1. Purpose and scope
This Privacy Policy explains which personal data is processed, for what purposes and on which legal bases, to whom it is transferred, how long it is retained and what rights data subjects have when using the CloudotNet website, application (app.cloudotnet.tech), authentication service (auth.cloudotnet.tech), public form service (forms.cloudotnet.tech) and file access service (files.cloudotnet.tech) offered under the cloudotnet.tech domain and its subdomains, together with the mobile application to be released later (the "Platform").
This policy is prepared on the basis of Turkey's Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation. For users established in the European Union, the General Data Protection Regulation (GDPR) is also observed to the extent applicable.
Two different roles. Two kinds of data are processed on the Platform:
- Account and Platform data: identity, contact, account security and usage data of the users who create an account. For this data we are the data controller.
- Customer content: tasks, records, form responses, documents and similar data that an organization enters into the Platform. For personal data contained in that content (for example data of the organization's employees, customers or form respondents) the data controller is that organization; we process it only on the organization's instructions and only to provide the service, acting as a data processor. The duty to inform data subjects about that content lies with the organization.
2. Data controller
| Data controller | Kürşat Turgut |
| Brand | CloudotNet Tech |
| Location | Kocaeli, Türkiye |
| Phone | +90 510 221 87 81 |
| kvkk@cloudotnet.tech | |
| Web | https://cloudotnet.tech · https://kursatturgut.com.tr |
CloudotNet Tech is a service brand developed and operated by Kürşat Turgut; it is not a separate company or legal entity. The Platform serves organizations of any sector.
3. Personal data we process
| Category | Data | Source |
|---|---|---|
| Identity and contact | Name, surname, email address, phone number (optional), profile photo (optional), preferred language | Registration form, profile page |
| Account and security | Username, password (stored only as an irreversible hash), two-factor authentication and passkey records, session and device information (browser/operating system), sign-in, sign-out and failed sign-in events, IP address | Authentication service |
| Organization and membership | Organization name and logo, roles and permissions, email address of invited persons, invitation status | Organization administrator |
| Usage and activity records | Change history showing who changed tasks, records and settings and when; notification preferences; delivery records of sent notifications | Platform usage |
| Technical access logs | Server request logs: request path, status code, duration, browser information (User-Agent), masked IP address (last octet zeroed for IPv4, last 80 bits zeroed for IPv6), user and organization identifier; error reports (error message, stack trace, request path; credentials and secret parameters are removed) | Servers |
| Legal consent evidence | Accepted text and version, language, date, digest (SHA-256) of the displayed content, IP address, browser information | Consent screen |
| API key usage | Key name and prefix (the key itself is not stored), endpoint called, status code, IP address, time | API and MCP access |
| Support requests | Subject, messages, attachments, application version and page where the request was opened, browser information | Support form |
| Website contact | Name, email, company (optional), phone (optional), message | Contact form and chat bubble |
| Website analytics (only with consent) | Page views, click and scroll heatmaps, session recordings, approximate location, device and browser information | Google Analytics 4, Microsoft Clarity |
The Platform does not request special categories of personal data (health, biometric data etc.). Entering such data into customer content is the organization's own decision and responsibility.
The Platform is not directed at persons under 18.
4. Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5) |
|---|---|
| Creating the account, authentication, organization and membership management, providing the service | Conclusion and performance of a contract (art. 5/2-c) |
| Account security; preventing unauthorized access, abuse and attacks; brute-force protection and rate limiting | Legitimate interest (art. 5/2-f) |
| Keeping the service operational, detecting and fixing errors | Legitimate interest (art. 5/2-f) |
| Proving acceptance of the Terms of Use and acknowledgement of the KVKK Notice | Legal obligation; establishment, exercise or protection of a right (art. 5/2-ç, e) |
| Keeping change history (audit trail) | Performance of a contract and legitimate interest (art. 5/2-c, f) |
| Answering support requests, sending service notifications | Performance of a contract (art. 5/2-c) |
| Answering website contact requests | Pre-contractual steps at the data subject's request (art. 5/2-c) |
| Meeting legal obligations and responding to requests of competent authorities | Legal obligation (art. 5/2-ç) |
| Analytics and heatmaps on the website | Explicit consent (art. 5/1); can be withdrawn at any time from the cookie banner |
No behavioural analytics, advertising or profiling takes place inside the Platform. Technical records are kept solely for system monitoring and security.
5. Method of collection
Personal data is collected electronically, by automated or partly automated means, through registration and sign-in forms, profile and organization settings, actions within the Platform, support and contact forms, and server logs.
