Yasin Serdar Saglam is the data controller responsible for the processing of your personal data as described in this Privacy Policy, in compliance with the General Data Protection Regulation (GDPR) and applicable Spanish data protection laws (LOPDGDD).
2. Information We Collect
2.1 Information You Provide
Contact Information: Name, email address, phone number when you contact us or engage our services
Payment Information: Billing details processed securely through Stripe. We do not store your full credit card numbers, CVV, or sensitive payment data on our servers
Business Information: Company name, industry, and project details relevant to service delivery
Communications: Content of emails, messages, and correspondence with us
2.2 Information Collected Automatically
Usage Data: Pages visited, time spent, referral sources, and interaction patterns
Device Information: Browser type, operating system, screen resolution, and IP address
Cookies & Tracking: We use Google Analytics and essential cookies for website functionality and analytics
3. How We Use Your Information
We use the collected information for the following purposes:
To provide, maintain, and improve our services
To process payments and issue invoices
To communicate with you about your projects, inquiries, or support requests
To comply with legal obligations, including tax reporting requirements under Spanish and EU law
To protect our rights, prevent fraud, and ensure the security of our services
To analyze website usage and improve user experience
4. Legal Basis for Processing (GDPR)
We process your personal data based on the following legal grounds:
Contractual Necessity: Processing necessary for the performance of a contract or to take pre-contractual steps at your request
Legitimate Interest: Processing necessary for our legitimate business interests, such as fraud prevention, service improvement, and direct marketing to existing clients
Legal Obligation: Processing required to comply with Spanish and EU tax, accounting, and regulatory obligations
Consent: Where you have given explicit consent for specific processing activities (e.g., marketing communications)
5. Payment Data & Stripe
Payment processing is handled exclusively by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. When you make a payment:
Your payment card details are transmitted directly to Stripe's secure servers
We receive only a transaction reference, last four digits of your card, and payment status
We do not store, process, or have access to your full card details
We do not sell, rent, or trade your personal information. We may share data with:
Stripe: For payment processing
Google Analytics and Google Ads: Website usage analytics and ad conversion measurement, only if you accept cookies
DigitalOcean, Cloudflare, Resend and ElevenLabs: Hosting, network security, delivery of contact form messages and the voice assistant on /ai (see section 10)
Tax Authorities: As required by Spanish and EU tax regulations
Legal Requirements: When required by law, court order, or governmental authority
Professional Advisors: Accountants, lawyers, and auditors bound by confidentiality obligations
7. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes described in this policy:
Client data: For the duration of the business relationship plus 5 years (as required by Spanish commercial law)
Invoice & tax records: Minimum 5 years (Spanish tax law requirement)
Analytics data: Up to 26 months (Google Analytics default)
Communications: For the duration of the business relationship plus 3 years
8. Your Rights (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
Right of Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of your data (subject to legal retention requirements)
Right to Restrict Processing: Request limitation of data processing in certain circumstances
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests or for direct marketing
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by GDPR.
9. Cookies
No analytics or advertising cookie is set and no Google Analytics or Google Ads script is loaded before you give consent. The cookie banner offers "Reddet" (Decline) and "Kabul et" (Accept) with equal weight; the site works the same if you decline. Your choice is stored in your browser's local storage for 12 months.
_ga, _ga_9SCQM80DQH (Google Analytics, only with consent): visit statistics, up to 2 years
_gcl_* (Google Ads, only with consent): ad conversion measurement, 90 days
YouTube and Instagram embeds (only with consent or on click): embedded videos load only if you accept cookies or click "İçeriği göster" (Show content) on a single video; Instagram posts load only with consent.
You can change your choice at any time with the "Çerez tercihleri" (Cookie settings) link at the bottom of each page. If you withdraw consent, Google cookies already set are deleted.
10. International Transfers and Recipients
The site and the personal data processed through it (IP address, browser and device information, pages visited, and the information you send through the contact form or the voice assistant) are transferred to the United States through the following providers:
DigitalOcean, LLC (USA): the servers hosting the site and its data are located in the USA (San Francisco).
Cloudflare, Inc. (USA): site traffic passes through the Cloudflare network for security, attack protection and performance; your IP address and request data are processed in the process. The invisible Cloudflare Turnstile check on /ai is part of this.
Google LLC (USA): only if you accept cookies, Google Analytics measures visit statistics and Google Ads measures ad conversions. If you decline, no data is sent to Google for this purpose. Fonts on the legal pages are loaded from Google Fonts.
Resend (USA): delivery of contact form messages to me by email.
ElevenLabs (USA/EU): processing and voicing the questions you ask the voice assistant on /ai.
YouTube (Google) and Instagram (Meta) (USA): embedded videos and posts, loaded only with your consent or on click.
Stripe (USA): payment processing for paid services, as described in section 5.
Transfers to the USA take place under Chapter V GDPR on the basis of the European Commission's EU-U.S. Data Privacy Framework adequacy decision where the provider is certified, and otherwise under the Standard Contractual Clauses included in the providers' data processing agreements. You can request a copy of the relevant safeguards at [email protected].
11. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
SSL/TLS encryption for all data in transit
Secure server infrastructure with regular updates
Access controls and authentication measures
Regular review of data processing practices
12. Children's Privacy
Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.
14. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.
15. Contact
For privacy-related inquiries or to exercise your data protection rights: