What this notice covers
This notice explains how Geeky Code Lab handles personal data on geekycodelab.com (the public site) and in the Geeky Code Lab Hub (the signed-in area for our team and our clients). It is our information notice (Aydınlatma Metni) under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK), and our notice under articles 13 and 14 of the EU General Data Protection Regulation (GDPR) for people in the European Union.
Our KVKK notice gives the same information in the short form KVKK asks for. Our Cookie policy explains the cookies on the public site and how to change your choice. Our Terms of use set the rules for using the site and the Hub.
This notice does not cover personal data that a client puts into the Hub about other people (for example their own customers) when we only store it for that client. In that case the client decides what happens to that data and our contract with the client applies.
Who is responsible for your data
The data controller (veri sorumlusu) is:
| Item | Details |
|---|---|
| Name | Kaveh Movahedi, sole proprietorship (şahıs işletmesi), trading as Geeky Code Lab |
| Address | Akpınar Mah. Arızlı TOKİ Konutları Sk. Arızlı TOKİ Konutları 4. Ada A6 Blok No: 19 İç Kapı No: 6, İzmit / Kocaeli, Türkiye |
| Tax office and number | Tepecik Tax Office, tax ID number 6231650161 |
| How to contact us about your data | The contact form, choosing Privacy request (your personal data), or by post to the address above (see "How to use your rights") |
Summary
| What | Data | Why | KVKK legal reason (art. 5) | GDPR legal basis (art. 6) | How long |
|---|---|---|---|---|---|
| Visiting the site | IP address, browser and device type, pages requested, time, referring page | Deliver pages, keep the site secure, find faults | Legitimate interest (5/2-f) | Legitimate interests (6(1)(f)) | Up to 30 days in logs |
| Your cookie choice | Random consent id, categories chosen, policy version, a keyed one-way hash of your IP address, your browser's user agent, time | Remember your choice; prove what you agreed to | Legal obligation (5/2-ç); establishing or defending a right (5/2-e) | Legal obligation (6(1)(c), art. 7(1)) | Cookie: 12 months. Record: 3 years |
| Analytics (only with your consent) | Pseudonymous visitor and visit ids, pages, events, device, approximate location | See which pages help and what to improve | Explicit consent (5/1) | Consent (6(1)(a)) | Cookies up to 2 years; Google keeps reports for 2 months |
| Marketing (planned; only with your consent) | Pseudonymous ids, pages, ad clicks and conversions | Measure ads and show relevant ads | Explicit consent (5/1) | Consent (6(1)(a)) | See each tool below |
| Contact form | Name, email, phone or WhatsApp number (optional), company, service, budget, timeline, message, IP address | Answer your request and prepare an offer | Steps before a contract (5/2-c); legitimate interest (5/2-f) | Pre-contract steps (6(1)(b)); legitimate interests (6(1)(f)) | 2 years after it arrives (privacy requests: 3 years); the IP address is not stored |
| Phone number, name shown on WhatsApp, messages | Answer your request | Steps before a contract (5/2-c); legitimate interest (5/2-f) | 6(1)(b); 6(1)(f) | Until we delete the conversation | |
| Site chat assistant | Your questions and the answers; a keyed one-way hash of your IP address | Answer your questions about our services | Legitimate interest (5/2-f); steps before a contract (5/2-c) | 6(1)(f); 6(1)(b) | 30 days after the last message on our server; nothing about the chat in your browser |
| Hub account | Name, email, role, language, profile photo, last seen, sign-in and security data | Give you access to the Hub and keep it secure | Contract (5/2-c); legitimate interest (5/2-f) | Contract (6(1)(b)); legitimate interests (6(1)(f)) | While the account exists; anonymised 12 months after it is deactivated, after a further 30 days' notice |
| Invitations | Email, role, language, who invited you, status | Give you access to the Hub | Legitimate interest (5/2-f) | Legitimate interests (6(1)(f)) | While your account exists; 90 days after an invitation is revoked or expires unused |
| Hub security log | Account events, user id, IP address, time | Security, investigating misuse, proving what happened | Legitimate interest (5/2-f); establishing or defending a right (5/2-e) | Legitimate interests (6(1)(f)) | Up to 30 days |
| Project work in the Hub | What you write, upload and change, and who did what | Run the projects we work on together | Contract (5/2-c); legitimate interest (5/2-f) | Contract (6(1)(b)); legitimate interests (6(1)(f)) | As set in the client's contract; deleted items and articles 30 days in Trash, their files 30 more days in storage history |
| Hub AI chat | Your questions, attached files and the answers | Answer your questions from the Hub's knowledge | Contract (5/2-c); legitimate interest (5/2-f) | Contract (6(1)(b)); legitimate interests (6(1)(f)) | 12 months after the chat's last message, or until you delete it |
| Invoices | Bill-to name, invoice details and PDF, payments | Record what we invoiced and what was paid | Legal obligation (5/2-ç); contract (5/2-c) | Legal obligation (6(1)(c)); contract (6(1)(b)) | 10 years from the issue date |
| Backups | Copies of the Hub database and stored files | Recover from faults and mistakes | Legitimate interest (5/2-f) | Legitimate interests (6(1)(f)) | Database copies 30 days, plus up to 30 more in version history; file copies 30 days |
The sections below give the details.
