Privacy policy
This policy explains what personal data corrplus.net processes when you visit the site, use the contact form or ask our AI assistant CorrAI a question, why, on what legal basis, who receives it and how to exercise your rights. It covers the GDPR for visitors in the EU and Türkiye's data protection law (KVKK, Law No. 6698). It describes only what the site actually does.
Who is the data controller?
The controller is [LEGAL NAME] (“Corrplus”), a company based in Istanbul, Türkiye.
- MERSIS number: [MERSIS NO]
- Address: [ADDRESS]
- Email: contact@corrplus.net
- Phone: +90 212 967 44 67
A Turkish-language information notice under Article 10 of the KVKK is published at /tr/kvkk-aydinlatma-metni/.
What data does the site process?
corrplus.net is a static website. It has no user accounts, comments or newsletter. The home page has an AI assistant, CorrAI, that answers questions from the site’s content.
| Category | Examples | When |
|---|---|---|
| Server logs | IP address, date and time, requested page, browser details | Every visit |
| Contact details | Name, email, phone, company | When you submit the contact form |
| Your message | The text you write in the form | When you submit the contact form |
| Form security signals | Browser and device signals evaluated by Cloudflare Turnstile | When you use the contact form |
| Usage data | Pages viewed, session length, approximate location, device type (Google Analytics 4) | Only if you accept analytics cookies |
| CorrAI conversations | The questions you type and the answers given, the page you asked on, date and time, country, a random session id made for each visit, response time and token use | When you use CorrAI |
| Abuse prevention | A one-way hash derived from your IP address and a request count. The IP address itself is not stored | When you use CorrAI |
Your theme (light or dark) and language preference are kept in your own browser’s local storage. They are not sent to us. Please do not include sensitive data (health, beliefs, biometrics) or personal details such as your name or contact details in the form messages or in what you type to CorrAI.
Why do we process it, and on what legal basis?
| Purpose | GDPR basis | KVKK basis |
|---|---|---|
| Running and securing the site (server logs) | Art. 6(1)(f), legitimate interest | Art. 5(2)(f), legitimate interest |
| Replying to a project or quote request | Art. 6(1)(b), steps before entering a contract | Art. 5(2)(c), establishing a contract |
| Replying to general questions | Art. 6(1)(f), legitimate interest | Art. 5(2)(f), legitimate interest |
| Protecting the form from bots (Cloudflare Turnstile) | Art. 6(1)(f), legitimate interest | Art. 5(2)(f), legitimate interest |
| Answering questions with CorrAI and reviewing questions and answers to check accuracy, speed and cost and to improve the site | Art. 6(1)(f), legitimate interest | Art. 5(2)(f), legitimate interest |
| CorrAI abuse limits | Art. 6(1)(f), legitimate interest | Art. 5(2)(f), legitimate interest |
| Measuring site use (Google Analytics 4) | Art. 6(1)(a), consent | Art. 5(1), explicit consent |
| Handling legal claims and lawful requests from authorities | Art. 6(1)(c) and (f) | Art. 5(2)(ç) and (e) |
Google Analytics 4 loads only after you accept analytics cookies in the consent banner. You can withdraw consent at any time through the cookie settings, without affecting processing that took place before. We do not make decisions about you based solely on automated processing, and we do not sell your data or share it for advertising. CorrAI’s answers are generated automatically by AI and can contain mistakes; they are for information only and are not an offer or a commitment.
Who receives the data?
| Recipient | Role | Data |
|---|---|---|
| Vercel Inc. | Hosting and delivery of the site | Server logs |
| Resend | Delivering form submissions by email to contact@corrplus.net | Form contents |
| Cloudflare, Inc. | Turnstile form protection | Browser and device signals, IP address |
| Google LLC / Google Ireland Ltd. | Google Analytics 4, only with consent | Usage data, online identifiers |
| Anthropic, PBC (United States) | Generating CorrAI’s answers with its AI model (Claude) | Your question, earlier questions and answers in the same conversation, the site content selected for the answer |
| Supabase, Inc. (servers in the EU, Frankfurt) | Database for contact requests and CorrAI records | Form contents, CorrAI questions and answers, abuse counters |
| Our email provider | Hosting the contact@corrplus.net mailbox | Correspondence with you |
We may also disclose data to courts or public authorities where the law requires it.
Are there international transfers?
Yes. Corrplus is based in Türkiye, so data you send us is processed in Türkiye. Our service providers may process data in the United States, the European Union and other countries. Where the GDPR applies, transfers rely on the safeguards the provider offers, such as an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission’s standard contractual clauses. Under the KVKK, transfers abroad follow Article 9, using appropriate safeguards such as the standard contracts published by the Turkish Personal Data Protection Authority, or another ground the law allows. Transfers for Google Analytics 4 rely on your consent.
How long do we keep it?
We keep data only as long as the purpose requires and any legal limitation periods run. Server logs are deleted according to the hosting provider’s retention settings. Form correspondence is deleted or anonymised once your request is closed and any period for possible claims has passed. CorrAI questions and answers are kept for at most 12 months and then deleted automatically. CorrAI abuse counters are deleted within two days. Analytics data follows the retention setting of our Google Analytics 4 property.
What are your rights?
Under the GDPR you can ask for access to your data, its rectification or erasure, restriction of processing, and a copy in a portable format. You can object to processing based on legitimate interest and withdraw consent at any time. You can also complain to the data protection authority in your country of residence or work.
Under Article 11 of the KVKK you can learn whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the recipients in Türkiye and abroad, request correction, erasure or destruction, ask that recipients be notified, object to an adverse result produced solely by automated analysis, and claim compensation for damage caused by unlawful processing. You can complain to the Turkish Personal Data Protection Board.
How can you contact us?
Email contact@corrplus.net or write to [ADDRESS]. For a KVKK request, include your name, contact address and what you are asking for; the formal application methods are listed in the Turkish notice. We answer KVKK requests within 30 days, as the law requires, and GDPR requests within one month.
Changes to this policy
We update this policy when the site starts new processing or changes a service provider. The current version, with its last updated date, is always on this page.