Studio
Sign in

KVKK Privacy Notice (Turkey)

Last updated: 27 October 2026

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for the Duty to Inform, to people who use 850house Studio at https://studio.850house.co and the site previews at sites.850house.co (the "Service").

For general information see our Privacy Policy, and for cookies see our Cookie Policy. This notice is published in Turkish and English; if they differ, the Turkish version prevails.

1. Data controller

ItemDetails
Legal name850 HOUSE YAZILIM VE TİCARET LTD. ŞTİ.
AddressBüyükdere Mah. Çayırbaşı Cad. No: 58 İç Kapı No: 1 Sarıyer / İstanbul
Tax office / numberSarıyer / 0281059451
MERSIS no.0028105945100001
Emailinfo@850house.co
Phone+90 532 348 44 84

2. Data we process, purposes and legal bases

We process your personal data in the categories, for the purposes and on the legal bases listed in KVKK Art. 5/2 below:

Data categoryExamplesPurposeLegal basis
Identity and contactEmail address, name if you give it; basic Google profile (name and profile photo) if you use Google sign-inCreating and managing your account, service messages, answering requestsArt. 5/2(c) establishing and performing a contract
Account securityPassword hash, sign-in sessions, sign-in recordsSigning in, keeping your account secureArt. 5/2(c) contract; Art. 5/2(f) legitimate interest
Customer transactionsChat messages, files of each site and version, uploaded logos and images, generated images, brand kit settings, credit balance and historyPlanning, writing, checking and publishing previews of sites with AI; creating and exporting brand kits; tracking credits; supportArt. 5/2(c) performing the contract
Quote requestsName, email, company, what you want built, domain and hosting needs, timeline, budget, notesPreparing and sending a quote for a bigger build, custom domain or hosting when you ask for oneArt. 5/2(c) establishing a contract
Finance / paymentOrder number, amount, date and payment status received from the payment provider (we never receive or process full card numbers)Selling credits, invoicing (e-invoice / e-archive), accounting and tax records, refundsArt. 5/2(c) contract; Art. 5/2(ç) legal obligation
Transaction security / technicalIP address, browser and device data, server and error logs, necessary cookiesInformation security, preventing abuse, obligations under Law No. 5651, improving the ServiceArt. 5/2(ç) legal obligation; Art. 5/2(f) legitimate interest
Legal mattersAny of the above relevant to a dispute, correspondenceEstablishing, exercising or defending rights; responding to authoritiesArt. 5/2(e) establishing, exercising or protecting a right; Art. 5/2(ç) legal obligation

Non-essential (analytics or marketing) cookies, if ever used, will rely only on your explicit consent; none are used today. We send no commercial electronic messages without your separate consent and İYS registration. No decisions with legal effect are made about you solely by automated processing.

3. How we collect data

We collect data electronically, partly or fully by automated means, through sign-up and sign-in forms, Google sign-in (only if you choose it), the chat, site building and brand kit screens, logo and image uploads, quote requests sent by email, the payment provider's checkout page, email correspondence, server logs and necessary cookies.

4. Recipients and purposes of transfer

Your data may be transferred, for the purposes and on the legal bases above, to the following recipient groups:

RecipientPurposeLocation
Supabase (database, authentication, file storage)Storing accounts, sites, brand kits and content, sign-inAbroad: EU (Frankfurt, Germany)
Vercel (web hosting)Serving https://studio.850house.co and the site previews at sites.850house.coAbroad: [USA / global edge network]
Trigger.dev (background jobs)Running the agent's jobs that write and check sitesAbroad: [EU / USA]
Anthropic (AI model Claude)Planning the site and writing its code; receives your messages and the site files for each turnAbroad: USA
OpenAI (image generation and brand description)Generating images and brand descriptions; receives image prompts and, for logos, the brand nameAbroad: USA
Resend (email)Sending sign-in links, account and other transactional emailsAbroad: USA
PayTR (payment provider)Taking payments and refundsTurkey
Google (only if you use Google sign-in)AuthenticationAbroad: USA
Accountants, tax offices, courts, enforcement offices and competent public authoritiesMeeting legal and tax obligations, protecting rightsTurkey

AI providers use the content sent to them only to produce your result and, under their API terms, do not use it to train their models [confirm per provider]. Transfers within Turkey are made under KVKK Art. 8 on the legal bases in Art. 5/2.

Transfers abroad are made under KVKK Art. 9 (as amended by Law No. 7499, in force since 1 June 2024): where a legal basis in Art. 5/2 exists, relying first on an adequacy decision and otherwise on one of the appropriate safeguards in Art. 9/4, mainly the standard contract published by the Board and notified to the Personal Data Protection Authority within five business days of signing. Where neither exists, data is transferred only in the occasional cases listed in Art. 9/6, for example where it is necessary to perform the contract with you.

5. Retention

DataRetention period
Account, site, brand kit and chat dataWhile the account is open; after closure, deleted or anonymised within about 6 months unless the law requires longer
Files, versions and images of deleted sites and brand kitsImmediately when deleted in the app
Invoices, payment and transaction recordsUp to 10 years under the Turkish Commercial Code, Tax Procedure Law and Law No. 6563
Server and access logs (incl. traffic data)Up to 2 years under Law No. 5651
Quote requestsA reasonable time after the request ends if no contract is made; for the limitation period if there is a dispute

When a period ends, data is deleted, destroyed or anonymised in the periodic destruction cycles of our data retention and destruction policy.

6. Your rights under KVKK Art. 11

By applying to the data controller, you can:

  • learn whether your personal data is processed;
  • request information about the processing;
  • learn the purpose of processing and whether data is used for that purpose;
  • know the third parties in Turkey or abroad to whom data is transferred;
  • ask for incomplete or inaccurate data to be corrected;
  • ask for data to be deleted or destroyed under the conditions in KVKK Art. 7;
  • ask for correction, deletion or destruction to be notified to the recipients;
  • object to an outcome against you that results solely from automated analysis;
  • claim compensation for damage caused by unlawful processing.

7. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include your name, surname, signature (for written applications), Turkish ID number (for foreigners, nationality and passport or ID number), address for notices, email if any, phone and the subject of your request. You can send it:

  • in writing with a wet signature, in person or through a notary, to: Büyükdere Mah. Çayırbaşı Cad. No: 58 İç Kapı No: 1 Sarıyer / İstanbul
  • signed with a secure electronic signature or mobile signature, to: info@850house.co
  • from the email address you previously gave us and that is registered in our system, to: info@850house.co

We will answer as soon as possible and within 30 days at the latest, free of charge. If answering involves an extra cost, a fee may be charged under the tariff set by the Personal Data Protection Board. If your application is rejected, you find the answer insufficient or we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application.