On the public site
Visiting the site
When you open a page, your browser sends us technical data: your IP address, browser and device type, the page you asked for, the page you came from and the time. Our servers and our content delivery network (Amazon CloudFront) need this to send you the page. We keep it in server logs for up to 30 days to keep the site secure and find faults, then it is deleted.
Your light or dark theme is kept in your browser, not sent to us. Your language is part of the address (/tr for Turkish).
Cookies and your choice
The site uses strictly necessary cookies to work, and analytics and marketing tools only if you allow them. The Cookie policy lists each cookie, its purpose and lifetime. You can change your choice at any time with Cookie settings.
When you make a choice we keep a record of it, so we can show what you agreed to if we are asked: a random consent id, the categories you allowed, the policy version, the time, your browser's user agent and a keyed one-way hash of your IP address. We never store the IP address itself, and the record is not linked to your name, email or any account. We delete these records after 3 years.
Analytics (only with your consent)
If you allow Analytics, we use Google Analytics 4 to see which pages are visited and what to improve. Google sets cookies that give your browser a random id, and receives the pages you view, the events on them (such as a form being sent), your device type and an approximate location derived from your IP address. Google does not give us your IP address. Google keeps reports for 2 months; the cookies last up to 2 years.
Before you choose, and if you refuse, Google's analytics code isn't loaded, so nothing about your visit is sent to Google. Once you allow Analytics, we pass your choice to Google through Google Consent Mode.
Marketing (only with your consent)
We don't use any marketing tools yet. We plan to add the tools below. When we do, they will load only after you allow Marketing, we will update this notice and the Cookie policy, and you will be asked again:
| Tool | Provider | Status |
|---|---|---|
| Meta Pixel | Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Planned, not in use yet |
| Google Ads | Google Ireland Ltd. / Google LLC | Planned, not in use yet |
| LinkedIn Insight Tag | LinkedIn Ireland Unlimited Company | Planned, not in use yet |
These tools measure whether our ads lead to visits and enquiries and can show you our ads on other sites. They set cookies or similar ids and send the provider the pages you visit and the actions you take. The providers may combine this with what they already know about you, under their own privacy policies.
Contact form
When you send the contact form we receive your name, email address, the service you are interested in and your message, plus anything optional you add: phone or WhatsApp number, company, budget and timeline. We also process your IP address briefly to stop abuse (a limit on how many messages one connection can send).
We use these details only to answer your request and, if you want, to prepare an offer. We don't use them for newsletters or advertising. The message is stored in our database and a copy is emailed to us through Amazon SES and received in our Google Workspace mailbox. We keep it for 2 years after it arrives, and a privacy request for 3 years; if we work together, the contract's retention applies. Your IP address is used only for that limit and is not stored with your message.
If you message us on WhatsApp, we see your phone number, the name you use on WhatsApp and your messages. We use them only to answer you. We use the WhatsApp Business app on our phone, with no other provider in between. WhatsApp is run by Meta, which processes your messages under its own terms and privacy policy, including outside Türkiye. We keep the conversation in the app until we delete it.
