Privacy and KVKK (Turkish data protection law)

This text is a draft. It should be reviewed by a lawyer before publication.

Data controller

This site is operated by Strateji Danışmanlık Hizmetleri San. ve Tic. A.Ş., which is the data controller for your personal data. Address: Zafer Mah. Kumrulu Sok. No. 2/18 Bahçelievler/İstanbul.

What we record while you browse

You do not need an account to browse. When you press “Visit site” we record which app was visited, the page language, where on the page the link was, whether the device was a phone or a computer and, if our infrastructure reports it, the country.

We do not store your IP address. To avoid counting the same click twice we derive a one-way digest from it that changes every day, and keep only that.

The address you are sent to carries tags showing that the visit came from Vitrinist and a random number unique to that click. If the maker reports a sale, we use the number to link the sale to the click. It does not contain your identity.

We record the words typed into the search box so we can see what people look for and what they cannot find. The record holds nothing about who you are.

Cookies

We use two cookies: a language cookie that remembers which language you opened the site in (set on the first visit, kept for one year) and a session cookie for makers who sign in. The fact that you closed the information note and the theme you chose (light or dark) are stored only in your own browser. We use no advertising cookies, tracking cookies or third-party analytics.

Maker accounts

For makers who add an app we keep their name, email, phone number if given, website address and a one-way hash of their password. When someone signs in, the browser type is stored with the session. The email typed in a failed sign-in attempt is recorded for security.

From reported sales we keep only the order number, amount, currency, date and the click number if there is one. Do not include your customers' personal data in a sale report; fields we do not recognise are not stored.

How long we keep it

Search records are deleted after 180 days, click records not linked to a sale after 400 days, and sale-report request logs and failed sign-in records after 90 days. Account and sales records are kept while the account is open and for as long as the law requires.

Sharing

This data is held on servers managed by the operator. It is not sold and not shared with anyone for advertising or marketing. If the law requires it, it is disclosed only to the competent authorities.

Your rights

To exercise your rights under Article 11 of Turkish Law No. 6698 (KVKK) and, where it applies, the GDPR (access, correction or deletion of your data), write to the address below. We reply within thirty days at the latest.