Privacy Policy

1. Data Controller

The data controller under KVKK is Furkan Özay (Istanbul, Türkiye). Legal identification details are in Terms of Use section 1.1.

Contact: [email protected]. How to exercise your rights is described in section 14.

2. Scope and Collection Method

This policy covers czay.dev and links.czay.dev. The site does not require an account and does not take payments. Your personal data is collected electronically through automatic means (your browser and server logs, cookies) and what you submit (contact form, feedback form, blog comments).

For cookies and similar technologies see the Cookie Policy. The student panel (student.czay.dev) requires an account, processes different categories of data and has its own privacy notice; this policy does not cover that data.

3. Contact Form and Resource Request Data

Contact form

• Data processed: name, email address, message content and the topic you choose.
• Purpose: replying to your request and continuing the correspondence. No newsletter or marketing list is kept through the contact form and no bulk email is sent.
• Legal basis: KVKK Art. 5/2-(f) legitimate interest (answering an incoming request); Art. 5/2-(c) where the request concerns entering into a contract.
• Retention: correspondence is kept for 2 years after the request is concluded and then deleted. If you ask for earlier deletion and no legal retention duty applies, it is deleted.
• Source: if you reach the contact form through a link carrying campaign parameters (utm_source, utm_medium, utm_campaign), those values are written into the email together with the address of the first page you landed on and your message, and are used only to understand where the request came from. This source information is kept in your browser for the session, and for 30 days if you gave analytics or marketing consent.
• Advertising measurement: if you consented to marketing cookies, submitting the form passes a "Lead" event to Meta Platforms: the page address, browser identifiers (_fbp/_fbc), IP address, browser information and SHA-256 hashes of your name and email address. The content of your message is not passed.

"Email me the resources" form on the Goodies page

• Data processed: your email address and the resources you select.
• Purpose: sending you the links to the resources you selected by email. Your address is used only for that delivery and is not stored unless you opt in; the delivery record is kept by the email provider (Resend) for the provider's own retention period.
• Legal basis: KVKK Art. 5/2-(f) legitimate interest (delivering the resources you asked for).
• New-resource notifications (optional): if you tick the separate checkbox, which is unticked by default, your address is kept in a notification list at Resend so you can be told when new resources are added. Legal basis: KVKK Art. 5/1 explicit consent. Retention: until you withdraw consent. You can withdraw at any time through the unsubscribe link in the emails sent, or by writing to [email protected]; withdrawal does not affect the lawfulness of earlier processing.

Scheduling (Cal.com)

• Data processed: the name, email address, optional note and time slot you enter in the "Book an intro call" window. When the window opens, your browser connects to Cal.com's servers; your IP address and browser information are visible to them.
• Purpose: scheduling a call with you and sending the calendar invitation. Cal.com's script is loaded only when you click this button, not when the page opens.
• Legal basis: KVKK Art. 5/2-(f) legitimate interest (scheduling the call you asked for).
• Retention: the booking record is kept for the same period as contact form correspondence (2 years from the call); you can ask for earlier deletion by writing to [email protected].

4. Feedback and Testimonial Data

• Data processed: the name, organization/program, period, rating and comment you submit in the feedback form.
• Purpose: reviewing the comment and, once approved, publishing it on the site as a testimonial. The submission is opened as an issue in a private GitHub repository for review.
• Legal basis: KVKK Art. 5/1 explicit consent. The form states that your comment may be published.
• Retention: published comments stay until you withdraw consent; unpublished submissions are deleted after review. Student comments show the first name only; no surname or photo is kept.
• Withdrawing consent: you can ask for your comment to be removed at any time by writing to [email protected]. Withdrawal does not affect the lawfulness of earlier processing.

5. Blog Likes

The heart button under blog posts only keeps a counter. When you like a post, your identity, IP address or cookies are not stored with it; the server keeps a single total per post. Whether you liked it is remembered only in your browser (localStorage). To prevent abuse, your IP address is used in a short-lived rate-limit counter during the request (Upstash, hourly window). The comment feature has been removed.

• Legal basis: KVKK Art. 5/2-(f) legitimate interest (counter accuracy and site security); no personal data is stored with the like.
• Retention: the counter stays as long as the post is published; rate-limit records are deleted within an hour at most. Earlier comments are no longer shown on the site; they may remain in GitHub Discussions, where GitHub is a separate controller of that data.