AI chat assistant
If you use the chat assistant on the site, what you type and the assistant's answers are sent to our AI provider, Anthropic PBC (USA), to produce the answers. To find the passages from our public articles that answer your question, your question is also sent to Voyage AI (USA), with the passages that might answer it, so it can rank them. Please don't type sensitive personal data (for example health information) into the chat.
The conversation is kept on our server for 30 days after its last message, then deleted. With it we keep a keyed one-way hash of your IP address, never the address itself, so we can limit how many questions one connection can ask and see which chats came from the same connection. Like every request to the site, the chat's requests are also in our server logs, with your IP address, for up to 30 days. Only GCL's owner and administrators can read stored chats, to look into problems and abuse; each time a chat is opened we record who opened it and when. Nothing about the chat is stored in your browser: it is linked to the site's session cookie, which ends after 2 hours without activity. We also count each answer's size and cost, without its text, to keep within our limits. Anthropic doesn't use what we send to train its models, and keeps it only as long as its commercial terms allow. Voyage AI doesn't train on our data and deletes what we send right after processing.
The legal basis is our legitimate interest in answering your questions (KVKK 5/2-f; GDPR 6(1)(f)), or steps before a contract when you ask about our services (5/2-c; 6(1)(b)).
In the Hub
The Hub is open only to people we invite: our team and the people at our clients who work with us.
Invitations
To invite you, an administrator enters your email address, the role you will have, the language of the invitation and, for project work, the projects and spaces you will see. We email you a link that works once and expires after 7 days. We keep the invitation record (email, role, language, who invited you, when it expires, and whether it was accepted or revoked) while your account exists. If an invitation is revoked or expires without being accepted, it is deleted 90 days after. We process your email before you have an account because your organisation or our team asked us to give you access (legitimate interest, KVKK 5/2-f; GDPR 6(1)(f)); we got it from the person who invited you.
Your account
Your account holds your first and last name, email address, role, preferred language, profile photo (if any), when you were last active (updated at most every 5 minutes) and whether two-factor authentication is on. It also holds what we need for secure sign-in: a hashed password (we never see the password itself), and, if you set up two-factor authentication, its secret and recovery codes, stored encrypted.
Other people in the Hub see your name, photo and role where it matters: administrators on the Team page, and people in the same projects next to the work you do.
When someone leaves, their account is deactivated: they can no longer sign in, their sessions end and their connected apps are disconnected. The account and the work linked to it stay so that project history stays correct. 12 months after an account is deactivated we schedule it for anonymisation, tell the person by email, and anonymise it 30 days later: their name, email, photo and sign-in data are removed and their work shows as "Former member". If you ask us to erase your account, we check who is asking, deactivate the account and anonymise it 30 days later.
Signing in with Google
If you sign in with Google, Google tells us your Google account id, name, verified email address and your Google Workspace domain, and the first time, your profile photo. We only accept Google Workspace accounts that match someone we invited. Google processes your sign-in under its own privacy policy. We keep the Google id with your account so we can recognise you next time.
Profile photo
You can upload a photo, or the first time you sign in with Google we copy your Google photo (only if you have none and never removed one). We crop it, remove its metadata (such as location) and store it in three small sizes. Anyone who has the photo's web address can open it, so it is not secret, though the address is not published anywhere outside the Hub. When you remove or replace a photo we delete the files; copies remain in our storage's version history for up to 30 days. Photos are optional.
Sessions, cookies and two-factor authentication
The Hub uses only strictly necessary cookies: a session cookie that ends after 2 hours without activity, a security cookie against cross-site request forgery, and, if you choose "Keep me signed in", a cookie that keeps you signed in for 30 days. Session data is kept on our server in memory storage until the session ends. The Hub loads no analytics or advertising tools.
Security log
For each security-relevant event (signing in or out, a failed sign-in, password and two-factor changes, invitations, role changes, deactivation, connecting or disconnecting an app, changing your photo) we write a log line with your user id, the event, the IP address it came from and the time. For a failed sign-in we log a one-way hash of the email entered, not the email. We keep these logs for up to 30 days to detect and investigate misuse.
