Privacy notice
Version:
This page describes how Heftas works today. It is a translation for convenience: the Turkish text is the one that applies.
On this page · 13 sections
at a glance
We keep your e-mail address for your account, what you write so we can build your site, and the ids Dodo Payments gives us for payments. No ads, no analytics, we sell nobody any data. Below is the long version: every line has a counterpart in the code.
- Do we sell your data?
- No. There are no ads, analytics or tracking cookies either. →
- Does data leave Turkey?
- Yes. We run the product with 8 outside services; their servers: USA, Germany. →
- What does the model never see?
- It is never given: form messages sent to your site, your e-mail address, your credit ledger and payment details. →
- If I delete my account?
- Sites, form messages and conversations go. The credit ledger stays, detached from you. →
- How long until you answer a request?
- 30 days at most, free of charge. →
deadlines
1.what we keep, and why
Your e-mail address
It is your account. Sign-in codes come here, and form messages from your site land here.
legal basis: Performance of the contract · kept: Until you delete your account.
Sign-in codes
Six digits instead of a password; deleting an account that has no password is confirmed with the same kind of code. We store a hash, not the code itself.
legal basis: Performance of the contract · kept: Valid for 10 minutes; the row is deleted after 24 hours.
Session cookie
So you don’t have to sign in again on every page. The session record also keeps the first 300 characters of the line your browser introduces itself with, so the open sessions list in the account tab can say “Chrome · Windows” and you can spot a device you don’t recognise and close it. We do not write your IP address to the session.
legal basis: Performance of the contract · kept: 30 days, extended as you use it. Deleted as soon as you sign out or delete your account.
What you write and the site we build
The sentences you ask for, your answers to the setup questions, the site’s files and the photos you upload.
legal basis: Performance of the contract · kept: Until you delete the site or your account. An unpublished site on an account that has never paid is deleted if nobody opens it for 30 days; we let you know by e-mail a week before, and opening the site once starts the period again.
The site you publish
The live version of your site sits on our server and is served to your visitors from there. The published files are public. So that a publish that stops halfway cannot break the old site, five earlier versions are kept next to the live one.
legal basis: Performance of the contract · kept: The live version and the 5 before it. When you delete the site or your account they are all deleted at once; a deleted site’s address is not given to anyone for 30 days, so that old links do not end up in someone else’s hands.
Form messages sent to your site
Messages your visitors send. They are yours; we carry them on your behalf.
legal basis: Performance of the contract (you are the controller of this data, we process it) · kept: Until you delete the site or your account; deleting the site deletes its messages.
Your site’s visit count
So the monthly report can say how many times your site was opened this month. One number per day only: no visitor address, cookie or device is kept with the number. (Because the request that reports a visit reaches our server, the address stays for 25 hours in the rate-limit counter only; see the row below.)
legal basis: Legitimate interest · kept: Until the site is deleted.
Counts for the home page and sign-in steps
To see how many people open the home page and see the pricing, and how many start building a site and reach the sign-up page. A few numbers per day: no visitor address, cookie or device is kept with them (the address stays only in the rate-limit counter, for 25 hours). The same numbers are also split by where the visit came from: the source tag in the link (for example “instagram-bio”) or only the name of the referring site (for example google). No page path, no search term, nothing placed in your browser.
legal basis: Legitimate interest · kept: Indefinitely; it cannot be tied to a person.
Your phone number
Only if you want. For support; it never appears anywhere on the site we build.
legal basis: Explicit consent (you fill in the field and can leave it empty) · kept: Until you delete it or close your account.
Payment records
Your plan, credit movements and your Dodo customer id. Your card number never reaches us.
legal basis: Performance of the contract and legal obligation · kept: Even if the account is deleted, the payment record stays at Dodo Payments for the legal period. Your credit movements stay with us but are cut from the account: a hash that cannot be turned back stands where your name and address were.
Server logs
To see what happened when something breaks. Records are written, not people: addresses, e-mails, message contents and tokens do not go into the log.
legal basis: Legitimate interest · kept: 30 days. Filed day by day; past days are deleted.
Rate-limit counters
So nobody asks for a hundred sign-in codes a minute from one address. The counter key contains the IP address of whoever made the request, and it is kept with a timestamp; nothing else is written. An IP address counts as personal data, which is why we say so here. The same applies to anyone who opens the home page, the sign-in page, or the visit counter of a site we built.
legal basis: Legitimate interest · kept: Deleted once they are older than any window could count.
What you write in the complaint form
If you reported a site we host: the site address you wrote, your account of it, which language (Turkish or English) you opened the form in and, if you left one, your reply address. You don’t need an account and we don’t open one. We use the reply address and the language only to answer you in your own language.
legal basis: Legitimate interest (handling complaints about content we host) · kept: The complaint record stays, because it is the basis for a decision to take a site down. Your reply address does not: it is removed from the record 180 days after the answer is sent, and the remaining text does not contain it. If you want it deleted sooner, write from the same form.
