Private context should stay attached to a clear purpose.

The form prepares an email; it does not submit or store your answers.

Yağız Oğuz, operating as Getyear from Istanbul, Türkiye, is the data controller for personal data that Getyear receives for project inquiries. The direct privacy contact is hello@getyear.app.

Personal data is collected electronically in two distinct ways: ordinary website-request data passes through the hosting and security infrastructure when a page is opened, and project details reach Getyear only when you choose to send them from your own email application.

Typing in the project-brief fields or choosing Prepare email brief does not post the answers to a Getyear API or store them in the site's database. The page creates a mailto draft in your browser. Getyear receives the details only after you review the draft and press send in your email application. Your browser or email application may retain inputs or drafts under its own settings and policies.

Only necessary information should be used for a defined operational purpose.

An email draft can contain the name, work email, company or product, selected service, product stage, timing, budget band, desired outcome, optional material URL and the page source label you deliberately choose to send. Getyear uses a sent email to assess fit, understand the requested decision, reply, discuss a proposal and, if both sides proceed, establish or perform the engagement.

Ordinary hosting and security data may include a network identifier such as an IP address, request headers, requested path, timestamp and abuse or security signals. It is used to deliver the site, maintain availability, diagnose faults and prevent misuse—not to create advertising profiles.

The operational legal ground for details sent to request an assessment, proposal or engagement is KVKK Article 5(2)(c), where processing is necessary for establishing or performing a contract directly connected with the parties. The operational legal ground for proportionate hosting and security processing is Article 5(2)(f), where it is necessary for Getyear's legitimate interests without harming the data subject's fundamental rights and freedoms. Applicability and necessity must be assessed for the actual data flow; the form checkbox records that this notice was read and is not presented as blanket consent.

Inquiry purpose

Assess the requested work, reply, prepare a proposal and establish or perform an engagement if both sides proceed.

Security purpose

Deliver and protect the site, preserve availability, diagnose faults and prevent abuse with proportionate infrastructure data.

Each recipient has a limited delivery or security role.

OpenAI Sites and Cloudflare may receive ordinary infrastructure data as hosting and security providers so they can serve, route and protect the site. The email providers used by you and Getyear receive a message only when you send it, so they can route it, screen it for spam or security threats, deliver it and support the reply. Getyear does not sell inquiry information or disclose it for advertising audiences; a further disclosure would be limited to a legal obligation or a necessary professional service subject to an appropriate duty of confidentiality.

These providers may process information outside Türkiye. The Article 9 mechanism that applies to each provider and data flow must be documented rather than assumed. Getyear has not documented a valid routine Article 9 mechanism for stored web-form intake, so the site's database intake and operator inbox are not enabled and project-brief answers are not transmitted to that infrastructure.

A user-initiated email may still be routed through or stored by email providers outside Türkiye, depending on the sender's and recipient's services. This notice does not claim that user initiation alone is a general Article 9 safeguard. Stored form intake will remain disabled unless and until an appropriate Article 9 transfer mechanism and its required process are documented.

Getyear does not retain a project brief that the page never sends.

Before you send an email, the brief remains under your control in the page and email draft. Getyear cannot access or delete information it has not received. Your browser and email application control any local form restoration, history or saved draft under their own retention settings.

After an email reaches Getyear, it may be kept while the request is assessed, answered or used to prepare a proposal. If an engagement proceeds, necessary contract, invoice and legal records follow their applicable retention periods. Getyear does not claim a fixed automatic deletion period for inquiry email, but should delete or anonymize it when the purpose and any applicable legal obligation end. Hosting and email providers may retain security and delivery records under their own documented settings.

You may exercise every applicable data-subject right.

Under KVKK Article 11, you may ask whether your personal data is processed; request information if it is; learn the purpose of processing and whether it is used in accordance with that purpose; and learn the third parties in Türkiye or abroad to whom it has been transferred.

You may request correction of incomplete or inaccurate data; request deletion or destruction under the conditions in Article 7; request that correction, deletion or destruction be notified to third parties to whom the data was transferred; object to a result against you produced by analysis exclusively through automated systems; and demand compensation if you suffer damage because personal data was processed unlawfully. Getyear does not use the project inquiry to make a solely automated adverse decision.

Use one direct address and disclose only what is needed for the request.

Start a privacy request by emailing the data controller at hello@getyear.app with the subject Privacy request. State the right you want to exercise and enough context to locate the relevant email or record; do not resend confidential project material unless it is necessary.

Getyear may ask for proportionate evidence to verify that the requester is the data subject or an authorized representative, and may direct the requester to a formally required application method. Verification information is used only to prevent another person from accessing, changing or deleting your data. The request will be evaluated under the applicable KVKK procedure and any mandatory legal retention obligation.