Connected AI apps
You can connect an AI app such as Claude or ChatGPT to the Hub. We then store the app's name and web address, when you first authorised it, and access tokens that expire after 1 day (refresh tokens after 30 days). You can see and disconnect these apps in My account at any time. When you use such an app, the information you ask it to read from the Hub goes to that app's provider under your own agreement with it; we are not responsible for how that provider handles it.
Project work
When you work on a project in the Hub, we store what you and others create there: work items with their fields, descriptions, checklists and links, comments and mentions, attached files, documentation pages, and a history of who changed what and when. We use it to run the project, to notify people who follow an item or are mentioned or assigned (in the Hub and by email; you can turn email off in My account), and to keep a record of the work. Items marked Internal are seen only by our team.
Deleted items, pages and comments stay in the project's trash for 30 days and are then deleted with their files. A deleted knowledge base article stays in the knowledge base's Trash for 30 days in the same way. A deleted file stays in our storage's version history for 30 more days, so it is fully gone up to 60 days after it was deleted. When a file is removed from an item or article that is kept, the file is deleted in the same way, but its name and who added it stay with the item or article until that is deleted. How long project data is kept after a project or the contract with the client ends, and whether it can be exported first, is set in the client's contract.
Some of these features are being added in stages; this notice describes them as they become available.
Hub AI chat
People in the Hub can ask the Hub's AI assistant questions. A chat holds your questions, any files you attach and the answers, and only you can read it. To produce the answers, your question, the relevant passages from pages you are allowed to open and your attached files are sent to our AI provider, Anthropic PBC (USA). To find those passages, your question is also sent to Voyage AI (USA), with the passages that might answer it, so it can rank them.
A chat is deleted 12 months after its last message, and you can delete any chat at once. When an account is anonymised, its chats and their files are deleted. We count each answer's size and cost, without its text, for 13 months to keep within our budget. Anthropic doesn't use what we send to train its models, and keeps it only as long as its commercial terms allow. Voyage AI doesn't train on our data and deletes what we send right after processing.
AI features in projects and the knowledge base
If a documentation page or a knowledge base article has "AI can use this" switched on (it is on unless someone turns it off), its text and attached files are split into passages and stored with a numeric representation (an embedding) in our own database, so the Hub's AI assistant can answer questions from them. The embeddings are created by Voyage AI (USA). Answers only use pages the person asking is allowed to open. Switching "AI can use this" off removes the page from the AI index.
AI answers can be wrong. They are suggestions, not decisions: nothing in the Hub makes a decision about you by automated means alone.
Invoices
If your organisation is our client, we record the invoices we issue to it in the Hub: the bill-to name, the invoice details and its official PDF, and the payments made. The client's owners in the Hub can see their invoices and get an email when one is added. Invoices are kept for 10 years from the issue date, for our accounting and tax duties, and are not changed when a person's account is anonymised.
Emails from the Hub
We send invitations, password resets and notifications from our no-reply address through Amazon Simple Email Service. The email address and the message pass through Amazon's servers in the United States.
Who receives your data
We don't sell personal data. We share it only as described here:
| Recipient | What for | Where |
|---|---|---|
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. | Hosting of the site and Hub (servers, database, files, backups, logs) | Frankfurt, Germany (eu-central-1) |
| Amazon CloudFront (AWS) | Delivering pages and files quickly and securely | AWS edge locations worldwide, near you |
| Amazon Simple Email Service (AWS) | Sending Hub emails and contact-form copies | USA (us-east-1) |
| Google (Google Ireland Ltd. / Google LLC) | Google sign-in; Google Analytics 4 with your consent; Google Ads with your consent (planned); Google Workspace (our email) | EU and USA |
| Meta (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) | WhatsApp; Meta Pixel with your consent (planned) | EU and USA |
| LinkedIn Ireland Unlimited Company | LinkedIn Insight Tag with your consent (planned) | EU and USA |
| Anthropic PBC | Answers from the AI chat on the site and in the Hub | USA |
| Voyage AI | Finding the passages the AI answers use (embeddings and ranking) | USA |
| Other Hub users | Your name, photo and your work in shared projects | Wherever they work |
| Public authorities and courts | Only when the law requires it | Türkiye |
AWS, Amazon SES, Anthropic and Voyage AI process data on our behalf and only on our instructions (data processors). For Google sign-in, WhatsApp and the advertising tools, Google, Meta and LinkedIn also decide for themselves how they use the data, under their own privacy policies.
