FutMind Privacy Policy and KVKK Information Notice
Effective date: [DOLDURULACAK: yürürlük tarihi — yayımda] Version: 1.1 (draft)
This document fulfils the disclosure duty under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and explains how we process your personal data.
1. Data controller
- Legal name: [DOLDURULACAK: şirket ticari unvanı]
- Address: [DOLDURULACAK: şirket merkez adresi]
- Tax office and tax number: [DOLDURULACAK: vergi dairesi adı ve vergi kimlik numarası]
- MERSIS number: [DOLDURULACAK: MERSİS numarası]
- VERBIS registration number: [DOLDURULACAK: VERBİS kayıt numarası]
- Contact person for the data controller: [DOLDURULACAK: irtibat kişisi adı ve unvanı]
- Application e-mail address: [DOLDURULACAK: KVKK başvuruları için e-posta adresi]
- Registered electronic mail (KEP): [DOLDURULACAK: KEP adresi]
2. Categories of personal data processed
| Category | Contents |
|---|---|
| Identity | First name and surname (required when you join). The Turkish ID number you may choose to type into the payment form: we do not store it; we only pass it to the payment institution. |
| Contact | E-mail address. The billing address, city and country you type into the payment form; the postcode and phone number if you choose to give them. |
| Customer transaction | Subscription plan, start and renewal dates, cancellation record, invoice records, refund requests. The texts you accepted with an order, their versions and the time of acceptance. |
| Financial | Transaction and subscription reference returned by the payment institution, amount and payment status. Card details never reach us; they are entered on the payment institution's page. |
| Transaction security | Security events such as registration, sign-in, password reset and deletion request: time, outcome, e-mail address, IP address and coarse device type (e.g. "iPhone · app"). Session records: time and coarse device type. Password hash. For everyone who visits the site, the web server log: IP address, the address of the page opened (without its query part), browser information and time. |
| Usage | The short tag of the link you came from when you joined (e.g. Discord, Telegram, the app). The times you signed in and renewed a session. We do not link which page you opened or what you clicked to your account. We count page views and clicks only as daily totals. |
| Marketing | Your consent to commercial electronic messages and consent history (IYS record) |
| Requests and complaints | Support correspondence, your KVKK applications and our responses |
We do not collect special categories of personal data (health, religion, biometrics, etc.). Please do not send such data to us in support correspondence.
We do not serve persons under 18 and do not knowingly process children's data. If we determine that an account belongs to a person under 18, we close the account and delete the data.
3. Purposes and legal bases
| Purpose | Data processed | Legal basis (KVKK Art. 5) |
|---|---|---|
| Account creation, authentication, session management | Identity, contact, transaction security | Art. 5/2-c: necessary for conclusion and performance of the contract |
| Providing the subscription and analysis content | Customer transaction | Art. 5/2-c: performance of the contract |
| Collecting payment and issuing invoices | Financial, identity, contact, customer transaction | Art. 5/2-c: performance of the contract. Records the law requires us to keep are in the next row (Art. 5/2-ç). |
| Statutory books and document retention, tax duties, proof of pre-contract information and of consent | Financial, identity, contact, customer transaction | Art. 5/2-ç: compliance with a legal obligation (Law No. 6563 Art. 11/3, Commercial Code Art. 82, Tax Procedure Law Art. 253) |
| Handling support requests | Contact, requests and complaints | Art. 5/2-c and Art. 5/2-f: legitimate interest |
| Preventing fraud and abuse; telling you by e-mail when your account is signed in to from a device we have not seen before; showing the successful and failed sign-in attempts of the last 14 days on your account page | Transaction security | Art. 5/2-f: legitimate interest; KVKK Art. 12: data security duty |
| Site security and fault finding | Transaction security (web server and system logs) | Art. 5/2-f: legitimate interest; KVKK Art. 12: data security duty |
| Measuring, as totals, which channel members come from and whether they come back on day 1 and day 7 after joining | Usage (source tag, sign-in and session renewal times) | Art. 5/2-f: legitimate interest |
| Sending commercial electronic messages | Contact, marketing | Art. 5/1: explicit consent (with Law No. 6563 Art. 6/1 and IYS registration) |
| Pursuing disputes and legal defence | All relevant categories | Art. 5/2-e: establishment, exercise or protection of a right |
Where processing relies on explicit consent, you may withdraw your consent at any time. Withdrawal does not make processing before that point unlawful.
