Privacy & Data Protection
The short version: this site uses no cookies, does not track you and does not sell data to ad networks. We only receive what you write to us when you fill in the contact form. The long version is below.
Last updated: 27 August 2026
1. Data controller
The data controller is ornisoftware. It is based in Istanbul, Türkiye and works remotely. You can reach us about anything in this notice at [email protected]. Processing is governed by Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"); where the GDPR applies to you as a visitor in the EU, the rights described below apply in the same substance.
2. What data we process
Data reaches us from only three sources through this site, and all three are written out one by one below:
a) The contact form
When you fill in the form, your name, email address and message are sent to us. You write these yourself; the site does not quietly collect any field beyond them. The form also contains a bot trap field that is invisible to visitors — it exists to filter out automated submissions, is never filled in by a real user, and its content is not stored.
b) Visit statistics
We use Cloudflare Web Analytics. This tool sets no cookies, writes nothing to your browser and does not track you across sites. It only produces aggregate information that does not identify you, such as page views, referring source, country and browser type.
c) Server logs
The site is hosted on Cloudflare infrastructure. As on every internet server, IP addresses and request logs are kept for a short period by the infrastructure provider for security and abuse prevention.
3. Cookies and browser storage
This site uses no advertising or tracking cookies. Only two technical entries are kept in your browser: (1) a session entry that stops the intro animation replaying on every page transition — it lives in session storage and is deleted by itself when you close the tab; (2) if you CHOSE a language from the switcher at the top right, an entry remembering it, so the site opens in your language next time. Neither contains personal data, neither is sent to a server and neither is used for advertising; both are removed when you clear your browsing data. That is why you see no cookie consent box on the site — there is no cookie to consent to.
4. Purpose and legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, message | Replying to your request, preparing a proposal, discussing the project | KVKK art. 5/2-c — directly related to entering into or performing a contract (GDPR art. 6(1)(b)) |
| Visit statistics | Understanding which content on the site is useful | KVKK art. 5/2-f — legitimate interest (GDPR art. 6(1)(f)) |
| Server logs | Security, abuse and attack prevention | KVKK art. 5/2-f — legitimate interest (GDPR art. 6(1)(f)) |
5. Who we share it with
We do not sell your personal data, do not share it with ad networks and do not add it to marketing lists. Only the following providers, which are necessary for the service to work, are involved:
- Cloudflare — site hosting, security, email routing and cookieless visit statistics.
- Resend — delivering the message from the contact form to us as an email.
- Google Workspace — hosting our company mailbox; this is where we read your message.
These providers' servers are located outside Türkiye, so data you send through the form is transferred abroad within the meaning of KVKK art. 9. The transfer happens only for the purposes above and within these providers' terms of service. No transfer is made to any other third party; duly made requests from legally authorised public authorities are reserved.
6. How long we keep it
We keep messages from the contact form for at most 2 years after the correspondence is concluded, and they are deleted at the end of that period. If you want them deleted earlier, writing to us is enough and we act on it. Visit statistics are not tied to a person and are therefore not subject to a separate retention period.
7. Security of the data
The site is served over HTTPS end to end; your form submission travels through an encrypted channel. Messages are processed server-side, are not stored on the site itself and land directly in our mailbox. Access is limited to the team members doing the work.
8. Your rights
Under KVKK art. 11 — and under the equivalent GDPR provisions where they apply to you — you may apply to us to:
- learn whether your personal data is being processed,
- request information about it if it has been processed,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties to whom it has been transferred, at home or abroad,
- request that it be corrected if incomplete or inaccurate, and that this be notified to the third parties it was transferred to,
- request its deletion or destruction within the conditions of the law,
- object to a result against you arising from automated analysis,
- claim compensation if you suffer damage due to unlawful processing.
You can send your request to [email protected]. We conclude requests free of charge within 30 days at the latest. If you are not satisfied with the outcome, your right to complain to the Turkish Personal Data Protection Authority — or to your local supervisory authority in the EU — is reserved.
9. Changes to this notice
If the data processed on the site changes (a new form field, a new provider or the use of cookies), this notice is updated too and the "last updated" date above changes.
This is a translation for convenience. The legally binding version of this notice is the Turkish one; in case of any discrepancy, the Turkish text prevails.