Legal

KVKK Disclosure Notice

Last updated: 23 May 2026

1. Data controller

Under Law No. 6698 on the Protection of Personal Data (“KVKK”), Mindie acts as the data controller operating the YourPT platform. Contact: [email protected].

2. Personal data processed

• Identity & contact: full name, email, phone (optional), WhatsApp number (for trainers).
• Account security: password hashed with argon2id, session token, IP address (for rate limiting, ≤ 30 days).
• Profile content: trainer/studio bio, certifications, packages, location, photos, transformation stories.
• Transaction data: leads left by clients, class bookings, review data.
• Cookies: session + language + consent preference (see the Cookie Policy).

3. Purposes of processing

• Providing the YourPT service (profile, leads, bookings)
• Account security and abuse prevention
• Sending transactional emails (signup confirmation, password reset, lead notifications, etc.)
• Statistics and product improvement (aggregated)
• Fulfilling legal obligations (invoices, tax)

4. Legal grounds (KVKK art. 5)

• Formation and performance of a contract
• Legitimate interest (abuse prevention, basic analytics)
• Explicit consent (marketing, optional cookies)
• Required by law (tax, commercial retention)

5. Transfers

Personal data is shared with the following sub-processors to deliver the service. It is not transferred to third parties for advertising or sale.

• Cloudflare R2 — file storage
• Larksuite SMTP — email delivery
• Polar.sh — payment processing (billing fields only)
• OpenRouter — AI assistant requests (not stored long-term)
• Sentry / Plausible / PostHog (if enabled) — anonymized telemetry

6. Retention periods

Account data is kept until the account is deleted. System logs are kept for at most 30 days, backups on a rolling 30-day window. Data subject to a legal retention obligation is kept per the relevant legislation.

7. Rights of the data subject (KVKK art. 11)

The data subject has the right to learn whether their personal data is processed, to request information if it is, to learn the purpose of processing and whether it is used accordingly, to request correction or deletion, and to exercise all rights under KVKK art. 11. To apply: [email protected].

8. Transfers abroad

Some sub-processors (R2, OpenRouter) may process data in regions outside the EU. Transfers are made with appropriate safeguards under KVKK art. 9.

9. Security

Passwords are hashed with argon2id, all traffic is carried over TLS, and only the operator can access production data. In the event of a personal-data breach, affected users are notified within 72 hours.

10. Changes

When there is a material change to this notice, users are notified by email. The date above always reflects the current version.