Draft, pending owner approval. Last updated 14 November 2026.
KVKK privacy notice (Aydınlatma Metni)
Pyramid Works LLC prepared this notice under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures for Fulfilling the Obligation to Inform, for people who fill in the Datarithms early-access form. This is a translation; the Turkish text governs. For invited accounts, cookies and other topics, see the Privacy notice.
This is not a consent form. We do not ask for explicit consent to send the form; your data is processed on the legal grounds below.
1. Data controller
| Controller | Pyramid Works LLC, a company in the United States |
| Privacy requests | privacy@datarithms.io |
| Representative in Türkiye / EU / UK | None appointed. |
2. Personal data processed
| Category | Data |
|---|---|
| Contact | Work email address |
| Customer transaction | Company name, the monthly ad spend range you chose, whether you are a company or an agency, when you sent the form |
| Transaction security | A keyed one-way hash of your IP address (the IP address itself is not written to the database); the IP address in server logs |
No special categories of personal data are processed.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5/2) |
|---|---|
| Reply to your early-access request by email, decide who joins early access, and invite you | Processing is necessary and directly related to setting up a contract with you (c); our legitimate interest, provided it does not harm your fundamental rights and freedoms (f) |
| Protect the form against automated and repeated submissions (at most 5 per IP per hour) and review abuse | Our legal obligation to keep data secure, KVKK Art. 12 (ç); our legitimate interest (f) |
| Answer privacy requests and protect our rights against legal claims | Legal obligation (ç); establishing, using or protecting a right (e) |
4. How the data is collected
Electronically and directly from you when you fill in the early-access form; the IP address hash and server logs are collected automatically when the form is sent.
5. Recipients and purposes of transfer
| Recipient | What it does | Country |
|---|---|---|
| Hivelocity (hosting) | Provides the rented server that runs the site and the database, and stores the data on our behalf. We manage the server with Coolify, self-hosted software on that server; Coolify is not a separate recipient. | United States |
| Cloudflare (domain) | Provides DNS for datarithms.io. [If Cloudflare's proxy is switched on, site traffic and IP addresses pass through Cloudflare; to be confirmed by the owner.] | United States |
| Cloudflare (email forwarding) | Cloudflare Email Routing receives the emails you send to privacy@datarithms.io and forwards them to our team's mailbox, acting as our processor. | United States |
| Public authorities and courts | Only where the law requires it. | The relevant country |
Your data is not sold, not shared for advertising and not transferred to any other third party.
6. Storage outside Türkiye
The controller is in the United States and your data is stored on a server in the United States. Your data leaves Türkiye when you send the form.
You send the data directly to us, with no intermediary in Türkiye. The Personal Data Protection Authority's guide on transfers of personal data abroad (January 2025) states that a controller abroad obtaining personal data directly from a data subject in Türkiye is not a transfer of personal data, but that KVKK applies to that processing. We process your data in line with KVKK.
Your data is stored in the US, on a server we rent from our hosting provider. The same guide treats a controller abroad passing data to a processor abroad as a transfer. [Which KVKK Article 9 transfer tool (for example a standard contract) is needed for the hosting provider is under legal review; to be confirmed by the owner.]
We do not ask for your explicit consent to storage abroad. Under KVKK Article 9/6, explicit consent can support a transfer only where there is no adequacy decision and no appropriate safeguard, and only for incidental transfers; the Authority's guide says transfers in the ordinary course of business are not incidental. The general principles of KVKK (Article 4) and the data security obligations (Article 12) apply to your data in full.
7. Retention
| Data | How long we keep it | Why this long |
|---|---|---|
| Early-access request (work email, company, monthly ad spend range, company or agency) | Deleted automatically 365 days (about 12 months) after we receive it, or earlier if you ask. | So we can reply to you while early access runs. |
| IP address hash on an early-access request | Removed from the request automatically after 30 days. | Only needed for short-term abuse review. |
| Form submission records (IP address hash, time) | Deleted automatically after 7 days. | The hourly submission limit needs one hour; the rest is for abuse review. |
| Sign-in attempt records (email, IP address hash, time, success or failure) | Deleted automatically after 30 days. | The lockout looks back 15 minutes; the rest is for reviewing security incidents. |
| Password setup links (stored only as a hash) | Stop working after 24 hours; deleted automatically 7 days after that. | A short time to explain why a used or expired link no longer works. |
| Account (email, password hash, role, created and last sign-in time) | While the account exists; deleted within 30 days after you ask or after the account is closed. | Needed for the account to work. |
| Session cookie | 8 hours in your browser; removed when you sign out. | Keeps you signed in. |
| Server logs (time, requested page, response status, IP address) | [up to 30 days; server setting to be confirmed by the owner] | To run the service and investigate attacks. |
| Privacy requests and our replies | 3 years after the request is closed. | To show that we answered on time. |
[If database backups are kept: deleted data leaves the backups within the backup retention period, to be confirmed by the owner.]
At the end of the period the data is deleted or anonymised. Periods marked "automatically" are applied by a deletion job that runs regularly. [The daily run of the deletion job is not scheduled yet; the owner will set it up.]
8. Your rights under KVKK Article 11
By applying to us you have the right:
- to learn whether your personal data is processed,
- if it is, to request information about it,
- to learn the purpose of processing and whether the data is used for that purpose,
- to know the third parties in Türkiye or abroad to whom it is transferred,
- to ask for correction if it is incomplete or wrong,
- to ask for deletion or destruction under the conditions of KVKK Article 7,
- to ask that correction, deletion or destruction be notified to third parties who received the data,
- to object to a result against you that comes only from automated analysis of your data,
- to claim compensation if you suffer damage because of unlawful processing.
9. How to apply and when we answer
Under KVKK you can apply in Turkish in one of these ways (Communiqué on the Procedures for Applications to the Data Controller):
- by email to privacy@datarithms.io from an email address you gave us before and that is in our records (the easiest way),
- by email to privacy@datarithms.io signed with a secure electronic signature or mobile signature.
Include your name, your Turkish ID number (or, for foreign nationals, nationality and passport or ID number), a postal address, an email address if you have one, and what you are asking for.
We answer free of charge as soon as possible and at the latest within 30 days. If the work has its own cost, the fee in the Board's tariff may be charged. We may ask for information to confirm who you are.
If we refuse, if you find the answer insufficient, or if we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer and in any case within 60 days of your application (KVKK Article 14; kvkk.gov.tr).