Transfers outside Türkiye and the EU
Our servers are in Germany, and some providers above are in the United States or work worldwide. So your data is transferred outside Türkiye.
Under KVKK (article 9): your data goes abroad to the providers in "Who receives your data": Amazon Web Services (Germany; Amazon SES in the USA; CloudFront near you), Google (EU and USA), Meta for WhatsApp (EU and USA), Anthropic PBC (USA) and Voyage AI (USA). We don't rely on your explicit consent for any of these transfers.
Under the GDPR: when we pass EU data to providers in the United States, we rely on the provider's certification under the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. You can ask us which of the two applies to a provider (see "How to use your rights").
How we collect your data
- Automatically, from your browser and device when you use the site or Hub (logs, cookies, the tools you allow).
- From you, when you fill in a form, message us, use a chat assistant, accept an invitation or work in the Hub.
- From others: from the person who invited you to the Hub; from Google when you sign in with Google; from other Hub users who mention you, assign work to you or write about you in a project.
We collect it electronically, through the site, the Hub, email and WhatsApp.
How we protect your data
Traffic is encrypted (HTTPS). Our servers accept connections only through our content delivery network and have no open remote-login port. Passwords are hashed and two-factor secrets are encrypted. Access in the Hub follows roles and projects, so each person sees only what they are allowed to see. Files are stored privately except profile photos. We keep database backups for 30 days, and for up to 30 more days in the backup store's version history, so we can recover from faults.
How long we keep your data
We keep data only as long as the purpose needs, or longer only when the law requires it or to establish or defend a legal claim, then we delete, destroy or anonymise it. The periods are in the summary and the sections above. After data is deleted for good, copies can remain in storage version history for up to 30 days and in database backups for up to 60 days before they are gone.
Your rights
Under KVKK (article 11) you can ask us to:
- tell you whether we process your personal data, and if so, give you information about it;
- tell you why we process it and whether we use it for that purpose;
- tell you who we transfer it to, in Türkiye or abroad;
- correct it if it is incomplete or wrong, and tell those we transferred it to;
- delete or destroy it when the reasons for processing it no longer exist (article 7), and tell those we transferred it to;
- object to a result that is against you and comes only from automated analysis of your data;
- compensate you if you suffer damage because we processed your data unlawfully.
Under the GDPR you can also ask for access, correction, deletion, restriction of processing and a copy of data you gave us in a portable format; object to processing based on our legitimate interests; and withdraw your consent at any time (for cookies, with Cookie settings). Withdrawing consent doesn't affect what we did before.
You don't have to give us your data, but without the details a form or the Hub needs, we can't answer you or give you an account.
How to use your rights
You can send your request in either of these ways:
- Online: through our contact form, choosing Privacy request (your personal data) under "What do you need?". We email you a receipt with the date we received it.
- By post: a signed letter to our address in "Who is responsible for your data".
Online, tell us your name, your email address and what you are asking for. We don't ask for an ID number on the form: if we need to confirm who you are, we ask in our reply. By post, include what the communiqué requires: your name, signature, Turkish ID number (or, for foreign nationals, nationality and passport or ID number), address and request. We keep a record of each privacy request for 3 years to show we answered it. We answer within 30 days, free of charge unless the request needs significant cost, in which case we may charge the fee set by the Personal Data Protection Board.
If you are not satisfied with our answer, or we don't answer within 30 days, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr) within 30 days of our answer, and in any case within 60 days of your request. If you are in the EU, you can also complain to the data protection authority where you live or work.
Children
The site and the Hub are meant for businesses and adults. We don't knowingly collect data from children under 16.
Changes to this notice
If we change this notice in a way that matters, we update the date at the top and, for Hub users, tell you in the Hub or by email before the change applies.