Requests that broke our rules
If a site we don’t build (gambling, adult content, drugs and the like) was requested, or such a site was about to be published, or such a photo was uploaded: the text of the request or site, which rule it broke and your account id. A person reads it to check whether the refusal was wrong. We don’t keep a refused photo itself, only its file name.
legal basis: Legitimate interest (not hosting illegal content) · kept: Kept like complaint records, and it stays even if you delete your account: it is the only record of repeated abuse. If the refusal was wrong, write from the support page and we will delete the record.
Free first site record
Each e-mail address gets one site for free; this stops it being given a second time when the account is deleted and reopened with the same address. We keep an irreversible hash (SHA-256) of the address, not the address itself, and the date.
legal basis: Legitimate interest (preventing abuse of the free allowance) · kept: It stays even if you delete your account; the address cannot be recovered from the hash.
Backups
So your account and site come back if a disk is lost. A copy of the database and the site files.
legal basis: Legitimate interest · kept: The last 14 backups are kept and older ones deleted. Keys are not in the backup. On top of that the hosting company copies the server’s whole disk every day; those images are kept for 7 days and go with the server if it is deleted.
legal basis:KVKK art. 5, 10
2.how long it stays
These periods are the settings the product actually applies; the figures on this page are read from those settings. If you delete your account, the sites, form messages and conversation history go with it; this cannot be undone.
- Sign-in code validity10 minutes
- Used sign-in code row24 hours
- Session30 days
- Dodo event record30 days
- Log files30 days
- Backupslast 14 backups
- Rate-limit counters25 hours
- Complainant’s reply address180 days after the answer
- Published versionsthe live one + 5 before it
- A deleted site’s address30 days
3.who sees it
We use these outside services to run the product. Each one sees only what its own job needs:
Anthropic · The model that writes the site, and the model that checks requests, photos and sites against our rules
Your request sentences, your answers to the setup questions, the site’s files, the photos you upload and screenshots of the generated site.
servers: USA
Dodo Payments · Payments
Your e-mail address, your account id with us, your payment and billing details. Dodo Payments takes your card details; they never reach us.
servers: USA
Resend · Sending e-mail
The recipient’s address and the content of the message: sign-in codes, the form message itself, support answers.
servers: USA
Google · Signing in with Google
The e-mail address of the Google account. Your password never reaches us; Google confirms the address and sends us only that confirmed address.
servers: USA
Hetzner · Server: the panel, the database, the sites we build and publish, backups
The server holding your account and sites is theirs. So all the data listed above sits on their disks, and the IP address of every connection to the server passes through their network. They do not look at this data for their own purposes; they run the server on our behalf.
servers: Germany
Cloudflare · Domain records (DNS)
DNS queries for Heftas addresses. Our traffic does not pass through Cloudflare; it sees no visitor, page or content.
servers: USA
Let’s Encrypt · Certificates for the sites’ secure (HTTPS) connection (ZeroSSL as a fallback)
The domain name a certificate is requested for and our server’s address. The names a certificate is issued for already appear in a public certificate log.
servers: USA
Pexels · Stock photos
The search query the model writes. On the published site photos load from Pexels, so Pexels also sees the visitor’s IP address.
servers: USA
All of them are outside Turkey: the server is in Germany, the others in the USA. So when you use the product this data is transferred abroad. That is part of using Heftas, not something you choose separately. We have not yet completed the safeguard documents that Article 9 of KVKK asks for such transfers; we are not hiding it, and what we do and what your rights are is below.
legal basis:KVKK art. 9
4.data controller
For the data described on this page the data controller is the individual who runs Heftas. Heftas is a product name, not a company. Under Article 10 of KVKK: we collect the data for the purposes and on the legal bases written above, sharing it with the outside services named above; the method of collection is your using this site, registering and paying.
We have no duty to register in the data controllers’ registry (VERBIS) at present, because we are below the thresholds for number of employees and financial size; if that changes we will register.
5.what the model never gets
The model that writes the site does not see everything. It is never given:
- Form messages sent to your site
- Your e-mail address
- Your credit ledger and payment details
6.AI and automated checks
An AI model writes the site. Another model checks requests, photos and sites against our rules; a request or site is refused automatically first, and the only legal effect is that “this site was not built or published”. A person reads what was refused; if you think it was wrong, write from the Support tab and a human looks again. We use no model to profile you, to advertise or to score you.
7.cookies and browser storage
This is everything we use:
__Host-yzs_google (cookie)
Set only when you press “Continue with Google”: a one-time value that confirms the browser that started the sign-in is the one finishing it. HttpOnly. It is not a Google cookie; once you are on Google’s page, Google sets its own under its own rules.
kept: 10 minutes; deleted when the sign-in finishes.
