Privacy Policy

1. Data controller

Your personal data is processed by Ahmet Tekeci (sole proprietorship), the developer of Kora, acting as the data controller.

2. Data we process and why

• Sign-up form: the work email address you enter in the form on the home page. It is used to respond to your request and to contact you about trying Kora. The address is sent as an email to info@kora.menu; the website does not store it in a database.
• Account: the first name, last name, business name (optional), email address and password you enter when signing up on app.kora.menu. They are used to create your account, review your sign-up, send you a sign-in link once it is approved, verify your identity when you sign in and send password reset links. For the review, your name, business name and email address are also sent as an email to info@kora.menu; the password is not. They are kept in the account database on the server; the password is stored only in irreversible form (a bcrypt hash). The account is kept until you ask for it to be deleted.
• Session and password reset: when you sign in, your session is kept with the kora_session cookie; it ends after one day, or after 30 days if you chose “Remember me”. A password reset link is valid for 60 minutes and works once.
• Abuse prevention: to stop the forms and sign-in attempts from being sent many times in a short period, irreversible hashes of your IP address and of the email address tried are kept on the server; sign-up form counters are deleted after about one hour, account counters after about one day.
• Server logs: for every request to the website, the IP address, date and time, requested page, response code, amount of data transferred, referring page and browser information are written to the server logs. These logs are used for security and troubleshooting. Log files are archived when they reach a set size, and archives are deleted after 10 days.
• Visit statistics: the pages run the Cloudflare Web Analytics script. It sends Cloudflare the page viewed, the referring page, browser and device type, country and measurements of how fast the page loads. It does not use cookies or browser storage. We only see this data as aggregate statistics and do not use it to identify individual visitors.
• Language preference: when you choose Turkish or English in the language menu, your choice is stored in your browser for one year in a cookie named kora_lang.

3. How data is collected and legal grounds

Your data is collected electronically and automatically while you use the website and submit the forms.

• The email address in the sign-up form, the account details and the session cookie are processed because they are directly related to entering into and performing a contract at your request (KVKK Art. 5/2-c) and on the basis of our legitimate interest (Art. 5/2-f).
• The IP and email hashes and server logs are processed on the basis of our legitimate interest in keeping the website and accounts secure (Art. 5/2-f).
• Visit statistics are processed on the basis of our legitimate interest in measuring how the website is used and how fast it is, in order to improve it (Art. 5/2-f).
• The language cookie is used only to remember the language you chose, on the basis of our legitimate interest (Art. 5/2-f).

4. Cookies

The website uses two cookies. kora_lang is created only when you make a choice in the language menu and is used for nothing other than remembering your preferred language. kora_session is created only when you sign in on app.kora.menu, is required to keep you signed in and is deleted when you sign out. No analytics, advertising or tracking cookies are used. The cookieless Cloudflare Web Analytics script runs for visit statistics (see section 2); there is no third-party code for advertising or tracking.

5. Transfers and service providers

Your personal data is not sold and is not shared with third parties for marketing. The following service providers are used to run the website; they process data to provide their service:

• Cloudflare, Inc. (USA): website traffic passes through Cloudflare for content delivery and security, during which IP addresses and request details are processed. Visit statistics are also processed by Cloudflare through Cloudflare Web Analytics.
• Hostinger: provider of the virtual server that runs the website, the app.kora.menu pages, the sign-up form and the account database.
• Dynadot (USA): email service hosting the info@kora.menu mailbox.

Because some of these providers are located abroad, your data may be transferred abroad within the scope of Article 9 of KVKK. Data may also be shared with public authorities that are legally entitled to request it, only to the extent required.

6. Your rights

Under Article 11 of KVKK, you may apply to the data controller to:

• learn whether your personal data is processed,
• request information about the processing,
• learn the purpose of the processing and whether the data is used accordingly,
• know the third parties in Türkiye or abroad to whom your data is transferred,
• request correction of incomplete or inaccurate data,
• request erasure or destruction of your data under the conditions of Article 7 of KVKK,
• request that correction, erasure or destruction be notified to the third parties to whom your data was transferred,
• object to a result against you arising exclusively from automated analysis,
• claim compensation for damage caused by unlawful processing.

You can send your request by email to info@kora.menu or in writing to Yayla Mah. Vatan Cad. No: 40/3 İç Kapı No: 26, Tuzla / İstanbul. Requests are answered free of charge within 30 days at the latest; if the request involves an additional cost, the fee set by the Turkish Personal Data Protection Board may apply.

7. Security

Your connection to the website is encrypted with HTTPS. The account database, form settings and counters are kept outside the public web directory. Passwords are never stored in plain text.

8. Changes

This policy is updated when the website or its data processing changes. The current version is always on this page.