Privacy Policy

Our approach

We see personal data not as an asset but as a responsibility. That is why our core principle is simple: we do not collect data we do not need.

We need your address for an order, not your date of birth. Invoicing requires tax details, not your occupation. Every field in our forms has a concrete purpose.

Data we collect

Required information

• Account: Full name, email, phone. To deliver your order and to contact you.
• Delivery: Address details. Shared with the shipping company for delivery only.
• Invoice: Fields required by law.

Optional information

• Favourite products and back-in-stock notification preferences.
• Marketing consents — off by default.

Automatically collected data

IP address, browser information and session records. These are kept to protect your account: to monitor login attempts, detect suspicious access and show you your active sessions.

Data we do not collect

We do not know these and do not want to:

• Your card number. Payments are taken on the iyzico infrastructure. We only have the card brand and the last four digits — so you can recognise your order.
• Your password. It is hashed irreversibly. No one, including us, can see it; if you forget it, you create a new one.
• Location, contacts, device files. We never ask for these permissions.

Data sharing

We do not sell your data and do not transfer it to third parties for marketing. Data is shared only when necessary to provide the service, and only as much as needed:

• iyzico: For payment. Order amount and billing details.
• Shipping company: Name, address, phone for delivery. Order contents are not shared.
• Email and SMS providers: To deliver notifications.
• Competent authorities: When required by law.

Our security measures

We built security as the foundation of the system, not as a layer added later. Our main measures:

Account security

• Passwords are hashed irreversibly (bcrypt).
• Two-step verification is offered; it is mandatory for administrator accounts.
• After five failed login attempts the account is temporarily locked.
• You can see your active sessions and remotely close a device you do not recognise.
• Other sessions are closed by default when you change your password.
• Your password is asked again for critical operations (changing email, deleting the account, downloading data).

System security

• All traffic is encrypted (HTTPS).
• Payments are taken with 3D Secure and verified on the server.
• Administrator actions are kept in immutable records; they cannot be deleted.
• Passwords, card details or session keys are never written to security logs.

Cookies

No non-essential cookie is loaded without your consent. Details are in our cookie policy.

Your rights

You have the right to access, correct and delete your data. Two rights can be used directly from your account:

• Download my data: All your personal data as a machine-readable file. The link is valid for 15 minutes.
• Delete my account: Your personal information is removed. Order and invoice records are kept as required by tax law, but can no longer be linked to your identity.

These can be done on the account privacy page. For the legal grounds and more details, see the KVKK information notice.

Children's privacy

Our site is not intended for people under 18, and we do not knowingly collect data from this age group.

Policy changes

When we change this policy, the date at the top of the page is updated. For significant changes we notify registered users by email.

Contact

For privacy questions, you can reach us via our contact page.