KVKK Disclosure Notice

The data controller is Criccletech Bilişim Ltd. Şti., established in Istanbul, Türkiye. You can reach us about anything in this notice at privacy@linkhiver.com.

Depending on how you use the Service, we process the following categories:

• Identity: your name or display name, and your username.
• Contact: your email address.
• Transaction security: the hash of your password, session and sign-in records, and records kept for security and abuse review.
• Customer activity: the links, galleries, QR codes, business cards and profile content you create.
• Marketing and measurement: cookieless aggregate statistics about visits to your published profile, and product-usage records of which dashboard features you use.
• Visual records: the profile photo, background and gallery images you upload.
• Financial: subscription and invoice records created by our merchant of record, Paddle, when you pay. Your card number never reaches us.

We process your personal data only for these purposes:

• Creating and running your account, and serving your published profile to visitors.
• Answering your support requests and delivering transactional email — sign-in codes, password resets, verification and service notices.
• Selling, invoicing and refunding paid subscriptions.
• Detecting and preventing fraud, spam and abuse, and keeping the Service secure.
• Understanding which features help and improving the product.
• Meeting our legal obligations and responding to requests from competent authorities.

Our processing rests on the following grounds in Article 5 of the Law:

• Directly related to the conclusion or performance of a contract (Art. 5/2-c): creating your account, publishing your profile, running your subscription.
• Necessary for the controller to meet a legal obligation (Art. 5/2-ç): invoices and accounting records, responses to competent authorities.
• The controller's legitimate interests, provided they do not harm your fundamental rights and freedoms (Art. 5/2-f): security and abuse review, cookieless visitor statistics, product-usage measurement.
• Explicit consent (Art. 5/1): marketing email, optional analytics cookies, and — if you use the AI Bio feature — transferring your bio text to a model provider abroad. You can withdraw consent at any time.

We do not set out to collect special categories of personal data; if you choose to write such data into your own profile, we publish it under Article 6 of the Law on the basis of your explicit consent.

We collect your personal data by wholly automated means, electronically: the sign-up and sign-in forms, the actions you take in the dashboard, the name and email address returned by Google or Apple if you sign in with them, the subscription records returned by our merchant of record when you pay, and the cookieless measurement of visits to your published profile.

We do not sell your personal data and we do not pass it to third parties for their own marketing. Under Articles 8 and 9 of the Law we transfer it only to the providers needed to run the Service: database and file storage (Supabase, our database in Tokyo, Japan), application hosting (Vercel), network and bot protection (Cloudflare), payments (Paddle, United Kingdom), mobile subscriptions (RevenueCat with Apple and Google), email delivery (Resend), error monitoring (Sentry, European region), analytics (Google and Microsoft, only with your explicit consent), the model provider for the AI Bio feature only if you use it (DeepSeek, China), and Meta only if you connect Instagram auto-reply. All of these providers are located abroad, and each transfer is made on one of the grounds set out in Article 9. We may also disclose data where a court order or a lawful request from a competent authority compels it, limited to the scope of that request.

The detailed list of which data goes to which provider is in Section 5 of our privacy policy.

We keep your account data for as long as your account exists. When you delete your account, your profile, links, uploaded images, visit statistics and product-usage records are erased from the live database immediately; our database provider's encrypted daily backups roll over after 7 days, and from that point no copy remains. Invoices and payment records are kept by our merchant of record for as long as tax and commercial law requires. Aggregate statistics that cannot be linked to you may be kept indefinitely.

By applying to the data controller, you have the right to:

• Learn whether your personal data is processed.
• Request information about it if it has been processed.
• Learn the purpose of processing and whether the data is used in line with that purpose.
• Know the third parties, in Türkiye or abroad, to whom your personal data has been transferred.
• Request correction if it has been processed incompletely or inaccurately.
• Request erasure or destruction under the conditions in Article 7 of the Law.
• Request that any correction, erasure or destruction be notified to the third parties the data was transferred to.
• Object to a result reached against you solely through automated analysis.
• Claim compensation if you suffer damage because the data was processed unlawfully.

To exercise these rights, apply under the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application should state your name and surname, your Turkish ID number if you are a Turkish citizen, an address or email address for our reply, and the subject of your request.

• In writing, as a signed letter delivered to our company address in person or through a notary.
• Through a registered electronic mail (KEP) address, a secure electronic signature or a mobile signature.
• From the email address you previously gave us and that is registered in our system, to privacy@linkhiver.com.

We conclude your application free of charge as soon as possible and within thirty days at the latest; if the request genuinely incurs a cost, the fee in the tariff set by the Board may apply. If your application is rejected, if you find our reply inadequate, or if we do not reply in time, you may complain to the Personal Data Protection Board within thirty days of learning our reply and in any case within sixty days of your application.

We update this notice when our processing or the law changes. The last-updated date above always reflects the version in force, and we email the address on your account when a change is material.