Privacy policy

This policy summarises our data practices on the canturan.dev domain and its pages (the “Site”). The legal details of how your personal data is processed (purposes, legal grounds, recipients, retention periods and your rights) are set out in our KVKK data protection notice; the two documents should be read together.

1. In short

• The Site has no analytics, advertising, retargeting or social media tracking tools.
• Only technical cookies that are strictly necessary for the Site to work are used.
• Fonts are not loaded from an external service; they are served from our own infrastructure.
• Your card details never reach us; card payments are taken through iyzico.
• We do not sell or rent your data, nor share it with anyone for marketing purposes.

2. Who runs the Site?

The Site is operated by Alican Turan, a natural person trading under the name canturan.dev, who is the data controller for your data. Address: Mehmet Akif Ersoy Mah. 2135. Sokak No: 14/5, Esenyurt / İstanbul. Email: info@canturan.dev.

3. When you visit the Site

The Site is hosted on infrastructure provided by Vercel Inc. When you open a page, your browser sends certain technical information to the server, which is automatically logged in the hosting provider’s systems:

• IP address;
• the page requested, with date and time;
• browser type and version, and operating system;
• the referring page;
• error and performance logs.

We use these logs only to keep the Site secure, detect attacks and misuse, and fix technical errors; we do not use them to build visitor profiles or to identify you. Logs are kept for no longer than 6 months.

4. When you write to us

When you fill in the contact form, we receive your name, email address and message and, optionally, your phone number, company name and any information you share about your project (for example the type of service, budget range and timeline). The form content reaches us as an email via the Resend email infrastructure. We use this information only to respond to your request, schedule an intro call and prepare a quote. The form includes technical checks to prevent spam and misuse.

When you contact us by email, phone or WhatsApp, we likewise process only the information you choose to share. WhatsApp conversations are additionally subject to WhatsApp’s own privacy terms.

5. When you make a payment

On our payment page we collect your name, contact and billing details, and the payment amount and reference. Card payments are taken through the secure payment form of iyzico Ödeme Hizmetleri A.Ş., a payment institution licensed by the Central Bank of the Republic of Türkiye, with 3D Secure authentication.

Your card number, expiry date and security code are sent directly to iyzico; they never reach our servers and are neither seen nor stored by us. From iyzico we receive only outcome information such as the payment result, transaction number, amount and instalment details. iyzico is a separate data controller for the data it processes and is subject to its own privacy policy. A payment confirmation may be sent to your email address.

6. Cookies

The Site uses only strictly necessary technical cookies, which is why we do not show a cookie consent banner. You can find out what each cookie does in our cookie policy.

7. Who do we share information with?

We share your information only with the providers we need in order to deliver our services (hosting, email, payments, accounting) and, where required by law, with the competent authorities. Transfers to providers established abroad are carried out in accordance with Article 9 of the KVKK. The full list of recipients is set out in section 5 of the KVKK data protection notice.

8. Security

• All connections are encrypted with HTTPS (TLS).
• Card data is processed only within iyzico’s PCI DSS-compliant infrastructure.
• Access to hosting, email and administrative accounts is restricted and protected by two-factor authentication.
• Secret keys are kept in encrypted environment variables, not in the source code.
• The software components we use are updated regularly.

No transmission over the internet is entirely free of risk. If we become aware of a security breach, we will notify you and the Personal Data Protection Board as required by law.

9. External links

The Site contains links to the live sites of our selected projects and to other websites. Those sites are subject to their own privacy policies; once you follow a link, the operator of that site is responsible for the data practices you encounter there.

10. Children

The Site and our services are not directed at persons under 18. We do not knowingly process their data.

11. Your rights

Your rights under Article 11 of the KVKK, and how to exercise them, are explained in detail in sections 8 and 9 of the KVKK data protection notice. If you are located in the European Union and the EU General Data Protection Regulation (GDPR) applies to you, you may also exercise your rights of access, rectification, erasure, restriction of processing, data portability and objection through the same channels, and lodge a complaint with the supervisory authority in your country.

Note for visitors in the European Union (GDPR)

Where we offer our services to people in the EU, the GDPR may apply to our processing of their personal data under Art. 3(2) GDPR, even though we are established in Türkiye. In that case we process your data on the basis of Art. 6(1)(b) GDPR (contract and pre-contractual steps), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (our legitimate interest in running a secure website and answering enquiries), and you have the rights set out in Articles 15 to 22 GDPR: access, rectification, erasure, restriction of processing, notification of recipients, data portability, objection and the right not to be subject to a decision based solely on automated processing. We do not make such decisions. You may send GDPR requests to info@canturan.dev; we respond within one month (Art. 12(3) GDPR). Under Art. 77 GDPR, you also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

12. Changes

We may update this policy. The current version is always published on this page together with the date of the last update; we will announce material changes separately.