4. Method of collection
We collect your data from the registration form, the account page, the payment form and correspondence. We also collect it from the site's and the app's server logs, electronically and by automated means. The site has three cookies only: two that keep your session going and one that remembers you closed the cookie information strip at the bottom of the screen. We use no measurement, analytics or advertising cookie. Details are in the Cookie Policy.
5. Retention periods
| Data | Retention period | Basis |
|---|---|---|
| Account and profile data | Until the account is deleted. It is deleted within 30 days of the deletion request at the latest, and it leaves the server backups before those 30 days are up. | KVKK Art. 5/2-c: performance of the contract |
| Source tag (the short tag of the link you came from when you joined) | Removed from your account 30 days after you join; the account stays. | KVKK Art. 5/2-f: legitimate interest |
| Invoice and accounting records | 10 years | KVKK Art. 5/2-ç; Commercial Code Art. 82 (for tax purposes, also 5 years under Tax Procedure Law Art. 253) |
| Payment transaction records | 10 years | KVKK Art. 5/2-ç; Commercial Code Art. 82, Law No. 6563 Art. 11/3 |
| Order and order consent records (the text you accepted and its version, time of acceptance, account and order number, billing details; no IP address and no device information is kept) | 10 years from the end of the year of the transaction | KVKK Art. 5/2-ç; Law No. 6563 Art. 11/3, Commercial Code Art. 82 |
| Login and transaction security logs | 14 days | KVKK Art. 5/2-f: legitimate interest (account security); KVKK Art. 12: data security duty |
| Session records (time, coarse device type) | Deleted 14 days after the session ends. A session lasts at most 30 days. | KVKK Art. 5/2-f: legitimate interest (account security); KVKK Art. 12: data security duty |
| Sign-in and payment attempt counters (IP address or e-mail) | 1 day | KVKK Art. 5/2-f; Art. 12 |
| Web server access logs (IP address, page opened, browser information; not linked to membership) | About 15 days | KVKK Art. 5/2-f: legitimate interest (security) |
| Web server error logs (IP address and address of the failing request) | [DOLDURULACAK: süre — sunucu ayarı bekleniyor] | KVKK Art. 5/2-f: legitimate interest (fault finding) |
| Server system and application logs (operation and error records; some carry an IP address) | About 90 days | KVKK Art. 5/2-f: legitimate interest (fault finding) |
| Delivery records of membership e-mails at Brevo (recipient address, subject, delivery status) | [DOLDURULACAK: Brevo gönderim kaydı süresi — sahibin Brevo ayarı bekleniyor] | KVKK Art. 5/2-f: legitimate interest (seeing whether a message arrived) |
| Support correspondence | [DOLDURULACAK: süre — destek posta kutusu kurulup süre uygulanınca] | KVKK Art. 5/2-f: legitimate interest |
| Commercial message consent records | 3 years from withdrawal of consent | KVKK Art. 5/2-ç; Regulation on Commercial Communication and Commercial Electronic Messages Art. 13/2 |
| KVKK application records | 3 years from the date of response | KVKK Art. 5/2-e: protection of a right (proof that the application was answered) |
If your account is deleted, the order records are cut loose from your account. Your e-mail address and phone number are removed from them. An order paid on the site keeps the name, surname and address. An order that was never paid, and a purchase made through an app store, keeps no buyer details.
Security events (the login and transaction security logs in the table) are deleted from the live system on the first night after their 14 days are up. Deleted records stay in the server's nightly backups for about 14 more days. Only the server administrator can reach the backups. At about day 28 these records leave the backups as well.
When a period expires, data is deleted, destroyed or irreversibly anonymised. Accounts with a deletion request, security events, session records and attempt counters are deleted by jobs that run every night. On our periodic destruction schedule, no more than 6 months pass between two destruction runs.
6. Transfers
We do not sell your data.
