Privacy Policy

Two companies provide services under the simurgh.media brand: Simurgh Medya Yazılım Ticaret Ltd. Şti. in Türkiye and SIMURGH MEDIA, LLC in the United States. The Turkish company is the controller for our website and the shared client portal; for data about a service you buy, the company named on your order or invoice is the controller. For personal data on sites you host with us and in projects you give us to work on, you are the controller and we are your processor.

Company

Simurgh Medya Yazılım Ticaret Ltd. Şti.

Address

Atatürk Mah. Ertuğrul Gazi Sk. A Blok No: 2E Kat: 21 D: 331, 34758 · Ataşehir / Istanbul, Türkiye

Tax / MERSİS

Kozyatağı Tax Office · 7700972620 · MERSİS [MERSİS No]

Phone

+90 555 085 01 24

US company

SIMURGH MEDIA, LLC · Delaware · EIN 38-4335560 · 1111B S Governors Ave STE #23849, Dover, DE 19904 US

E-mail

[email protected]

Data Protection Officer (DPO)

[email protected]

We process only the data you give us and the technical data needed to provide the service and protect your account. We do not build advertising profiles.

2.1 Data you give us

• Identity and contact: name, title/position, e-mail, phone, address
• Company and billing: company name, tax office and number, billing address; for invoices to individuals in Türkiye, the Turkish ID number where tax law requires it
• Request forms: company, role, topics, budget and timeline in the project request form; your e-mail address for the newsletter
• Message content: what you write in forms, e-mails and support tickets
• Portal account: sign-in e-mail, password (only its hash is stored), two-step verification secret and recovery codes, account users and roles
• Payments: card details are entered directly with the payment provider (Stripe for the US company, iyzico for the Turkish company); we see only a reference (token), the card brand, last 4 digits and expiry date. For bank transfers, the transfer receipt and an IBAN for refunds
• Domains: registrant and contact details (name, organisation, address, e-mail, phone), name servers
• Hosting and projects: files, databases and e-mail in your hosting account; data you give us in projects (for these we are your processor)

2.2 Technical data collected automatically

• Server logs: IP address, browser, request time and error logs
• Portal security records: time, IP address and browser for actions such as sign-in, sign-out, password and card changes
• Cookies: strictly necessary cookies for sessions and form security (details in §8)
• Bot protection: browser and device signals used by Cloudflare Turnstile on form and sign-in pages
• Licence activation: the domain, installation ID, version and IP address that smApp installations send when verifying their licence

We process each item of data for a specific purpose and on an appropriate legal basis (KVKK Arts. 5–6; for people in the EU/EEA, GDPR Art. 6).

We keep your data for as long as its purpose requires and the law prescribes. The detailed retention table is in Section VIII of the KVKK Notice.

When the period ends, data is deleted, destroyed or anonymised as part of periodic destruction. Copies in backups are deleted automatically at the end of the backup cycle. Invoices and accounting records are kept for the statutory period even if you close your account.

We do not sell or rent data or give it to ad networks. The providers below work only with the data needed to provide the service. Some are used only for a particular service or company.

You can ask for the current processor list at [email protected]. When we add a processor that affects client data we update this page, and we notify clients with a data processing agreement in advance.

Some of your data is transferred outside Türkiye and the EU because of payments (Stripe), e-mail (Resend), bot protection (Cloudflare), domain registration (Enom/Tucows and registries), font and library delivery (Google Fonts, jsDelivr) and sharing with our US company.

These transfers are protected by the following safeguards:

• Under KVKK Art. 9 as amended by Law No. 7499, the standard contracts announced by the KVKK Board and their notification to the Authority; for occasional transfers necessary to perform a contract, the exceptions in Art. 9/6
• For data of people in the EU/EEA, the EU Standard Contractual Clauses (SCCs) under GDPR Art. 46 or the recipient's EU–US Data Privacy Framework certification
• TLS encryption in transit; card details held only by the payment provider
• Data minimisation: each provider receives only the data its service needs. Details: KVKK Notice, Section VI

Under KVKK Art. 11 and (for people in the EU/EEA) GDPR Arts. 15–22, you have the rights below. We conclude every request within 30 days.

To exercise your rights, write to [email protected] or use the other channels in the KVKK Notice. Requests are free; where an action involves an extra cost, the fee in the KVKK Board's tariff may be charged. If you are in the EU/EEA, you may also complain to your local data protection authority.

On the site and in the portal we use only cookies that are strictly necessary for the service to work. We do not use advertising or analytics cookies.

Details: Cookie Policy.

We protect your data with technical and organisational measures in line with industry practice. The main ones:

Our services are not aimed at people under 18 and we do not knowingly collect their data. If we find that we have, we delete it immediately.

We are an agency that builds AI and automation projects. Our use of AI follows these rules:

• Data of site and portal visitors is not sent to AI models.
• In client projects, AI providers are used only with the data and providers agreed in the project contract; we act as a processor in that context.
• We prefer provider settings and contract terms that keep client data out of model training; projects involving special category data are assessed separately.
• Model output cannot be guaranteed to be accurate; we design human review steps into the systems we deliver.

We may update this policy as laws and our services change. We announce important changes by e-mail or in the portal before they take effect. You can ask for earlier versions at [email protected].

For questions about this policy or data subject requests, use the channels below. We answer every request within 30 days.