
Each category below lists the data, the purposes, the legal basis (proposed, pending legal review), how the data is collected, who may receive it and how long it is kept.
Identity and contact data
Data you give when registering and verifying your account.
- Data
- Username
- E-mail address
- Phone number
- Purposes
- Creating and operating your account
- Account and platform security, fraud and abuse prevention
- Meeting legal obligations
- Legal basis (proposed)
- Necessary for establishing or performing a contract (KVKK art. 5/2-c)
- Legitimate interest of the controller, without harming your rights (art. 5/2-f)
- Collection method
- Forms you fill in on the website
- Recipients
- Hosting and infrastructure providers
- E-mail delivery provider
- SMS provider
- Retention
- [Not defined yet — to be set by the operator after legal review]
Account security data
Data that protects your account and detects misuse.
- Data
- Password (stored only as an irreversible hash)
- Sign-in sessions (stored as hashes)
- Hashed IP address
- Browser / device description
- Sign-in attempts and results
- Purposes
- Account and platform security, fraud and abuse prevention
- Creating and operating your account
- Legal basis (proposed)
- Legitimate interest of the controller, without harming your rights (art. 5/2-f)
- Necessary to fulfil a legal obligation (art. 5/2-ç)
- Collection method
- Automatically from your browser or device when you use the service
- Recipients
- Hosting and infrastructure providers
- Retention
- [Not defined yet — to be set by the operator after legal review]
Profile data
Optional details you add to your public profile.
- Data
- Biography
- Avatar
- Language and theme preferences
- Purposes
- Creating and operating your account
- Legal basis (proposed)
- Necessary for establishing or performing a contract (KVKK art. 5/2-c)
- Collection method
- Forms you fill in on the website
- Recipients
- Hosting and infrastructure providers
- Retention
- [Not defined yet — to be set by the operator after legal review]
Content and interaction dataNot active yet
What you publish and how you interact with others.
The platform feature behind this item is planned but not live. It is listed so the notice stays complete once the feature opens.
- Data
- Posts
- Comments
- Reactions
- Bookmarks
- Follow relationships
- Purposes
- Publishing and showing content
- Moderation and enforcing the Community Rules
- Legal basis (proposed)
- Necessary for establishing or performing a contract (KVKK art. 5/2-c)
- Legitimate interest of the controller, without harming your rights (art. 5/2-f)
- Collection method
- Forms you fill in on the website
- Recipients
- Hosting and infrastructure providers
- Retention
- [Not defined yet — to be set by the operator after legal review]
Anonymous-publishing technical data
Technical signals kept to prevent abuse of anonymous posting.
- Data
- Hashed IP address
- Hashed device signal
- Bot-check result
- Purposes
- Account and platform security, fraud and abuse prevention
- Moderation and enforcing the Community Rules
- Legal basis (proposed)
- Legitimate interest of the controller, without harming your rights (art. 5/2-f)
- Collection method
- Automatically from your browser or device when you use the service
- Recipients
- Hosting and infrastructure providers
- Retention
- [Not defined yet — to be set by the operator after legal review]
Communication dataNot active yet
Messages exchanged with support.
The platform feature behind this item is planned but not live. It is listed so the notice stays complete once the feature opens.
- Data
- Support messages
- E-mail correspondence
- Purposes
- Answering support requests
- Meeting legal obligations
- Legal basis (proposed)
- Necessary for establishing or performing a contract (KVKK art. 5/2-c)
- Establishment, exercise or protection of a right (art. 5/2-e)
- Collection method
- Forms you fill in on the website
- E-mail you send to us
- Recipients
- Hosting and infrastructure providers
- E-mail delivery provider
- Retention
- [Not defined yet — to be set by the operator after legal review]
Transaction dataNot active yet
Records of paid plans and purchases.
The platform feature behind this item is planned but not live. It is listed so the notice stays complete once the feature opens.
- Data
- Subscription records
- Payment references (no card numbers are stored)
- Purposes
- Processing payments
- Meeting legal obligations
- Legal basis (proposed)
- Necessary for establishing or performing a contract (KVKK art. 5/2-c)
- Necessary to fulfil a legal obligation (art. 5/2-ç)
- Collection method
- Forms you fill in on the website
- From the payment provider
- Recipients
- Payment provider
- Authorised public bodies, where the law requires
- Retention
- [Not defined yet — to be set by the operator after legal review]
Consent, request and audit records
Proof of your choices, your data requests and security-relevant actions.
- Data
- Consent records
- Data-request history
- Security and administration logs
- Purposes
- Keeping evidence of choices and requests
- Meeting legal obligations
- Legal basis (proposed)
- Necessary to fulfil a legal obligation (art. 5/2-ç)
- Establishment, exercise or protection of a right (art. 5/2-e)
- Legitimate interest of the controller, without harming your rights (art. 5/2-f)
- Collection method
- Automatically from your browser or device when you use the service
- Forms you fill in on the website
- Recipients
- Hosting and infrastructure providers
- Authorised public bodies, where the law requires
- Retention
- [Not defined yet — to be set by the operator after legal review]
5. Your rights (article 11)
Under article 11 of KVKK, as a data subject you may apply to the data controller to:
- Learn whether your personal data is processed
- Request information if it has been processed
- Learn the purpose of processing and whether it is used accordingly
- Know the third parties to whom data is transferred in Türkiye or abroad
- Request correction if data is incomplete or inaccurate
- Request erasure or destruction under the conditions of article 7
- Request that corrections and erasures be notified to third parties who received the data
- Object to a result against you produced solely by automated analysis
- Claim compensation for damage caused by unlawful processing
How to apply
You can submit requests about your personal data from your account on the Data Requests page. The operator may add further application channels below.
Operator-defined application channels: [Not set — to be completed before publication]
Requests are answered as soon as possible and within 30 days at the latest (configurable; to be confirmed by legal review).