KVKK Privacy Notice (Türkiye)
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
1. Data controller
Under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Obligation to Inform, your personal data in connection with Sivis is processed by the following data controller.
| Data controller | Hasan Akgül (an individual developing software products under the Pingel brand; “Pingel”) |
|---|---|
| Location | Istanbul, Türkiye |
| hasan@pingel.dev | |
| Web | pingel.dev |
2. Data, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data E-mail (authentication only, never shown on your profile), name and photo with Google sign-in, password (hashed by Firebase) | Creating your account, signing you in, providing the service and service notices | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Public profile Nickname, avatar, optional country, birth year/date and gender | Showing your profile and linking your posts to you | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Posts and interactions Sivs, inspiration comments, likes, saves, view counts; the account link is kept for anonymous posts too | Running the platform; anonymity applies towards other users, the account link is kept to handle abuse | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)) | Until you delete them or close your account |
| Moderation inputs Post text (before publication) | Filtering rule-breaking content before publication (Cloudflare Workers AI) | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)) | At the time of the request; not stored by the provider |
| Notifications and reports Push token, report reason and reported content | Sending notifications (if allowed), reviewing reports | Your explicit consent (KVKK Art. 5(1)); you may withdraw it at any time; Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)) | Until you revoke permission; reports 1 year |
| Agreement and consent records Documents you accepted, their versions, date and time | Proving that the agreement was concluded and you were informed | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 10 years after account closure (limitation period) |
| Contact and support Name, e-mail, message content | Answering your questions and requests | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 2 years after the conversation ends |
| Technical and security logs IP address, browser/device info, request time, error logs | Running the service, keeping it secure, preventing abuse and attacks, obligations under Law No. 5651 | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Expressly provided for by law (KVKK Art. 5(2)(a)) | Hosting provider logs 30 days; records under Law 5651 for the statutory period (1–2 years) |
| Usage statistics Pages visited, session duration, approximate location (country/city), device type, cookie ID | Anonymised statistics to improve the site (Google Analytics) — only if you consent | Your explicit consent (KVKK Art. 5(1)); you may withdraw it at any time | 14 months in Google Analytics |
| Advertising data Cookie ID, ad interactions, approximate location | Showing ads; personalising them by interest if you consent (Google AdSense) | Your explicit consent (KVKK Art. 5(1)); you may withdraw it at any time | According to Google's policy, up to 13 months |
3. Method of collection
We collect personal data electronically, partly by automated means, through the forms you fill in, the actions you take in your account, the e-mails you send us and the technical information your browser or device sends automatically (including cookies and similar technologies).
4. Recipients and purposes of transfer
Your personal data is transferred, limited to the purposes above and in line with KVKK Arts. 8 and 9, to the following suppliers that provide the technical infrastructure (some located abroad):
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Cloudflare, Inc. | Hosting, content delivery, DNS, attack protection | Global network (US-based) |
| Firebase Cloud Messaging (Google) | Push notifications (if you allow them) | EU and/or US |
| Google reCAPTCHA / Firebase App Check | Bot and abuse protection | United States |
| Google Analytics 4 (Google Ireland Ltd., Google LLC) | Visit statistics — only with your consent | EU and/or US |
| Google AdSense (Google Ireland Ltd., Google LLC) | Showing ads — personalised only with your consent | EU and/or US |
Transfers abroad rely on appropriate safeguards under KVKK Art. 9 (standard contracts, providers' data protection commitments) and, for occasional transfers without them, the exceptions in Art. 9(6). Data may also be disclosed to authorised public bodies and courts on request and as required by law. Your data is never sold.
5. Your rights under KVKK Art. 11
- to learn whether your personal data is processed;
- to request information if it is processed;
- to learn the purpose and whether it is used accordingly;
- to know the third parties in Türkiye or abroad to whom it is transferred;
- to request correction if incomplete or inaccurate;
- to request deletion or destruction under Art. 7;
- to request that corrections and deletions be notified to recipients;
- to object to an adverse outcome resulting solely from automated analysis;
- to claim compensation for damage caused by unlawful processing.
6. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request with your name, (for written requests) signature, address or e-mail for notification and the subject of your request from the e-mail address registered with us to hasan@pingel.dev, with a secure electronic or mobile signature, or in writing. We conclude requests free of charge within 30 days; if the action involves an additional cost, the fee set by the Board may apply. If your request is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.