6. Processors and transfers
Your personal data is not sold, rented or shared with third parties for marketing. It is transferred only to the service providers below, to the extent necessary to provide the service and to be processed on our instructions:
| Provider | Purpose | Data transferred | Location |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting (application, database, authentication, website) | All Platform data | European Union (Finland) |
| Cloudflare, Inc. | Network security, DDoS protection, content delivery, human verification (Turnstile), object storage (uploaded files and database backups) | Network traffic (IP address, browser information, request content); uploaded files; encrypted backups | Global network; database backups restricted to the European Union region |
| Functional Software, Inc. (Sentry) | Error monitoring | Error reports (request path, error message, stack trace; credentials and secret parameters are removed before sending) | European Union (Germany) |
| Resend, Inc. | Email delivery (account verification, password reset, invitations, notifications and contact form emails) | Recipient email address, subject and content | United States |
| Google LLC | Website analytics (only if consent is given) | Usage data, cookies | Global |
| Microsoft Corporation | Website heatmaps and session recording (only if consent is given) | Usage data, cookies; form fields are masked | Global |
Google and Microsoft are independent data controllers for the data they collect through their analytics services and process it under their own privacy policies. Those policies are not part of this policy; you can read them here: Cloudflare, Hetzner, Sentry, Resend, Google, Microsoft.
If an organization configures its own outgoing email server, emails that organization sends from the Platform are delivered through the organization's own provider.
Data is disclosed to competent public authorities only where the law expressly requires it and only to the extent requested.
7. International transfers
Transfers to the providers located outside Turkey in the table above are carried out under the conditions set out in article 9 of the KVKK. These transfers are technically necessary to provide the service; every user's data is processed on this infrastructure.
8. Retention periods
| Data | Retention |
|---|---|
| Account, profile and organization data | While the account or organization remains open; deleted or anonymised within 30 days of a closure or deletion request |
| Customer content | While the organization remains open; deleted when the organization is deleted; drops out of backups within 30 days |
| Change history (audit trail) | For the period defined in the organization's plan, at most for the life of the organization; deleted with the organization |
| Legal consent evidence | 10 years after the account is closed (general limitation period) |
| Authentication events (sign-in, sign-out, failed sign-in) | 90 days |
| Server request logs | Up to 30 days |
| Error reports | Up to 90 days |
| API key usage records | Up to 12 months |
| Notification and email delivery records | Up to 180 days |
| Support requests | 2 years after the request is closed |
| Website contact requests | 1 year after the request is resolved |
| Database backups | 30 days |
| Website cookie preference | Until you delete it from your browser |
At the end of the period the data is deleted, destroyed or anonymised. Where a dispute or legal obligation is pending, retention is extended only for as long as necessary.
9. Data security
- All connections are encrypted with TLS; servers are not directly reachable from the internet, traffic passes only through the security layer.
- Each organization's data is separated at the database level (row-level access policies); no organization can access another organization's data.
- Access is role and permission based. Users can enable two-factor authentication and passkeys, and can view and terminate their sessions.
- Passwords are stored as irreversible hashes. Account lockout and rate limiting protect against failed sign-in attempts.
- IP addresses are masked in server logs; request and response bodies are not logged. Credentials and secret parameters are removed from error reports before they are sent.
- Change history and consent evidence are append-only; they cannot be altered or deleted afterwards.
- The database is backed up daily; backups are kept in the European Union region in storage whose access is restricted by key.
- Administration panels are available only to authorized staff behind an additional authentication layer.
If a data breach is detected, the Personal Data Protection Board is notified within 72 hours in line with the KVKK and Board decisions, and affected persons are informed within a reasonable time.
10. Cookies
The cookies and browser storage used on the website and in the Platform, their purposes and how you can manage your preferences are described in the Cookie Policy. Inside the Platform only strictly necessary cookies are used, for maintaining the session and for security; no analytics or advertising cookies are used.
11. Your rights
Under article 11 of the KVKK you have the right, by applying to the data controller, to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties to whom the data is transferred, in Turkey or abroad,
- request correction if the data is incomplete or inaccurate,
- request erasure or destruction under the conditions of article 7 of the KVKK,
- request that correction, erasure and destruction be notified to the third parties to whom the data was transferred,
- object to a result against you arising from analysis of the data exclusively by automated systems,
- claim compensation for damage suffered due to unlawful processing.
How to apply. In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request from the email address registered on the Platform to kvkk@cloudotnet.tech, with a secure electronic or mobile signature, or in writing; the postal address for written requests is provided on request via kvkk@cloudotnet.tech. The request must include your name, surname, signature (for written requests), Turkish ID number (nationality and passport number for foreigners), address for notification, email or phone number for contact, and the subject of the request. Requests are concluded free of charge within 30 days at the latest; if the operation entails an additional cost, the fee set by the Board may be charged. Additional information may be requested to verify your identity.
If your request is rejected, the answer is found insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board.
You can correct your account and profile information directly on the profile page of the Platform, terminate your sessions, and view the versions of the legal texts you have accepted.
12. Changes to this policy
This policy is published with a version number and effective date. Changes are published on the website as a new version; for significant changes affecting Platform users, users are informed inside the Platform and by email.
13. Contact
For privacy questions and requests, use the contact channels in section 2.
