Purpose: English version of the KVKK Aydınlatma Metni, provided for App Store submission and non-Turkish-speaking users.
Status: DRAFT — lawyer review required before publish (COMPLIANCE-001 §8). The Turkish text is authoritative for Turkish residents (KVKK m.10); this English text is provided for information and does not replace it.
Controller: Muhammed Emin Boydak, operated as a sole proprietorship (no separate legal personality). The controller role transfers to the company only at the LTD conversion (ADR-0015). Contact: [email protected]
Scope: stancona.org, app.stancona.org, keep.stancona.org, shop.stancona.org, newsletter (news.stancona.org), and the Gate mobile app.
Last updated: 2026-10-07
1. What personal data do we collect, and why?
| # | Data | Where collected | Purpose | Legal basis |
|---|---|---|---|---|
| 1.1 | Email address | Sign-up / sign-in (one-time code verification) | Account creation and identity verification | Performance of a contract (KVKK m.5/2-c) |
| 1.2 | User preferences (theme, language) | In-app settings, first-party storage | Keeping your session/experience consistent | Necessary for the service — no consent required (m.5/2) |
| 1.3 | Newsletter sign-up (email + timestamp) | Waitlist / newsletter (double opt-in) | Marketing communications | Consent (m.5/1) + opt-in requirements under Turkish law |
| 1.4 | Order and invoice data (name, email, order records) | shop (via payment institution) | Order fulfilment, e-archive invoicing, tax obligations | Contract (m.5/2-c) + legal obligation (m.5/2-ç) |
| 1.5 | Payment card data | Never stored by us — processed by iyzico/Polar (payment institutions) | Payment collection | We do not store card data as controller |
| 1.6 | Anonymous usage statistics | Self-hosted Umami (cookie-free, truncated IPs) | Traffic/measurement, product improvement | Statistical measurement — not personal data (see §5) |
What we do not collect: date of birth (until the 13+ gate lands — see compliance register §1), location, phone number (except scenarios requiring event confirmation, which is separately gated), and special categories of personal data (KVKK m.6) under any circumstances.
2. How long do we keep it?
| Data class | Retention | Then |
|---|---|---|
| Account + email identity | While the account is open | Irreversible deletion within 30 days of a deletion request (m.7/1-f, m.13) |
| Sign-in code (OTP) records | Max 24 hours after verification | Automatic purge |
| Newsletter consent proof | As long as required to prove consent, even after withdrawal (burden of proof) | Deletion when purpose ends |
| Newsletter subscription (active) | Until unsubscribed | Account deletion → 30 days |
| Invoice/order records | Statutory tax retention (VAT records 5 years, e-archive rules) | Deleted/anonymised after the legal period |
| Umami statistics | Raw 12 months (ADR-0047), aggregates indefinitely | Raw data automatically dropped |
3. Who do we share it with?
Only with service providers inside/outside Turkey, limited to the service purpose and our contract: Cloudflare (DNS/CDN/WAF — log processing), Netcup (hosting, Germany), AWS SES / Resend (email delivery to subscribed recipients), iyzico / Polar.sh (payments — card data lives with the payment institutions), accountant (statutory financial obligations). Data is never sold or shared with third parties for marketing purposes.
4. Cookies
We use only first-party, necessary/preference storage (session, theme, language). No advertising or third-party cookies are used; therefore no consent banner is required. If that changes (e.g. an advertising tool for EU traffic), a consent mechanism will be added.
5. Analytics (Umami)
We measure anonymous traffic and in-app events with Umami, hosted on our own infrastructure (umami.stancona.org). It uses no cookies and stores truncated IP addresses. This measurement does not build individual profiles, and the data does not leave for third parties. This policy covers that measurement.
6. Your rights (KVKK m.11)
Upon request you may: learn whether your data is processed; request information if it is; learn the purpose of processing and whether it is used accordingly; know the third parties it was transferred to; request correction of incomplete or incorrect data; request deletion or destruction under the conditions of m.7; request that corrections/deletions be communicated to third parties to whom the data was transferred; and object to results produced against you by automated systems.
How to apply: email [email protected] with the subject line "KVKK Request" from your registered address. Response time: at most 30 days (m.13), free of charge (or the KVKK Authority tariff if the request disproportionately burdens us).
Deletion procedure: (1) identity verification, (2) irreversible deletion of account + identity + preference rows, (3) newsletter unsubscribe, (4) invoice records under statutory retention are kept and segregated, with the retained categories explained to you, (5) written outcome sent to you. Umami data is anonymous and therefore outside the scope of such requests.
7. Effective date and changes
This policy takes effect on its publication date; changes are announced with a version note on this page. You may also complain to the KVKK Authority (personaldata.gov.tr / kvkk.gov.tr).
8. Contact
- Privacy requests: [email protected]
- Data controller: Muhammed Emin Boydak (sole proprietorship); transfers to the company at the LTD conversion (ADR-0015).
This English text is a courtesy translation of the authoritative Turkish KVKK Aydınlatma Metni. For Turkish users, the Turkish text governs.