Privacy & Cookie Policy

1. Data controller

The data controller is WoodstoneStudio. For any question or request about your personal data, write to [email protected].

2. What data we collect

• Contact form: full name, email address, optionally phone number and company name, the service you are interested in and your message. To prevent abuse and spam, your IP address and the submission time are also recorded.
• Email and WhatsApp messages: the contact details and message content you share when you write to us directly.
• Analytics data (only if you consent): usage data that does not directly identify you, such as pages visited, visit duration, device and browser type and approximate location (country/city).
• Technical logs: the hosting infrastructure may keep standard server logs, including IP address and request details, for security and operation.

3. Why we process data and on what legal basis

• To respond to your request, prepare a quote and establish a possible business relationship: GDPR Art. 6(1)(b), KVKK Art. 5/2-c.
• To keep the form and the site secure and prevent spam and abuse: legitimate interest, GDPR Art. 6(1)(f), KVKK Art. 5/2-f.
• To measure and improve how the site is used (Google Analytics): only with your consent, GDPR Art. 6(1)(a), KVKK Art. 5/1. You can withdraw your consent at any time.

4. Cookies

Our site does not set cookies of its own. Your cookie choice is stored in your browser's local storage (under the key "wss-consent"), not as a cookie, and is used only to remember your choice.

Analytics cookies are loaded only if you choose "Accept". If you don't consent, Google Analytics is never loaded and no data is sent to Google.

• _ga — Google Analytics; used to distinguish visitors. Duration: 2 years.
• _ga_<id> — Google Analytics; used to keep session state. Duration: 2 years.

5. Who we share data with

We do not sell your personal data or share it for advertising. It is shared only with the following service providers, and only as far as needed to run the service:

• Vercel Inc. — server infrastructure that receives the contact form.
• Supabase Inc. — database where form requests are stored.
• Email service provider — delivery of new-request notifications and correspondence.
• GitHub Inc. (GitHub Pages) — website hosting.
• Google LLC (Google Analytics) — site usage measurement, only if you consent.
• Competent public authorities where required by law.

6. International transfers

The servers of the providers above may be located outside your country, including in the European Union and the United States, so your data may be transferred internationally. Transfers are made with the safeguards required by the GDPR and KVKK Art. 9 (such as standard contractual clauses); by ticking the consent box on the contact form and accepting analytics cookies you consent to these transfers.

7. Retention

• Form requests and correspondence: up to 2 years if no business relationship is established; otherwise for the period required by applicable law.
• Analytics data: up to 14 months in Google Analytics.
• Your cookie choice: in your browser until you delete or change it.

8. Your rights

Under the GDPR and KVKK Art. 11 you have the right to:

• know whether your personal data is processed and request information about it,
• know the purpose of processing and whether it is used accordingly,
• know the third parties your data is transferred to,
• request rectification, erasure or destruction of incomplete or inaccurate data,
• request data portability and object to processing,
• withdraw your consent at any time,
• claim compensation for damage caused by unlawful processing.

9. How to make a request

Send your request to [email protected]. We respond free of charge within 30 days at the latest. If you are not satisfied with our response, you can lodge a complaint with the data protection authority in your country or with Turkey's Personal Data Protection Authority (KVKK).

10. Changes

We may update this notice when the tools we use or the law change. The current version is always published on this page, with the last-updated date at the top.