KVKK Information Notice

The company providing the Buildary service, whose details appear below, is the data controller that decides how your personal data is used.

Legal business name

MFC GRUP İNŞAAT YAZILIM LİMİTED ŞİRKETİ

Brand

Buildary

Tax number

2170415294

Registered office address

İzmir Konak İsmet kaptan mahallesi 1364 sokak no 14 sema iş merkeziNo 104/105 FC GRUP

Email

buildarydev@gmail.com

Telephone

0850 302 02 79

We process your name, email address, account and login information; the requests you write, your conversations, the content and previous versions of your websites, and your usage records. Your first name, surname, identity number or tax number, telephone number, and billing address provided when you make a payment are sent to iyzico for payment. The same information is also stored in your billing profile at Buildary so that we can issue invoices. Your identity number or tax number is stored encrypted. Buildary does not receive your card number.

Your telephone number is used to send a verification code (by SMS or WhatsApp). We also use it for a WhatsApp message when your website is ready, but only if you enable that message in Settings. The number is stored for verification. If you delete your account, your number is deleted; only a one-way hash (HMAC) of a number that has received welcome credit remains, so that credit is given only once per number. The number cannot be recovered from the hash.

We use this information to open your account, create the website you request, store your websites, measure your usage entitlement, verify payment, handle invoicing and subscriptions, provide support, protect the system, improve the product, and measure how people reach our website.

These activities are based on the legal grounds of entering into or performing the contract between us, fulfilling our legal obligations, establishing or protecting a right, and our legitimate interests that do not harm your fundamental rights. Advertising measurement is based on your explicit consent; details are in the Advertising measurement section below. If you do not consent, you can use the service in exactly the same way.

If you opened an account through a friend's invitation link or a "Made with Buildary" badge on a website, we record which account invited you, the date you purchased your first plan, and your plan. To prevent a person from awarding invitation rewards to their own accounts, before releasing the reward we check whether the inviting and invited accounts share the same email address, telephone number, billing identity number or tax number, billing address, payment customer code, or a hash of the first six and last four digits of the payment card (not the card number itself), and whether they registered with the same surname from the same network (a keyed hash of the IP address).

This comparison is automatic and affects only the invitation reward: a match results in the reward not being given, without affecting your account or service. You can write to the address below to object to the outcome. The basis for this processing is our legitimate interest in preventing undue gain and abuse, and establishing or protecting a right. The registration IP hash is deleted 30 days after the reward decision is finished, or, for registrations that never make a payment, 120 days after registration. For the invitation cookie, see the Cookie Policy.

To measure the results of Buildary advertisements, we share the following information with Meta Platforms only if you give explicit consent. Consent is given as two separate choices in the cookie banner or Cookie preferences and can be withdrawn at any time.

Information shared for the browser tag: the _fbp and _fbc cookie identifiers set by Meta, your IP address, browser information, the address of the page you open, and the advertising click code.

Information shared for account and payment events: the event type and time, the amount paid and currency, package name, a SHA-256 hash of your email address, a hash of the random identifier linked to your account, your IP address, and browser information.

Not shared: your telephone number, name, address, identity number or tax number, card information, the requests you write, and the content of your websites.

Purpose: to measure which registrations and payments result from our advertisements and to enable advertisements to be shown based on those results. Legal basis: your explicit consent (Law No. 6698, Art. 5/1).

Recipient: Meta Platforms (USA). Meta processes this information on our behalf for measurement and matching; it may also use it under its own responsibility for displaying advertisements and developing products. The transfer abroad is based on the Board's standard contract; the contract was signed on November 4, 2026; notification to the Authority will be made within the statutory period.

Collection method: the Meta tag in your browser and our server. Retention: on our server, an unsent event for no more than 7 days, a sent event for no more than 30 days; the consent record for 3 years after consent is withdrawn. At Meta, event information for no more than two years.

You withdraw your consent through the Cookie preferences link at the bottom of the page. If you are logged in, sharing linked to your account is turned off immediately; if you turn it off without logging in, the tag stops immediately in this browser, while sharing linked to your account is turned off when you next log in or when you log in and turn off the setting. Permission for an existing account is not automatically given by a choice in the cookie banner; we ask separately for that account after you log in. You can also exercise your rights concerning information previously sent to Meta through the address below.

Your information may be transferred to the following service providers to the extent necessary to provide the service. For each provider, we state the purpose, country, types of data transferred, and basis for the transfer.

