Privacy.

This notice is given under the Turkish Personal Data Protection Law No. 6698 (KVKK). It is also published in Turkish; if the two versions differ, the Turkish text prevails.

Short version. When you write to us through the contact form, we store the details you submit, email a copy to our own mailbox, and use them to review your request and reply. The records are stored with our hosting and database providers in Frankfurt, in the European Union; the email copy reaches our Google Workspace mailbox through our email delivery provider. We don't sell it, use it for advertising, or use it to train models. Form records and their email copies are deleted no later than two years after submission, and you can ask us to correct or delete them sooner.

Who is responsible

The data controller for personal data submitted through eqlx.ai is Can Demir, a sole proprietor trading as eqlx, based in İstanbul, Türkiye. Privacy requests and questions can be sent to privacy@eqlx.ai. If you would rather apply by post, ask at the same address and we will send you our postal address. The identity, residency, and processing terms for customer deployments are defined separately in the relevant agreement.

What we collect

The contact form collects name, email, company, sector, message, inquiry topic, and any optional role choice. When you arrive through a scoped call to action, we may also store short internal identifiers for the source page, call to action, sector, and approved campaign, and, when you come from a use-case page, a reference to that use case. These identifiers contain no message text.

To enforce abuse limits, the server briefly processes the request's network address and converts it into a purpose-specific pseudonymous digest. The application database does not store the raw address, user-agent string, email, or form body in its rate-limit records. Standard hosting logs may still include request metadata, such as the address, time, and requested page, under the hosting provider's controls. Please do not put customer records, production data, credentials, model files, confidential evidence, or secrets into free-text fields.

When enabled for the hosted deployment, the site uses cookie-free Vercel Web Analytics to count aggregate page views and understand which published pages and referral sources are useful. A page-view record may include the page path, referrer, broad location, device type, operating system, and browser category. Before sending, the application removes every query parameter and URL fragment. It sends no custom analytics events, form values, or contact details.

The site sets no cookies.

Why we use it, and on what legal basis

Inquiry data is used to assess the request, reply, and — if both sides choose to continue — prepare the requested pre-contract discussion. This processing is necessary to take the steps you ask for before a contract may be made (KVKK Article 5(2)(c)) and rests on our legitimate interest in answering business inquiries (Article 5(2)(f)). Abuse limits and hosting logs rest on our legitimate interest in keeping the site secure (Article 5(2)(f)). Where a law requires us to keep or disclose a record, we do so to meet that legal obligation (Article 5(2)(ç)). We do not run advertising trackers, sell audience data, or follow visitors across sites.

Aggregate page-view analytics, when enabled, is used to understand public-site usage and improve navigation and content. It is not used to build individual visitor profiles or measure the text a visitor enters.

Who receives it, and where

Personal data is collected electronically through this site's forms and passed to the following service providers only as far as each needs it to provide its service:

• Vercel Inc. (United States) hosts the site. The server functions that receive form submissions run in Vercel's Frankfurt region; the platform and its request logs are operated by Vercel, including from the United States.
• Supabase Inc. (United States) provides the database that stores submissions, in its Frankfurt, European Union region.
• Resend (Plus Five Five, Inc., United States) delivers a copy of each form submission to our own mailbox. It processes the submission only to send that email and keeps its delivery records, which include the message, for the period its service sets.
• Google (Google Workspace) provides our mailbox, which receives that copy, and the email service we use to reply to you.

Because these providers process data outside Türkiye, submitting a form involves a transfer of personal data abroad. These transfers are made under Article 9 of the KVKK. We may also disclose data to a public authority where the law requires it. We do not sell or rent personal data to anyone.

How long we keep it

Contact records, and their copies in our mailbox, are deleted no later than two years after submission. If a conversation becomes an engagement, the records needed for the agreement are kept for the periods that commercial and tax law require. Pseudonymous rate-limit records expire automatically, and provider security and delivery logs follow each provider's configured retention. We delete records earlier on a valid request unless a legal obligation requires a limited record to be retained.

Customer data on deployments

Regulated custom work runs physically inside the customer's own on-premises infrastructure. Other customer-specific engagements define the approved deployment and data boundary in writing. Production-data access is limited to the authorized identities and purposes required by the relevant scope and agreement, including a data-processing agreement where required.

YouTube API Services

Our internal publishing tool uses YouTube API Services to upload and manage videos on our own YouTube channel (Can Demir | eqlx, youtube.com/@eqlx_ai). By using it, we agree to the YouTube Terms of Service, and Google's Privacy Policy applies to the data Google processes.

• What it accesses: only our own channel, through Google sign-in (OAuth). It uploads our videos and sets their titles, descriptions, thumbnails, captions, playlists, and publish times. It does not access other channels, and it does not collect, store, or share any data about viewers, including comments or analytics.
• What it stores: an access token, kept only on the computer where the tool runs, and the IDs of our own videos in a local log. Nothing is sold or shared with third parties.
• Revoking access: the channel owner can revoke the tool's access at any time in Google's security settings (myaccount.google.com/permissions).
• Deleting data: revoking access stops all use. The stored token is deleted from the computer, and the local log is deleted, within 7 days of revocation or on request to privacy@eqlx.ai.

Your rights

Under Article 11 of the KVKK, you have the right to:

• learn whether we process personal data about you;
• request information about that processing;
• learn the purpose of the processing and whether the data is used accordingly;
• know the third parties, in Türkiye or abroad, to whom the data is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for the data to be deleted or destroyed under the conditions of Article 7;
• ask for a correction or deletion to be notified to the third parties who received the data;
• object to a result against you that arises solely from automated analysis of the data; and
• claim compensation if you suffer damage because the data was processed unlawfully.

To use these rights, email privacy@eqlx.ai from the address you used when you contacted us, or apply in writing by post. We answer within 30 days, free of charge; if the request creates a separate cost, the fee set by the Personal Data Protection Board may be charged. If your request is refused, the answer is insufficient, or we do not answer in time, you can complain to the Board (Kişisel Verileri Koruma Kurulu). If another data-protection law, such as the EU GDPR, applies to you, you can use the same address to exercise the rights it gives you.