Privacy and Data Protection

1. Who processes your data

Your data is processed by the business trading as YadCap, acting as the data controller.

Registered name

Samet Kerem Ülfaz

Address

Merdivenköy Mahallesi, Dikyol Sk. B Blok No: 2 İç Kapı No: 179, Kadıköy / İstanbul

Tax office

Göztepe

Tax number

10066839698

Phone

0552 678 35 79

Website

www.yadcap.com

2. What we collect

Everything we hold is listed below. We do not process anything that is not on this list.

• Account: your email address and your password. We cannot see your password; it sits in the database as an irreversible hash.
• If you sign in with Google: the email address, name and profile photo Google hands us. Google never gives us your password.
• Order: your name, email, phone, delivery address, what you ordered and what you paid.
• Payment: the outcome, the payment id iyzico gives it, and the last four digits of your card. Your card number, expiry and CVC never reach us at any point; you type those on iyzico's own page.
• Your Turkish ID number: payment institutions are required by law to hold it. It travels with the payment request straight to iyzico and is never written to our database.
• Collection: which serial code you claimed, when, and which product it belongs to.
• Security records: your claim attempts and your IP address. We keep these to stop code-guessing attacks.
• Admin records: what was done in the panel, by whom, when and from which IP.
• If you write to us on Instagram: what you wrote and your Instagram username.
• Your cart: it lives in your own browser and is never sent to us.

3. Why we process it, and on what basis

We do not use automated decision-making or profiling. We do not sell your data and we do not share it with anyone for advertising.

We do not send marketing email today. If we start, we will ask for separate, explicit consent. Refusing it changes nothing about your account or your collection, and you can withdraw it whenever you want.

• Opening your account, tying your collection to it, taking your order and delivering it: forming and performing the contract.
• Taking payment and passing your Turkish ID number to the payment institution: an obligation set out in law.
• Keeping order, invoice and payment records: a legal obligation.
• Protecting the serial-code system from abuse, plus security and admin records: legitimate interest.

4. Signing in with Google

Google sign-in is optional. You can create an account with an email address and password instead and do exactly the same things with it.

When you press the button you are sent to Google. Google returns only your email address, name and profile picture; your Google password and everything else in your Google account stay with Google. Google's own privacy policy applies to that step.

If you already had a password account on the same email address, the Google identity is linked to it. You will not end up with two accounts and a collection split between them.

5. Where it lives and who else sees it

We do not sell your data. It is shared only with the service providers we need to run the site, and only as far as each service requires:

• Supabase: the accounts, orders and collection database. Servers in Germany (Frankfurt).
• Vercel: hosting. Your IP address appears briefly in access logs.
• iyzico: taking the payment. Your name, email, phone, address and Turkish ID number go to iyzico with the payment request. iyzico is a payment institution established in Turkey.
• Resend: order confirmations, shipping notices and account emails. Your email address and a summary of your order.
• Our contracted courier: your name, phone and delivery address, so the parcel can be delivered.
• Google: only if you choose to sign in with Google.

iyzico and the courier are established in Turkey, so those transfers stay domestic. Supabase, Vercel, Resend and Google are abroad, which means your data is transferred outside Turkey. That happens only as far as receiving the service requires, and under the commitments those providers give as data processors.

We share it with nobody else. The only exception is a lawful request from a competent public authority.

6. How long we keep it

Once the period ends the record is deleted or stripped of anything identifying you.

• Account and collection: for as long as your account exists. Delete your account and the collection record goes with it.
• Order, delivery and payment records: 10 years, as tax and commercial law require. These have to stay even if you delete your account within that period.
• Security and claim-attempt records: 12 months at most.
• Admin records: 2 years.

7. Cookies

The site currently sets strictly necessary cookies only: the one that keeps you signed in. No advertising cookies, no tracking pixels, no third-party analytics. That is why you never see a cookie consent banner here.

Your cart is not even a cookie. It sits in your browser's own storage and is never sent to us.

If we add analytics later, a banner will ask for your consent before the tool runs, and this page will be updated.

8. Your rights

Under KVKK article 11 you can ask us to: confirm whether we process your data, tell you what we hold and why, tell you whether it has been used for its stated purpose, name the third parties it has been transferred to inside or outside Turkey, correct it if it is incomplete or wrong, delete or destroy it, notify those third parties of any correction or deletion, object to a decision produced solely by automated analysis that works against you, and compensate you for damage caused by unlawful processing.

If you are in the EU, the GDPR also gives you the right to receive your data in a portable format and to object to processing.

To exercise any of these, email us. We respond within 30 days at the latest. If our answer does not satisfy you, you can complain to Turkey's Personal Data Protection Authority, and if you are in the EU, to your local supervisory authority.

9. Changes to this page

We may update this text from time to time. The current version always lives here, and the date at the top marks the last substantive change. If something material changes, account holders get an email.