KVKK Disclosure

Data controller: gecis.in Contact: [email protected] Processing locations: Germany (Hetzner Online GmbH) and the Cloudflare global network.

Transaction security data: IP address, hash of the IP address, visitor key, User-Agent string, browser and operating system information, device type, referring address, click date and time.

Location data: country, region, city, continent and approximate coordinates derived from the IP address.

Contact data: the email address you choose to enter into the waitlist or an abuse report.

Other: the shortened destination address and any UTM campaign parameters.

Every time a short link is clicked, the visitor's raw IP address is recorded for analytics purposes in the ip column of the click_events table. A raw IP address is personal data.

Raw IP addresses are kept for at most 90 days. The limit is enforced in two stages by a job that runs automatically every night and requires no manual decision. First, the raw address is cleared from every click row older than 90 days; the limit is measured to the second, so no row keeps its address past it. Second, because the table is partitioned by month, the partition covering a month that has entirely passed the limit is dropped whole, which destroys the storage those addresses were written to; that step follows the clearing by up to a further month.

After 90 days only the hash of the IP address produced with a daily rotating salt (ip_hash) and the visitor key remain. The IP address cannot be recovered from those values; they exist solely so unique-visitor counts stay consistent retrospectively.

Access to raw IP addresses is limited to the administrator, and to abuse investigations and lawful requests.

Providing click statistics to the link's owner; securing the service and detecting and preventing abuse such as spam, phishing and automated request floods; enforcing rate limits; meeting legal obligations and responding to requests from the competent authorities; sending the launch announcement to people on the waitlist.

KVKK art. 5/2-(f): processing necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject — this covers the analytics and security data.

KVKK art. 5/2-(ç): compliance with a legal obligation of the data controller — this covers records kept under Law No. 5651.

KVKK art. 5/1: explicit consent — this covers leaving an email address on the waitlist, and it may be withdrawn at any time.

Your personal data is hosted on servers located abroad (Germany) and passes through the infrastructure of Cloudflare, Inc. for traffic management and bot protection. Data is not transferred or sold to third parties for marketing purposes.

Under KVKK art. 11 you have the right to: learn whether your personal data is processed; request information if it has been; learn the purpose of processing and whether it is used accordingly; know the third parties in Türkiye or abroad to whom it is transferred; request correction if it is incomplete or incorrect; request erasure or destruction; request that these operations be notified to the third parties it was transferred to; object to a result adverse to you arising from analysis carried out exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.

To exercise your rights, write to [email protected]. We will respond within 30 days. For a request concerning a raw IP address you must tell us the approximate time of the click and the short link address, otherwise it is technically impossible for us to match a record to you.