6. Analytics and Cookies

• Data processed: page views, referrer, browser and device information, approximate location (country/city level) and cookie identifiers.
• Purpose: traffic analysis, performance measurement and measuring whether visits from social media lead to a contact request or booking (Meta Pixel). No advertising is shown. Non-essential cookies run only with your consent; you can choose by category in the consent banner and change it later.
• Legal basis: KVKK Art. 5/2-(f) for essential cookies; Art. 5/1 explicit consent for analytics and marketing cookies.
• Retention: varies by cookie type; see the table in the Cookie Policy.

7. Hosting and Security Logs

When you view the site, technical data such as your IP address, request time, requested page and browser/device information is recorded in the hosting provider's server logs so the service can be delivered. When you submit a form, your IP address is also used for verification and rate limiting to block unwanted and automated submissions. Rate-limit counters, together with your IP address and (on the resource form) a hash of your email address, are kept at Upstash for at most one hour.

When an error occurs on the site, technical data such as the error message, page address and browser/device information is sent to the error and log monitoring provider Better Stack so the error can be fixed; the provider can see the IP address that comes with the request. These records are not used for advertising or profiling.

• Legal basis: KVKK Art. 5/2-(f) legitimate interest (secure, uninterrupted service and preventing abuse) and Art. 5/2-(ç) legal obligation (record-keeping duties under Law No. 5651).
• Retention: server logs are kept for the periods in the hosting provider's own policy; the controller does not archive them separately.

8. Payments and Invoicing

No payments are taken through the site. There is no cart, online order or card payment flow; no card data is collected or stored.

Fees for corporate training and software services are collected offline by bank transfer under the contract with the organization. Invoicing is carried out off the site and under tax law; the name/company and invoice details processed for this purpose are kept in accounting records, not on the site infrastructure.

• Legal basis: KVKK Art. 5/2-(a) expressly provided by law and Art. 5/2-(ç) legal obligation (Tax Procedure Law, Turkish Commercial Code).
• Retention: 10 years (books and records).

9. Parties Your Data Is Shared With

Your personal data is not sold or rented. It is shared only as far as needed to deliver the service, with the following providers:

These providers are subject to their own privacy policies. Information may also be given to competent authorities where a legal obligation requires it (KVKK Art. 8).

10. Transfers Abroad

The servers of the providers above are located abroad (USA and EU). Transfers are made under the mechanisms in KVKK Art. 9 (as amended by Law No. 7499): an adequacy decision, or appropriate safeguards such as standard contractual clauses, and the data processing agreements the providers offer. Explicit consent is used as a basis only for incidental transfers (one-off and not recurring).

Invoice and accounting records are not kept on the site infrastructure and are therefore not transferred abroad.

11. Retention and Destruction

Personal data is kept for the time required by the purpose it was processed for and by the relevant legislation; once that period ends or the reason for processing disappears, it is deleted, destroyed or anonymized. The periods are given in the sections above. Retention periods are reviewed at least once a year.

12. Data Security

Reasonable technical and organizational measures are taken under KVKK Art. 12: connections are encrypted with HTTPS, form submissions are protected with verification and rate limiting, no card data is ever collected, access to the admin panel requires authentication, and data is shared only with those who need it. In the event of a data breach, the data subjects and the Personal Data Protection Board are notified as soon as possible (within 72 hours) under KVKK Art. 12/5.

13. Your Rights (KVKK Art. 11)

By applying to the data controller you may:

• Learn whether your personal data is processed
• Request information if it has been processed
• Learn the purpose of processing and whether it is used accordingly
• Know the third parties it is transferred to, in Türkiye or abroad
• Request correction if it is incomplete or inaccurate
• Request deletion or destruction within the conditions of KVKK Art. 7
• Request that corrections, deletions and destructions be notified to third parties the data was transferred to
• Object to a result against you arising from analysis exclusively by automated systems
• Claim compensation if you suffer damage from unlawful processing

14. How to Apply

You may submit your application in writing, or by registered electronic mail (KEP), secure electronic signature, mobile signature or the email address you previously gave me, in line with the Communiqué on Procedures and Principles of Applications to the Data Controller, to [email protected]. The application must include your name, surname, your request and enough information to verify your identity.

Applications are concluded free of charge within 30 days at the latest, depending on the nature of the request; if the process requires a separate cost, the tariff set by the Board may be charged (KVKK Art. 13). If you find the answer insufficient, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date.

15. Children's Privacy

The site is not directed at children under 13 and personal data is not knowingly collected from this age group. Visitors aged 13-18 should use the forms only with the approval of a legal guardian. If you notice that a child's data has been collected, write to [email protected] and it will be deleted.

16. Policy Changes

When this policy is updated, the version and last-updated date at the top of the document are renewed. Material changes are announced on the site at least 14 days before they take effect. The current text is always published on this page.