Privacy Policy

Last updated: 11 September 2026

This page explains what personal data u2aistudio.com collects, why, on what legal basis, where it is kept and for how long. The site has two forms — a contact form and a career application form — and nothing else on it collects data about you: there is no account, no sign-in, no payment, no advertising network and no profiling.

1. Scope and data controller

This notice covers u2aistudio.com and its subdomains, together with the two forms published on the site. It is written to meet the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies, the GDPR. The data controller is:

Trade name: U2 AI Studio Teknoloji Anonim Şirketi
Registered office: Ahi Evran OSB Mah. Erkunt Cad. No: 3 Door No: 41, Sincan / Ankara, Türkiye
MERSİS: 0883124471000001 · Ankara Trade Registry: 434199 · Tax office / number: Sincan / 8831244710
E-mail: [email protected] · Registered e-mail (KEP): [email protected]
Telephone: +90 850 346 82 82 · +1 415 712 78 82

Two companion texts sit next to this one and say the same things in more detail for their own subject: the KVKK disclosure text and the Cookie Policy.

2. What we collect, why, and for how long

We collect what a form field asks for, plus the small amount of technical data needed to deliver and protect the site. The table below is the whole picture — there is nothing collected outside it.

Data	Purpose	Legal basis	Retention
Contact form — name, e-mail, company, subject, message	Answering your message and conducting the correspondence it starts	KVKK Art. 5/2-c and 5/2-f; GDPR Art. 6(1)(b) and 6(1)(f)	24 months after the last message exchanged about your request
Career application form — name, e-mail, telephone, area of interest, message, CV as a PDF file of at most 5 MB	Evaluating your application for an open or upcoming role	KVKK Art. 5/2-c and 5/2-f; GDPR Art. 6(1)(b) and 6(1)(f)	12 months from the application; longer only if you ask us in writing. If you join us, the file moves into your employee record and follows employment-law retention
Technical and anti-spam data — the page a form was sent from, the moment the form was opened, and the connection data (including IP address) processed by our infrastructure provider while serving the site	Blocking automated submissions, site security, fault diagnosis	KVKK Art. 5/2-f; GDPR Art. 6(1)(f)	12 months at most

At the end of the retention period the record is deleted from the database and the related notification e-mail is deleted with it. No decision about you is taken by automated means, and we do not build profiles or scores from form data.

Please do not put special categories of personal data — health, religious or philosophical belief, biometric or genetic data, criminal records, trade union membership — into your message or your CV. If such data reaches us anyway, we delete it instead of processing it further.

3. We do not ask for consent, and what the checkbox means

Answering a message you sent us, and evaluating an application you submitted, are processing activities that KVKK Art. 5/2 permits without consent: they are directly related to the establishment or performance of a relationship you initiated (Art. 5/2-c) and to our legitimate interest in responding to it (Art. 5/2-f). Asking for consent where another legal basis already exists would misstate the basis, so we do not ask for it.

The checkbox on the forms is therefore a confirmation that you have read this notice before sending, not a consent declaration. You do not need to withdraw anything to stop the processing; you can simply ask us to delete the record (see section 8).

Sending a form does not add you to any mailing list, and we do not send commercial electronic messages to the addresses collected through these forms. If we ever offer a newsletter, it will be a separate opt-in with prior consent under Art. 6 of Law No. 6563.

4. Where the data is kept and who sees it

When you submit a form, the record is written to a Cloudflare D1 database and a notification e-mail is sent to [email protected]. Contact requests are read by the business unit that can answer them; applications are read by the people running the hiring process. Access is limited by role, and no one outside that need sees the record.

The parties involved are:

Cloudflare — hosting, content delivery, security, and the D1 database that holds the form records; servers may be located outside Türkiye.
Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — serving font files. No cookie is set for this site, but your IP address and browser information are processed by Google when the font is requested, and that request may be served from the United States.
Cloudflare Web Analytics (static.cloudflareinsights.com) — aggregate visit statistics. It sets no cookie, stores no identifier in your browser and does not follow you across sites or sessions; it records the page viewed, the referrer, browser and device type, and country. Legal basis: KVKK Art. 5/2-f.
Our corporate e-mail provider — delivering the notification message.
Our legal and financial advisers, and authorised public authorities where the law requires disclosure.

