Privacy and personal data protection

1. Data controller

This notice covers the imece website and application under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).

Data controller: Batuhan Özoğuz (imece). Contact: hello@imece.io

2. Personal data we process

• Access request form: your name, email address, team or company name, team size, role, an optional note, the time you gave consent and the version of the text you consented to.
• Account and product use (teams admitted to the closed beta): your name, email address, role in the team, an optional profile photo, your GitHub account ID if you sign in with GitHub, and the content team members share through the app (handoffs, notes, decisions, messages and files).
• Technical data: when you visit the site, your IP address and browser details are processed in the access logs of our hosting and network providers. To prevent abuse of the forms, an irreversible hash of your IP address is kept for about two hours.
• Security logs: for actions taken with your account (such as sign-in attempts and changes to settings, invitations and membership), we record the type of action, its time and result, your IP address and your browser or app details. The content of the action, your password and your session tokens are not recorded. The access request form is not part of this log.

3. Purposes and legal bases

• Reviewing your access request and contacting you: your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
• Creating your account, signing you in and providing the product: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Keeping the service secure and preventing abuse: legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).

4. Service providers

We do not sell your personal data or use it for advertising. We work with these providers to run the service:

• Hetzner Online GmbH (Germany): server hosting. The database and team content are stored on servers in Germany; team content is also kept on team members' own devices.
• Cloudflare, Inc.: domain, security and content delivery. Requests to the site pass through Cloudflare's network.
• Resend, Inc.: delivery of sign-in code and invitation emails.

5. International transfers

The servers of the providers above are located outside Türkiye, so your personal data is transferred abroad. Your explicit consent on the access request form also covers this transfer.

6. Retention

• Access requests: until your request has been reviewed and the closed beta is over.
• Account and team content: for as long as the team account is open.
• IP address hash: about two hours.
• Security logs: 90 days.
• Data you ask us to delete is deleted on request, before these periods end.

7. Cookies and local storage

The site does not use advertising or analytics cookies. Your browser's local storage keeps only your theme and language preference and, on the account pages, your session. Cloudflare may set strictly necessary cookies for security.

8. Your rights

Under KVKK Art. 11 and the GDPR you can ask whether your data is processed, request information about it, ask for it to be corrected, erased or destroyed, learn which third parties it was transferred to, object to processing, receive your data in a portable format and seek compensation for damage. You can withdraw your consent at any time.

Send your requests to hello@imece.io; we reply within 30 days. You also have the right to complain to the Turkish Personal Data Protection Authority or, if you live in the EU, to your local data protection authority.

9. Changes

If this notice changes, the new version is published on this page. The access request form records which version you consented to.