Privacy Policy

1. In short

• There are no user accounts. You can browse the whole site without giving us any information.
• We use no advertising, tracking or analytics tools. Everything, including fonts, is served from our own server, and our pages send no requests to third-party servers.
• We only process personal data when you write to us, only to reply, and delete it automatically after months.

2. Controller

The controller responsible for processing your personal data is the sole proprietorship below, based in Turkey:

Email:

3. When you visit our site

When you open our pages, your browser sends your IP address, browser details and the requested page to our server, as with any website. This information may be kept briefly in server logs to operate and secure the site. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We do not track individual visits or build profiles.

Our security system records the IP address and a summary of a request only when it blocks that request as a suspected attack or abuse. These records are deleted after 90 days.

Your language and theme preferences are stored in your browser. See our Cookie Policy for details.

4. When you write to us

When you send the project brief, cost estimator or contact form, we receive your name, email address, optional phone number and company name, the services you are interested in, budget and timeline ranges, your message and, if you used the estimator, the features you selected.

To prevent spam, we store an irreversible hash of your IP address (not the address itself) and your browser's user agent with your request. If many requests arrive from the same source in a short time, we temporarily stop accepting them.

We use this information only to assess your request, reply to you and prepare a quote, and we send you an automatic confirmation email. The legal basis is steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for spam protection, our legitimate interest (Art. 6(1)(f) GDPR). Name, email address and message are required so that we can reply; without them we cannot process your request.

We do not add you to any mailing list, sell your data or use it for profiling or automated decision-making.

5. Recipients and international transfers

Your data is processed by the following service providers, only as far as needed to provide their service and on our instructions:

• the hosting provider whose servers run our website and database,
• the email provider through which notification and confirmation emails are sent.

We may also disclose data to public authorities where required by law.

International transfers: we are based in Turkey, so if you write to us from the European Union, your data is transferred to Turkey. There is no EU adequacy decision for Turkey. The transfer is necessary for steps you requested prior to a contract (Art. 49(1)(b) GDPR). If our hosting provider is located in another country, transfers follow the applicable safeguards of the GDPR and the Turkish Personal Data Protection Law (KVKK).

6. How long we keep your data

• Project requests and contact forms: kept for months, then deleted automatically and permanently. Related notification emails and correspondence are deleted after the same period.
• Security logs: kept for 90 days, then deleted.
• If a contract follows: contract and invoicing records are kept for the periods required by Turkish commercial and tax law.

If you would like your data deleted sooner, just write to us. We will do so promptly unless the law requires us to keep it.

7. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it rectified (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work (Art. 77).

Under the Turkish Personal Data Protection Law (KVKK, Art. 11) you have equivalent rights and may complain to the Turkish Personal Data Protection Authority.

To exercise your rights, email us from the address you used in your request. We reply free of charge, within one month at the latest.

8. External services and links

Our pages contain only links to external services. Nothing is sent to these services until you click:

• The WhatsApp button opens WhatsApp (Meta). Conversations there are subject to WhatsApp's privacy terms.
• Share links (LinkedIn, X) and our social media profiles open the respective platform.

9. How we protect your data

The site is served over HTTPS only and with a strict Content Security Policy. Requests can be accessed only by the site administrator. The admin panel is not accessible to visitors and is protected by a separate security layer. Forms are protected by rate limiting and automatic spam filtering.

10. Changes to this policy

We will update this policy if our website or our data processing changes. The current version is always on this page, and the date of the last update is shown at the top.