Privacy Notice On The Protection Of Personal Data
Last updated: 26 October 2026
This notice has been prepared under Article 10 of the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, to inform people who request a free pre-scan through querahq.com, who contact us, or who use our services.
1. Data Controller
Data controller: [Company name] ("Quera")
Address: [Company address]
MERSIS No: [MERSIS number]
Email: hello@querahq.com
2. Personal Data We Process
| Data Category | Data |
|---|---|
| Contact | Your email address and phone number |
| Business information | Business name and website address (these are not personal data if they do not belong to a natural person; for a sole proprietorship they may be personal data) |
| Transaction security | An irreversibly summarised (hashed) form of your IP address, the time the form was submitted, the result of the automated bot check |
| Consent records | A date and time record showing that you read this notice and, where applicable, of your consent to commercial messages |
| Service data | The measurements we take from the publicly available pages of your site, and the report sent to you |
We do not store your IP address in its raw form; we keep only its summary, used to count daily attempts to prevent abuse, for 24 hours.
3. Purposes Of Processing
We process your personal data for the following purposes:
- To carry out the free pre-scan you request and send the report to your email address.
- To verify that the email address belongs to you (confirmation link).
- To answer your questions about the report and, if you ask, to prepare a quote for our packages.
- If you have bought the monthly report or full service, to establish and perform the contract.
- To prevent abuse of the form by automated software, repeated scanning of the same site within a short time, and attempts that compromise system security.
- To fulfil our legal obligations and protect our rights in any dispute.
4. Legal Grounds And Method Of Collection
We collect your data through the form on our website, by your entering it electronically, and by automated means. The legal grounds we rely on (KVKK Art. 5/2):
- Meeting your pre-scan request and the service contract: being directly related to the establishment or performance of a contract (Art. 5/2-c).
- Security, prevention of abuse and keeping consent records: our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f), and legal obligation (Art. 5/2-ç).
- Evidence in case of a dispute: the establishment, exercise or protection of a right (Art. 5/2-e).
To send you commercial electronic messages such as campaigns, newsletters or offers, we additionally rely on the optional consent you give under Law No. 6563. You can use the pre-scan service without giving this consent.
5. Transfers
We do not sell your personal data or share it for advertising. To provide the service, we share only the data that is needed, with the service providers below, acting as data processors, and only to the extent necessary:
| Recipient | For What | Which Data |
|---|---|---|
| Cloudflare, Inc. (USA) | The server the form runs on, bot verification, temporary storage of the request | Email, phone, business name, website, IP summary |
| Email delivery provider (Resend, Inc. (USA)) | Delivering the confirmation link and the report to your email | Email address, report content |
| GitHub, Inc. (USA) | The infrastructure the scan runs on | Only the website address and business name; your email and phone number are never sent here |
These providers' servers are abroad. We carry out transfers abroad under KVKK Art. 9, within the framework of the standard contracts announced by the Personal Data Protection Board and the appropriate safeguards offered by the providers. Upon request, we may share data with authorised public institutions and bodies to the extent they are legally authorised.
6. Retention Periods
- Unconfirmed pre-scan requests: deleted automatically within 24 hours.
- Requests that hit the daily scan limit and are kept so that we can call you back: 45 days.
- Your pre-scan request and contact details: 12 months from our last contact; if you become our customer, for the term of the contract and then for the statutory retention periods.
- Records of consent to and refusal of commercial messages: 3 years from the withdrawal of consent, as required by the relevant legislation.
- IP summary: 24 hours.
When the period ends, we delete, destroy or anonymise the data.
7. Your Rights
Under KVKK Art. 11, you may apply to us to:
- Learn whether your personal data is processed and, if so, request information about it
- Learn the purpose of processing and whether it is used in line with that purpose
- Know the third parties in Turkey or abroad to whom it is transferred
- Ask for it to be corrected if it is incomplete or inaccurate
- Ask for it to be deleted or destroyed under the conditions in KVKK Art. 7
- Ask for corrections and deletions to be notified to the third parties to whom it was transferred
- Object to an outcome against you arising from analysis exclusively by automated systems
- Claim compensation if you suffer damage because of unlawful processing
You can send your application in writing to hello@querahq.com, with enough information for us to verify your identity. We resolve your application free of charge within 30 days at the latest. If you no longer want commercial messages, you can use the "unsubscribe" link in every message we send, or write to us.