KVKK Privacy Notice (Turkey)
Last updated: 27 October 2026
This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for the Duty to Inform, to people who use 850house Studio at https://studio.850house.co and the site previews at sites.850house.co (the "Service").
For general information see our Privacy Policy, and for cookies see our Cookie Policy. This notice is published in Turkish and English; if they differ, the Turkish version prevails.
1. Data controller
| Item | Details |
|---|---|
| Legal name | 850 HOUSE YAZILIM VE TİCARET LTD. ŞTİ. |
| Address | Büyükdere Mah. Çayırbaşı Cad. No: 58 İç Kapı No: 1 Sarıyer / İstanbul |
| Tax office / number | Sarıyer / 0281059451 |
| MERSIS no. | 0028105945100001 |
| info@850house.co | |
| Phone | +90 532 348 44 84 |
2. Data we process, purposes and legal bases
We process your personal data in the categories, for the purposes and on the legal bases listed in KVKK Art. 5/2 below:
| Data category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Identity and contact | Email address, name if you give it; basic Google profile (name and profile photo) if you use Google sign-in | Creating and managing your account, service messages, answering requests | Art. 5/2(c) establishing and performing a contract |
| Account security | Password hash, sign-in sessions, sign-in records | Signing in, keeping your account secure | Art. 5/2(c) contract; Art. 5/2(f) legitimate interest |
| Customer transactions | Chat messages, files of each site and version, uploaded logos and images, generated images, brand kit settings, credit balance and history | Planning, writing, checking and publishing previews of sites with AI; creating and exporting brand kits; tracking credits; support | Art. 5/2(c) performing the contract |
| Quote requests | Name, email, company, what you want built, domain and hosting needs, timeline, budget, notes | Preparing and sending a quote for a bigger build, custom domain or hosting when you ask for one | Art. 5/2(c) establishing a contract |
| Finance / payment | Order number, amount, date and payment status received from the payment provider (we never receive or process full card numbers) | Selling credits, invoicing (e-invoice / e-archive), accounting and tax records, refunds | Art. 5/2(c) contract; Art. 5/2(ç) legal obligation |
| Transaction security / technical | IP address, browser and device data, server and error logs, necessary cookies | Information security, preventing abuse, obligations under Law No. 5651, improving the Service | Art. 5/2(ç) legal obligation; Art. 5/2(f) legitimate interest |
| Legal matters | Any of the above relevant to a dispute, correspondence | Establishing, exercising or defending rights; responding to authorities | Art. 5/2(e) establishing, exercising or protecting a right; Art. 5/2(ç) legal obligation |
Non-essential (analytics or marketing) cookies, if ever used, will rely only on your explicit consent; none are used today. We send no commercial electronic messages without your separate consent and İYS registration. No decisions with legal effect are made about you solely by automated processing.
3. How we collect data
We collect data electronically, partly or fully by automated means, through sign-up and sign-in forms, Google sign-in (only if you choose it), the chat, site building and brand kit screens, logo and image uploads, quote requests sent by email, the payment provider's checkout page, email correspondence, server logs and necessary cookies.
4. Recipients and purposes of transfer
Your data may be transferred, for the purposes and on the legal bases above, to the following recipient groups:
| Recipient | Purpose | Location |
|---|---|---|
| Supabase (database, authentication, file storage) | Storing accounts, sites, brand kits and content, sign-in | Abroad: EU (Frankfurt, Germany) |
| Vercel (web hosting) | Serving https://studio.850house.co and the site previews at sites.850house.co | Abroad: [USA / global edge network] |
| Trigger.dev (background jobs) | Running the agent's jobs that write and check sites | Abroad: [EU / USA] |
| Anthropic (AI model Claude) | Planning the site and writing its code; receives your messages and the site files for each turn | Abroad: USA |
| OpenAI (image generation and brand description) | Generating images and brand descriptions; receives image prompts and, for logos, the brand name | Abroad: USA |
| Resend (email) | Sending sign-in links, account and other transactional emails | Abroad: USA |
| PayTR (payment provider) | Taking payments and refunds | Turkey |
| Google (only if you use Google sign-in) | Authentication | Abroad: USA |
| Accountants, tax offices, courts, enforcement offices and competent public authorities | Meeting legal and tax obligations, protecting rights | Turkey |
AI providers use the content sent to them only to produce your result and, under their API terms, do not use it to train their models [confirm per provider]. Transfers within Turkey are made under KVKK Art. 8 on the legal bases in Art. 5/2.
Transfers abroad are made under KVKK Art. 9 (as amended by Law No. 7499, in force since 1 June 2024): where a legal basis in Art. 5/2 exists, relying first on an adequacy decision and otherwise on one of the appropriate safeguards in Art. 9/4, mainly the standard contract published by the Board and notified to the Personal Data Protection Authority within five business days of signing. Where neither exists, data is transferred only in the occasional cases listed in Art. 9/6, for example where it is necessary to perform the contract with you.
5. Retention
| Data | Retention period |
|---|---|
| Account, site, brand kit and chat data | While the account is open; after closure, deleted or anonymised within about 6 months unless the law requires longer |
| Files, versions and images of deleted sites and brand kits | Immediately when deleted in the app |
| Invoices, payment and transaction records | Up to 10 years under the Turkish Commercial Code, Tax Procedure Law and Law No. 6563 |
| Server and access logs (incl. traffic data) | Up to 2 years under Law No. 5651 |
| Quote requests | A reasonable time after the request ends if no contract is made; for the limitation period if there is a dispute |
When a period ends, data is deleted, destroyed or anonymised in the periodic destruction cycles of our data retention and destruction policy.
6. Your rights under KVKK Art. 11
By applying to the data controller, you can:
- learn whether your personal data is processed;
- request information about the processing;
- learn the purpose of processing and whether data is used for that purpose;
- know the third parties in Turkey or abroad to whom data is transferred;
- ask for incomplete or inaccurate data to be corrected;
- ask for data to be deleted or destroyed under the conditions in KVKK Art. 7;
- ask for correction, deletion or destruction to be notified to the recipients;
- object to an outcome against you that results solely from automated analysis;
- claim compensation for damage caused by unlawful processing.
7. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include your name, surname, signature (for written applications), Turkish ID number (for foreigners, nationality and passport or ID number), address for notices, email if any, phone and the subject of your request. You can send it:
- in writing with a wet signature, in person or through a notary, to: Büyükdere Mah. Çayırbaşı Cad. No: 58 İç Kapı No: 1 Sarıyer / İstanbul
- signed with a secure electronic signature or mobile signature, to: info@850house.co
- from the email address you previously gave us and that is registered in our system, to: info@850house.co
We will answer as soon as possible and within 30 days at the latest, free of charge. If answering involves an extra cost, a fee may be charged under the tariff set by the Personal Data Protection Board. If your application is rejected, you find the answer insufficient or we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application.