Privacy Policy and Personal Data

By using the Services you acknowledge the practices described here. If you disagree, stop using the Services. Our separate KVKK disclosure notice should be read together with this Policy.

The website builder helps individuals and businesses create, edit, and publish sites with AI-assisted tools. Account, content, technical, and payment data may be processed in that flow.

Information you provide: name, email, hashed password, profile or company details; website-builder prompts, uploads, site content, publish/domain settings, feedback and revisions; support emails and attachments; billing name, tax details where needed, and contact address.

Data collected automatically: IP address, browser and device type, OS, language, screen info, session identifiers, feature-usage records, error and performance logs, referrer URL.

Data from third parties: basic profile and tokens from Google or Apple sign-in for account matching (your password is not sent to us that way); payment results, references, and subscription status from providers such as iyzico; minimum records required for domain/DNS or hosting integrations.

Main purposes: create and manage accounts; run the website builder and host/publish sites; process subscriptions and payments; authenticate sessions; prevent fraud, abuse, and security incidents; fix bugs and improve the product; provide support; meet retention and compliance duties.

For product analytics we prefer aggregated or de-identified data where feasible. Marketing or product announcements are sent only with consent or as otherwise allowed; you can update preferences via support.

Prompts and content you submit to AI features are processed to fulfil your request and generate outputs. You remain responsible for reviewing outputs before publishing; this Policy complements the Terms of Service.

Card payments run through authorized providers such as iyzico. We do not store card numbers, CVV, or similar sensitive payment credentials on our systems. Subscription status, invoices, and transaction references may be kept to manage access, handle refunds/disputes, and meet financial rules.

We may share data with service providers that supply hosting/infrastructure, authentication, payments, email/notifications, analytics, error tracking, and support — only as needed to run the Services and under contractual limits.

We may disclose data where required by law, court or authority order, to protect rights, in a security incident, or in a merger, acquisition, or restructuring, on a necessary and proportionate basis. If you use an organization or team account, admins may access certain account-linked information.

Sites you publish, links you share, or content you make public become visible to others by your choice; you are responsible for that visibility.

Transfers are made with safeguards appropriate under KVKK and related rules (for example contractual obligations, provider security standards, and access controls). Third-country providers also have their own privacy policies; we apply data minimisation where practicable.

Account and site data: while the account is active and until a deletion request is completed. After deletion, personal data is erased or anonymized; financial/invoice records and dispute evidence may be kept for periods required by law.

Security, access, and error logs: typically short-term (on the order of months for security and troubleshooting); longer if an incident requires investigation.

Payment and invoice records: retained under tax and accounting rules. See the account deletion page for deletion steps.

Essential cookies are required for the Service to work. Where analytics or optional tools are used, we provide notice or preference controls as required. You can clear or block cookies in your browser; some features may break.

Marketing tracking is used only with your opt-in or as otherwise permitted by law.

No method is 100% secure. Use a strong password, avoid leaving sessions open on shared devices, and report suspicious access promptly. Card data security also depends on the payment provider’s systems.

Email destek@atalay.ai or use the /en/account-deletion steps. We may ask for identity verification. Requests are handled within statutory timelines. Scope and exceptions are detailed in the KVKK notice.

If your country grants additional privacy rights (e.g. certain EU/EEA or other local regimes), you may raise them through the same channel; applicability depends on your jurisdiction.