We do not sell, rent or trade personal data, and we do not share it for anyone else's marketing.

5. Transfers abroad

The infrastructure that serves this site is global, so form records and technical data may be stored or processed outside Türkiye. Such transfers are made within the framework permitted by KVKK Art. 9 and in line with the decisions of the Personal Data Protection Board; where the GDPR applies, they rely on the transfer mechanisms of its Chapter V.

One transfer is under your own control: if you would rather your browser did not contact Google Fonts, blocking that domain leaves the site fully readable — it only changes the typeface.

6. Cookies and local storage

This site sets no cookies of its own. Your language is taken from the address you are on (/ and /en/), not from a cookie, and because there is no account or sign-in, no session cookie is created. There is no analytics cookie, no advertising cookie, no ad network, no social tracking pixel, no heat map and no embedded video.

When you dismiss the cookie notice, that choice is written to your browser's local storage under the key u2-cookie-consent. It stays on your device, it is not a cookie and it is never sent to us.

Cloudflare, as the infrastructure provider, may set technical cookies for security and bot protection. These are strictly necessary for delivering the service and are not used for advertising or profiling. Details are in the Cookie Policy.

7. Security

The site is served over HTTPS/TLS, so form contents travel encrypted. Records are kept in our infrastructure provider's managed database; access follows least privilege and is limited to named staff. Attachments are accepted only as PDF and only up to 5 MB, and the forms carry a timing check that filters automated submissions.

No system can be made completely secure, and we do not claim any certification or accreditation that we do not hold. If a breach occurs that is likely to create a risk for you, we notify the Personal Data Protection Board and the affected individuals in accordance with KVKK Art. 12/5, and Arts. 33-34 of the GDPR where it applies.

8. Your rights and how to use them

Under KVKK Art. 11 you may:

learn whether your personal data is being processed;
request information about it if it has been processed;
learn the purpose of the processing and whether the data is used in line with that purpose;
know the third parties in Türkiye or abroad to whom it has been transferred;
ask for it to be corrected if it is incomplete or inaccurate;
ask for it to be erased or destroyed once the conditions are met;
ask that correction, erasure or destruction be notified to the third parties the data was transferred to;
object to a result produced solely by automated analysis (we produce none on this site);
claim compensation for damage suffered because of unlawful processing.

Where the GDPR applies you also have the rights of access, rectification, erasure, restriction of processing, objection and data portability, and the right to lodge a complaint with your supervisory authority.

Under Art. 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your request in writing, to our registered e-mail (KEP) address, with a secure electronic signature or mobile signature, or from an e-mail address you have previously given us and that is registered in our systems. We conclude the request as soon as possible and within thirty days at the latest, free of charge; if the operation entails a cost, the fee in the Board's tariff may be charged (KVKK Art. 13). If your request is refused, the answer is insufficient, or no answer arrives in time, you may complain to the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of the application (KVKK Art. 14).

9. Children

This site, its forms and our services are not directed at people under 18, and we do not knowingly collect their personal data. If you believe a person under 18 has sent us data through a form, write to [email protected] and we will delete the record.

10. Changes to this notice

We update this page when the site changes — for example when a form, a field or a service provider changes. Updates take effect prospectively from the date they are published here; they do not retroactively alter the basis on which data already collected has been processed. Material changes are also announced on the homepage. If a change ever required your consent, we would ask for it separately rather than infer it from your continued use of the site.

11. Contact

For privacy questions and for requests under KVKK Art. 11: [email protected] · KEP [email protected] · +90 850 346 82 82 · +1 415 712 78 82 · Ahi Evran OSB Mah. Erkunt Cad. No: 3 Door No: 41, Sincan / Ankara, Türkiye.