Domestic transfers (KVKK Art. 8). To provide the Service, your data may be transferred to the following groups of recipients:
- Payment institution: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico) — for collecting card payments and processing refunds. iyzico receives your first name, surname, e-mail address, billing address, city and country. If you gave them, it also receives your postcode, phone number and Turkish ID number.
- Accounting and financial advisory provider: [DOLDURULACAK: mali müşavir / muhasebe firması].
- Authorised public authorities and judicial bodies: where required by law, limited to the scope of the request.
International transfers (KVKK Art. 9). Service providers whose servers are outside Türkiye:
- Hetzner Online GmbH (Germany, Nuremberg data centre) — hosting. All member data, and the web server log of everyone who visits the site, are kept on these servers.
- Sendinblue SAS, trading as Brevo (France) — delivery of membership e-mails: address verification, password reset, security notices, payment and account deletion e-mails. This company receives your e-mail address, your name and the content of the message. The content includes one-time links and, in a new-device notice, the device type and the sign-in time. Measuring message opens and link clicks: [DOLDURULACAK: Brevo açılma/tıklama ölçümü — sahibin Brevo ayarı bekleniyor]. Brevo also processes part of this data for its own purposes (including preventing spam and fraud and developing its own AI features), under its own privacy policy, as a separate data controller.
- [DOLDURULACAK: futmind.ai e-posta kutusu sağlayıcısı (destek ve KVKK başvuruları) — aktarım yolu kararı]
Legal basis for these transfers: [DOLDURULACAK: aktarım dayanağı — aktarım yolu kararı]. Where a standard contract is used, it is notified to the Authority within 5 business days of signature.
In-app purchases. If you buy inside the app, you give your payment and store account details directly to Apple (seller on the App Store: Apple Distribution International Ltd.) or to Google. For that data these companies are separate data controllers, bound by their own privacy policies. We send them nothing that identifies you. For Google Play purchases, to ask whether a purchase is valid and what was paid, we send back to Google only the purchase token and the order number Google itself issued.
7. Data security
The main technical and organisational measures we apply:
- All traffic is encrypted in transit (HTTPS).
- Passwords are stored as irreversible hashes.
- The old content that deleted records leave in the database file is also erased by a nightly job.
- On the server, only the administrator (root) account can read the member database.
- Card data never enters our systems; payment completes on the page of a licensed payment institution.
- Backups are kept for about 14 days.
If a data breach occurs, we notify the Personal Data Protection Board and the affected data subjects as soon as possible under KVKK Art. 12/5.
8. Your rights as a data subject (KVKK Art. 11)
You may exercise your rights under Article 11 of the Law (including learning whether your data is processed, asking for information, correction, deletion, objection and compensation) through the routes in section 9.
In addition:
- Receiving a copy of your data. On request, we provide the data associated with your account as a machine-readable file (JSON or CSV).
- Deleting your account and data. On your deletion request, your account is closed and your data is deleted. Records we are legally required to keep (in particular invoice and accounting records) are retained for their statutory period; access to them is restricted and they are not used for any other purpose. We tell you in writing which data was deleted and which was retained under a legal obligation. Logging out is not deletion; deletion happens only on your explicit request — and when you request it, it genuinely happens.
- Withdrawing consent. You may withdraw at any time the consent you gave for marketing messages.
9. How to exercise your rights
You may submit your application, in line with the Communiqué on Procedures and Principles of Application to the Data Controller, by one of the following routes:
- E-mail from the address registered to your account to [DOLDURULACAK: KVKK başvuruları için e-posta adresi].
- Registered electronic mail with secure electronic signature or mobile signature to [DOLDURULACAK: KEP adresi].
- A wet-signed petition delivered in person to [DOLDURULACAK: şirket merkez adresi] or served through a notary.
Your application should state your name, contact details, the subject of your request and any supporting documents.
We conclude the application within 30 days at the latest. Responses are free of charge as a rule; where the process incurs a cost, the fee set in the Board's tariff may be charged.
If your application is rejected, the response is insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of the application date.
10. Changes
If we update this policy, we publish the current version on our website and notify material changes by e-mail before they take effect.