Translation notice
This English translation is provided for convenience. If there is any inconsistency, the Turkish text prevails.
A. Privacy Policy
Caliper processes only the data needed to assess requests, provide account and project services, administer payments and invoices, secure the service and comply with legal duties. The site uses HTTPS. Essential session and security records may be used to operate and protect the service. Google Analytics loads only after a visitor allows analytics and is limited to page-visit measurement; advertising storage, advertising user data and ad personalisation remain disabled. Details appear in the Cookie Policy. Card numbers, expiry dates and security codes are handled in iyzico's secure environment and are not stored by Caliper.
B. KVKK Information Notice
The following notice covers visitors, applicants, members, clients, client representatives and project-portal users.
1. Data controller
Caliper Yazılım Çözümleri Anonim Şirketi (“Caliper”), at Zühtüpaşa Mah. Şefikbey Sk. No: 3, Kadıköy / Istanbul, Türkiye, is the data controller. Contact: info@caliperiq.com, phone +90 533 399 34 41.
2. Data categories and collection
Depending on the interaction, Caliper may process identity, contact, client-transaction, finance, transaction-security and legal records collected through website forms, account and portal actions, support messages, payment/invoicing processes and technical security logs. If analytics is allowed, limited usage data such as the page visited, session information, approximate location, browser and device type may also be processed through Google Analytics. Please do not submit sensitive personal data through general forms.
3. Purposes
Identity and contact data are used to respond and administer the relationship; client records to manage proposals, contracts, projects and support; finance records to administer payment requests, collections, refunds and invoices; security records to protect accounts and investigate errors; and legal records to comply with duties and establish, exercise or defend rights.
4. Legal grounds
Processing relies, as applicable, on contract formation or performance, legal obligation, establishment or protection of a right, and Caliper's legitimate interests without prejudicing fundamental rights under Article 5 of the KVKK. Consent is requested separately only where the law requires it.
5. Recipients and purposes
Data may be shared on a need-to-know basis with authorised Caliper personnel, competent authorities, professional advisers, and providers used for database/authentication (Supabase), hosting (Vercel), transactional email (Resend), secure payments (iyzico), consented page-visit measurement (Google Ireland Limited / Google Analytics) and authorised accounting or e-invoice services (Paraşüt, Türkiye). For a product bought on the payment centre (e.g. Ludimora), only that product's system receives the order result, the record of the accepted sales documents and the card matching code. Caliper does not send form identity/contact data, card details or payment amounts to Google Analytics and does not receive or store full card credentials.
6. International transfers
To run the service, personal data is transferred to these providers abroad: Vercel Inc. (US company; server processing in Frankfurt, Germany), Supabase Inc. (US company; database in Frankfurt, Germany), Resend Inc. (US company; transactional e-mail content, delivery logs and account records in the US; sending region currently Japan, being moved to the European Union) and, only if you allow analytics, Google Ireland Limited (Ireland). These transfers are regular. The Board's standard contract for transfers to these providers was requested on 22 October 2026; until it is signed and notified to the Authority, the safeguard required by Article 9 of the Law is not in place. During this period the company minimises the data transferred (for example, e-mails contain no address or tax/ID number) and replaces any provider with which the contract cannot be concluded; a move of transactional e-mail to a provider keeping data in Türkiye is being prepared. This section is updated as the status changes. iyzico and Paraşüt are companies established in Türkiye.
6a. Repeated withdrawal check on the payment centre
When a payment is completed on the payment centre (odeme.caliperiq.com), a one-way card matching code is generated from the first 6–8 and last 4 digits reported by the payment institution, using a separate secret key for each product; the card number and first digits are not stored. The code, the last four digits and the card family are personal data. Separately from invoicing, they are used to detect repeated withdrawals and refunds by the same person in a short period and so prevent abuse; the legal ground is KVKK art. 5(2)(f) (legitimate interest), weighed against the data subject's fundamental rights. The code is sent only to the product bought, does not match across products and is deleted 12 months after the payment. For the same purpose, on real orders that end in a withdrawal, a one-way person summary is generated from your identity details: from your Turkish ID number if you gave one, otherwise from your e-mail address, name and the last four card digits; it is separate for each product and kept for at most 12 months after the last withdrawal. Exercising the right of withdrawal is not abuse in itself; two or more withdrawals within 12 months are only a flag, never an automatic refusal of sale, and are reviewed by a person. You can object to the outcome at info@caliperiq.com and the objection is reviewed again by a person.
7. Retention and security
Records are kept only for the purpose and applicable statutory retention or limitation periods, then deleted, destroyed or anonymised. Invoices and other tax documents are kept for 5 years from the calendar year following the year they relate to (Tax Procedure Law no. 213, art. 253); commercial books and documents are kept for 10 years (Turkish Commercial Code no. 6102, art. 82). Acceptances of sales documents linked to an order are kept for 10 years with restricted access; notice and membership-agreement acceptance records not linked to an order are destroyed 3 years after the account is deleted. Records that remain after account deletion are detached from your identity but are still personal data, accessible only to authorised staff for legal retention. Meeting requests that did not become a project are kept for 1 year; project messages, updates, stages and the project summary for 3 years after the project ends (the project name and linked payment/invoice records are kept as financial records for 10 years); notifications for 1 year if read and 2 years if unread; audit logs for 2 years. The payment centre's card matching code is deleted 12 months after the payment, and a repeated-withdrawal flag 12 months after the last withdrawal. When an account is deleted, non-financial records are deleted or detached from the person; expired records are destroyed by a daily job. Access control, secure transport, logging and backup measures are applied in proportion to risk.
8. Your rights and requests
You may exercise the rights in Article 11 of the KVKK, including access, correction, deletion where applicable, information about recipients, objection to solely automated adverse results and compensation for unlawful processing. Send an identifiable request to info@caliperiq.com or the registered address above. Requests are handled under the statutory procedure and time limits.
9. Notice and consent
Viewing or acknowledging this notice is not consent. Where consent is required, it is requested separately, for a specified purpose and without combining it with this notice.
10. Updates
The current version and date are published here. Material changes are communicated through an appropriate channel.