__Host-yzs_session (cookie)
Remembers that you are signed in. HttpOnly: scripts on the page cannot read it.
kept: 30 days, extended as you use it. Deleted when you sign out.
__Host-lang (cookie)
The language you chose with the TR / EN switch at the top right. If you never chose, it is not set at all, and the language is read from your browser.
kept: 1 year.
heftas:create:… (browser storage)
A flag so refreshing the page does not start building the same site a second time.
kept: Gone when you close the tab.
heftas:build:… (browser storage)
The same flag on the editing screen.
kept: Gone when you close the tab.
All of them are needed for the product to work. There are no analytics, advertising or tracking cookies, no third-party cookies, and we build no profiles. Strictly necessary ones need no consent banner, so we did not put one in front of you.
The site we build for you sets no cookies of its own. But the pages load from our own server and the photos from Pexels: these two see the visitor’s IP address. Our server keeps no visitor access log for these sites; when something breaks, the server’s error log can pick up details of the request. Fonts come from our own server too; no request goes to Google. On a published site, every page load also sends one small request to our server to count the visit (see “Your site’s visit count” above): your visitor’s address reaches us with it, but we keep it only for the 25-hour rate limit, not with the count.
8.messages sent to your site
What your visitors write in a form is yours. Under KVKK you are responsible for that data and we carry it on your behalf: we show it in your inbox and, if it is on, send it to your e-mail. For that, Resend sees the message content too.
Informing your own visitors is your obligation. We put this notice on the sites we build, but you appear as the business; reading it once is up to you.
legal basis:KVKK art. 3, 10
9.your rights
Article 11 of KVKK gives you these rights: to learn whether your data is processed and to ask for information if it is; to learn whether it is used for its purpose; to know who it was transferred to; to ask for it to be corrected if incomplete or wrong; to ask for it to be deleted or destroyed once the reasons for processing are gone, and for those you transferred it to to be told; to object to a result against you that comes only from automated analysis; and to ask for compensation if unlawful processing harmed you. You can do most of it yourself: your e-mail, plan, credit movements and sites are on the account tab; you can download form messages as CSV.
For the rest, write from the Support tab in your dashboard; your request stays there together with its answer. If the data controller section states an e-mail or KEP address, you can also apply in writing there. There is no registered data protection officer. We answer within 30 days, free of charge. If the answer is not enough, or none comes, you can complain to the Personal Data Protection Board: within 30 days of learning the answer, and if none came, within 60 days of your request at the latest.
Deleting your account is there too: deleting from the Account tab takes your sites offline, closes any subscription and takes your data with it.
legal basis:KVKK art. 11, 13, 14
10.Europe and the UK
If you live in the European Economic Area or the United Kingdom, the rights GDPR gives you are yours too: to access your data, correct it, delete it, restrict its processing, object and take it with you, and to withdraw consent where processing rests on it. Use the same route for all of them. The legal bases for processing are written row by row in the list above (performance of a contract, legitimate interest, legal obligation, explicit consent). If you are not happy with our answer you can complain to the data protection authority of the country you live in.
The data goes to services in Germany and the USA; for transfers outside Europe these providers’ own transfer safeguards (such as standard contractual clauses) apply. If you want the detail, write from the Support tab.
11.children
Heftas is not designed for anyone under 18. If we learn that a minor has opened an account, we delete the account and its data.
12.complaints
If a site we built copied yours, commits fraud or hosts something illegal, write from /en/report. You don’t need to be our customer or open an account.
The only things that reach us from that form are in the list above: the address you wrote, your account of it and, if you left one, your reply address. We use the reply address only to answer you; we open no account, add you to no list, and send no automatic e-mail the moment you submit. We give you no information about the site’s owner.
13.version
Version of this text: 2026-11-04. If it changes, this page changes. The full text of older versions is not on this page; what changed in each version is below.
what changed
2026-11-04
The daily counts for the home page and sign-in steps are now also split by where the visit came from: the source tag in the link or the name of the referring site. Not tied to a person; nothing is placed in the browser.
2026-10-21
Sites moved from Netlify to our own server (Hetzner, Germany); Cloudflare and Let’s Encrypt joined the list of processors. Added the data controller, VERBIS, AI and automated checks, the written application route, rights in Europe and the UK, and children sections.
2026-10-16
Added the Google sign-in cookie, the browser line kept with a session, the IP address staying 25 hours in the rate-limit counter, the home page and sign-in step counts, and the verification code used when deleting an account.
2026-09-29
Payments moved from Stripe to Dodo Payments; Google sign-in joined the list of processors. Added that the credit ledger is detached from a deleted account.
2026-09-26
Added the English version and the language cookie (lang).
2026-09-24
Added the site visit count, the 30-day rule for free sites, the complaint form’s data, refused requests and the free-first-site record.
2026-08-30
First version: the text is generated from the settings in the code.