• netcup. Purpose: Application servers, database, and backups. Country: Austria (server in Vienna). Data: All account, website, payment reference, billing profile, and visitor records. Transfer basis: Standard contract (KVKK Art. 9).
• Cloudflare. Purpose: Storage of website files (R2), website publication, domain DNS records, and bot verification (Turnstile). Country: USA. Data: Website files and images, requests to published websites (IP address, browser information), domain records. Transfer basis: Standard contract (KVKK Art. 9).
• Resend. Purpose: Transactional emails: account verification, notifications, and website form and appointment notifications. Country: USA. Data: Email address, name, and email content; what the visitor completing the form has written. Transfer basis: Standard contract (KVKK Art. 9).
• Anthropic. Purpose: Artificial intelligence model for website creation, editing, and Ary's replies. Country: USA. Data: The requests you write, website content, Ary conversations; visitors' form text if needed for the requested task. Transfer basis: Standard contract (KVKK Art. 9).
• EachLabs. Purpose: Access to artificial intelligence models for images, video, audio, and some text tasks. Country: USA. Data: Prompts, photos and videos you upload, text to be voiced; text taken from customer questions for article tasks. Model providers (called through this service): OpenAI, Google, MiniMax, Kling, ByteDance, Deepgram, Mureka. Transfer basis: Standard contract (KVKK Art. 9).
• FastSaver. Purpose: Retrieving the reference video at the link you include in your prompt. Country: Uzbekistan. Data: The link you include in your video request. Transfer basis: Standard contract (KVKK Art. 9).
• Meta (WhatsApp and advertisements). Purpose: WhatsApp support channel (when you contact us on WhatsApp), Ary through WhatsApp, customer announcements, telephone verification code, and website-ready notification; management of your Meta advertising account when you connect it. Country: USA. Data: Telephone number, verification code, WhatsApp messages and media files, advertising account information, and campaign settings. Transfer basis: Standard contract (KVKK Art. 9).
• Telegram. Purpose: Messaging with owners who use Ary through Telegram. Country: Abroad (Telegram's server locations). Data: Telegram user identifier, the owner's conversations with Ary, and media files sent. Transfer basis: Standard contract (KVKK Art. 9).
• Google. Purpose: Sign in with Google; Google Ads, Search Console, and YouTube connections when you connect them. Country: USA. Data: Account name and email, advertising account identifiers, campaign settings and metrics, uploaded videos. Transfer basis: Standard contract (KVKK Art. 9).
• Spaceship. Purpose: Domain registration and renewal. Country: USA. Data: First name, surname, address, telephone number, and email as the domain owner. Transfer basis: Standard contract (KVKK Art. 9).
• Scrapingdog. Purpose: Finding the business's information in public map and search results. Country: India. Data: Business name, location, and search text. Transfer basis: Standard contract (KVKK Art. 9).
• Geoapify. Purpose: Address suggestions when entering a billing address. Country: Cyprus. Data: Only the address search text you enter. Transfer basis: Standard contract (KVKK Art. 9).
• PostHog. Purpose: Cookieless visit counting on promotional pages and product usage measurement in the dashboard. Country: European Union (servers). Data: Visit information converted into an irreversible hash; dashboard usage events linked to an account identifier. Transfer basis: Standard contract (KVKK Art. 9).
• iyzico. Purpose: Card payments and subscription collection. Country: Turkey. Data: First name, surname, identity number or tax number, telephone number, billing address; card information is entered on iyzico's screen and is not received by Buildary. Transfer basis: Processed in Turkey; no transfer abroad.
• Paraşüt. Purpose: Issuing e-Archive and e-Invoice invoices. Country: Turkey. Data: Invoice recipient's name, identity number or tax number, address, and payment amount. Transfer basis: Processed in Turkey; no transfer abroad.
• Netgsm. Purpose: Telephone verification SMS. Country: Turkey. Data: Telephone number and verification code. Transfer basis: Processed in Turkey; no transfer abroad.

If you separately permit advertising measurement, your information is also shared with the following provider (based on your explicit consent; details are in the Advertising measurement section).

• Meta Platforms (advertising measurement). Purpose: Measuring the results of Buildary advertisements. Runs only if you give permission in the cookie banner. Country: USA. Data: Meta cookie identifiers, IP address, browser information, page address; if you give separate permission, also event type, amount paid, and a SHA-256 hash of your email address. Transfer basis: Standard contract (KVKK Art. 9).

In addition, our accountant may access information for our invoice and accounting records, as may competent institutions and organizations upon a lawful request.

Transfers to processors abroad are made under Article 9 of Law No. 6698 (as amended by Law No. 7499). As of today, the Personal Data Protection Board has not issued an adequacy decision for any country. For this reason, we use the Board's standard contract as the basis for transfers to providers processing outside Turkey. When the contract is signed, we notify the Authority within five business days of signing.

Visit counting on promotional pages is cookieless, and your IP address is not stored. Advertising measurement is separate and runs only if you give permission (Cookie Policy). If you collect form submissions, appointments, or customer records on your websites, you are the data controller for your visitors' data, and Buildary is the data processor. Details are in the Data Processing Addendum.

If you choose to type your billing address into the search field, only the search text is sent to Geoapify to obtain address suggestions. Your name, Turkish identity number or tax number, telephone number, and payment information are not included in this search. Buildary does not permanently record the search text. The address you select from a suggestion is stored as your normal billing address when you save your billing information. Geoapify may use infrastructure abroad; the explanations above concerning transfers abroad apply. You can enter your address manually without using search.

We collect information electronically through the website, forms in the application, the requests you write, support messages and live support conversations, server logs, and payment notifications from iyzico.

We retain account and website information for as long as you use the service. When you delete your account, data that can be deleted is removed. Payment, invoice, agreement, and security records may be retained for the period required by law; when that period ends, they are deleted or disconnected from your identity.

You have the right to learn whether your data is processed; request information if it is processed; learn whether it is used for its intended purpose; know the recipients; request correction of inaccurate or incomplete data; request erasure or destruction when the conditions are met; request notification of corrections or erasure to recipients; object to an adverse result arising solely from automated systems; and request compensation if you suffer damage due to unlawful processing.

You can send your application, together with information enabling us to verify your identity, to buildarydev@gmail.com. We will reply within the statutory period. Do not include your card number or security code in your message.