privacy / kvkk
30 August 2026: This page is not a lawyer-approved, filed contract — it describes how Heftas works today and will be renewed before card payments open. It is a translation for convenience: the Turkish text is the one that applies, and this English version has not yet been reviewed by a lawyer.
We keep your e-mail address for your account, what you write so we can build your site, and the ids Stripe gives us for payments. No ads, no analytics, we sell nobody any data. Below is the long version — every line has a counterpart in the code.
Your e-mail address
It is your account. Sign-in codes come here, and form messages from your site land here.
legal basis: Performance of the contract · kept: Until you delete your account.
Sign-in codes
Six digits instead of a password. We store a hash, not the code itself.
legal basis: Performance of the contract · kept: Valid for 10 minutes; the row is deleted after 24 hours.
Session cookie
So you don’t have to sign in again on every page.
legal basis: Performance of the contract · kept: 30 days, extended as you use it. Deleted as soon as you sign out.
What you write and the site we build
The sentences you ask for, your answers to the setup questions, the site’s files and the photos you upload.
legal basis: Performance of the contract · kept: Until you delete the site or your account. An unpublished site on an account that has never paid is deleted if nobody opens it for 30 days; we let you know by e-mail a week before, and opening the site once starts the period again.
Form messages sent to your site
Messages your visitors send. They are yours; we carry them on your behalf.
legal basis: Performance of the contract — you are the controller of this data, we process it · kept: Until you delete the site or your account; deleting the site deletes its messages.
Your site’s visit count
So the monthly report can say how many times your site was opened this month. One number per day only: no visitor address, cookie or device is kept.
legal basis: Legitimate interest · kept: Until the site is deleted.
Your phone number
Only if you want. For support; it never appears anywhere on the site we build.
legal basis: Explicit consent — you fill in the field and can leave it empty · kept: Until you delete it or close your account.
Payment records
Your plan, credit movements, Stripe customer id and the date you accepted the terms. Your card number never reaches us.
legal basis: Performance of the contract and legal obligation · kept: Even if the account is deleted, the payment record stays at Stripe for the legal period.
Server logs
To see what happened when something breaks. Records are written, not people: addresses, e-mails, message contents and tokens do not go into the log.
legal basis: Legitimate interest · kept: 30 days. Filed day by day; past days are deleted.
Rate-limit counters
So nobody asks for a hundred sign-in codes a minute from one address. Only the counter key and a timestamp.
legal basis: Legitimate interest · kept: Deleted once they are older than any window could count.
What you write in the complaint form
If you reported a site we host: the site address you wrote, your account of it and — if you left one — your reply address. You don’t need an account and we don’t open one. We use the reply address only to answer you.
legal basis: Legitimate interest — handling complaints about content we host · kept: The complaint record stays, because it is the basis for a decision to take a site down. Your reply address does not: it is removed from the record 180 days after the answer is sent, and the remaining text does not contain it. If you want it deleted sooner, write from the same form.
Requests that broke our rules
If a site we don’t build — gambling, adult content, drugs and the like — was requested, or such a site was about to be published, or such a photo was uploaded: the text of the request or site, which rule it broke and your account id. A person reads it to check whether the refusal was wrong. We don’t keep a refused photo itself, only its file name.
legal basis: Legitimate interest — not hosting illegal content · kept: Kept like complaint records, and it stays even if you delete your account: it is the only record of repeated abuse. If the refusal was wrong, write from the support page and we will delete the record.
Free first site record
Each e-mail address gets one site for free; this stops it being given a second time when the account is deleted and reopened with the same address. We keep an irreversible hash (SHA-256) of the address, not the address itself, and the date.
legal basis: Legitimate interest — preventing abuse of the free allowance · kept: It stays even if you delete your account; the address cannot be recovered from the hash.
Backups
So your account and site come back if a disk is lost. A copy of the database and the site files.
legal basis: Legitimate interest · kept: The last 14 backups are kept and older ones deleted. Keys are not in the backup.
These periods are the product’s own settings; they are not typed onto the page but come from constants in the code. If you delete your account, the sites, form messages and conversation history go with it — this cannot be undone.
We use five outside services to run the product. Each one sees only what its own job needs:
Anthropic — The model that writes the site, and the model that checks requests, photos and sites against our rules
Your request sentences, your answers to the setup questions, the site’s files, the photos you upload and screenshots of the generated site.
servers: USA
Stripe — Payments
Your e-mail address, your account id with us, your payment and billing details, the moment you accepted the terms. Stripe takes your card details; they never reach us.
servers: USA / Ireland
Netlify — Hosting the published site
The files of the site you publish and the domain you connect. While the site is live, your visitors’ requests also go to Netlify.
servers: USA
Resend — Sending e-mail
The recipient’s address and the content of the message: sign-in codes, the form message itself, support answers.
servers: USA
Pexels — Stock photos
The search query the model writes. On the published site photos load from Pexels, so Pexels also sees the visitor’s IP address.
servers: USA
All of them are outside Turkey. So when you use the product this data is transferred abroad — that is part of using Heftas, not something you choose separately. We have not yet completed the documents KVKK asks for such transfers; the note at the top of the page is there for exactly this.
The model that writes the site does not see everything. It is never given:
This is everything we use:
yzs_session (cookie)
Remembers that you are signed in. HttpOnly — scripts on the page cannot read it.
kept: 30 days, extended as you use it. Deleted when you sign out.
lang (cookie)
The language you chose with the TR / EN switch at the top right. If you never chose, it is not set at all, and the language is read from your browser.
kept: 1 year.
heftas:create:… (browser storage)
A flag so refreshing the page does not start building the same site a second time.
kept: Gone when you close the tab.
heftas:build:… (browser storage)
The same flag on the editing screen.
kept: Gone when you close the tab.
All of them are needed for the product to work. There are no analytics, advertising or tracking cookies, no third-party cookies, and we build no profiles. Strictly necessary ones need no consent banner — so we did not put one in front of you.
The site we build for you sets no cookies of its own. But the page loads from Netlify and the photos from Pexels: these two see the visitor’s IP address. Fonts come from our own server; no request goes to Google.
What your visitors write in a form is yours. Under KVKK you are responsible for that data and we carry it on your behalf: we show it in your inbox and, if it is on, send it to your e-mail. For that, Resend sees the message content too.
Informing your own visitors is your obligation. We put this notice on the sites we build, but you appear as the business — reading it once is up to you.
Article 11 of KVKK gives you the right to ask what we keep, to correct it, to delete it and to learn where it was transferred. You can do most of it yourself: your e-mail, plan, credit movements and sites are on the account tab; you can download form messages as CSV.
For the rest, write from the Support tab in your dashboard. There is no separate application address or registered data protection officer; your request stays there together with its answer.
Deleting your account is there too: deleting from the Account tab takes your sites offline, closes any subscription and takes your data with it.
If a site we built copied yours, commits fraud or hosts something illegal, write from /en/report. You don’t need to be our customer or open an account.
The only things that reach us from that form are in the list above: the address you wrote, your account of it and — if you left one — your reply address. We use the reply address only to answer you; we open no account, add you to no list, and send no automatic e-mail the moment you submit. We give you no information about the site’s owner.
Version of this text: 2026-09-26. If it changes, this page changes; we do not keep the old version.