Privacy Notice (KVKK)

1. Data Controller

Data Controller: gerekli.tr
Contact: hacettepeliyegerekli@gmail.com

gerekli.tr is an independent platform currently offered as a free student helper tool, providing academic planning and course schedule creation for Hacettepe University students. It is not operated, endorsed, or supported by Hacettepe University or any official institution. Official academic processes must be verified through the university's authorized systems.

2. Personal Data Processed

The following personal data may be processed:

• Identity and contact data: Full name, email address
• Authentication identity (Supabase Auth): User identifier (UUID), session information, registration date
• Academic profile data: Department (required for Cloud Sync); optional, unverified Hacettepe institutional email (@hacettepe.edu.tr) stored for possible future university-specific features (currently grants no access or privileges)
• Academic History data: User-approved transcript/course-attempt records, grades, ECTS, and term GPAs. In the current public product, this data stays in browser local storage; the separate Academic History cloud-sync capability is not enabled
• gerekli.tr cloud/app data: Course schedules, GPA calculations, and preserved semester/attendance data; a Supabase copy of supported planning data after sign-in and required department setup, when Cloud Sync becomes ready
• Share link data: Course schedule content when the sharing feature is used (sign-in not required)
• Consent and acknowledgement records: Record that the KVKK notice was shown/read, terms of use acceptance time, cookie preferences
• Technical data: IP address, browser type, device information, session cookies, server error logs (for authentication and service security)

The current public product does not offer attendance tracking or semester-lifecycle transitions. If legacy semester or attendance data exists in local or cloud storage, it is retained as part of the preserved data model and compatibility behavior.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Creating user accounts and authentication
• Providing course schedule planning and GPA calculation, and preserving existing semester/attendance data for compatibility where it exists
• Providing transcript and Academic History tools from browser-local data
• Cloud synchronization of supported planner/GPA data across devices
• Creating and serving course schedule share links
• Supporting department selection and course-catalog context
• Service security, server error detection, and continuity
• Fulfilling legal obligations
• Product analytics and performance measurement (only with cookie preference)

4. Legal Bases for Processing Personal Data

Your personal data is processed on the following legal bases specified in Article 5 of the Personal Data Protection Law (KVKK) No. 6698:

• Explicit consent (Art. 5/1): Optional analytics, performance measurement, and non-essential cookies via separate choices in the cookie preference banner
• Performance of a contract/service (Art. 5/2-c): Account creation, authentication, schedule planning, GPA, supported cloud sync, share links, handling retained app data, and delivery of core services
• Legitimate interest (Art. 5/2-f): Service security, abuse prevention, server-side error logs (Sentry), and service reliability
• Legal obligation (Art. 5/2-ç): Keeping request/consent records and responding to lawful requests

Recording that the KVKK notice was shown and read during profile completion is an acknowledgement record, not explicit consent for all processing.

5. Transfer of Personal Data

Your personal data may be transferred to the following third parties to the extent necessary to provide the service:

• Supabase (determined by project configuration): Database, authentication, and supported planner/GPA cloud synchronization
• Google OAuth (USA): Optional Google sign-in — email, name, and profile photo
• PostHog (EU): Product analytics with your consent; session replay is disabled in the current public product (eu.i.posthog.com)
• Google Analytics 4: Page view and basic traffic measurement with your analytics consent; Google Signals and advertising personalization signals are disabled
• Sentry: Server error logs (Germany / DE, legitimate interest); client error reporting (DE, with performance preference)
• Vercel: Website hosting, secure delivery, and service availability
• Vercel Analytics / Speed Insights: Traffic and performance measurement only where the relevant analytics/performance preference allows it

Under no circumstances is your data sold or rented to advertising networks, data brokers, or third parties for marketing purposes.

6. Cross-Border Data Transfer (KVKK Art. 9)

Because some service providers use infrastructure located outside Türkiye, your personal data may be transferred abroad. Such transfers are handled under the applicable mechanisms of Article 9 of the Turkish Data Protection Law, relevant service provider agreements, and explicit consent where required.

7. Retention Periods for Personal Data

• gerekli.tr cloud/app data: Plans, semester/attendance and GPA data, profile, account-owned share links, and account-linked course-usage records are deleted when the in-app data deletion action completes successfully. Academic History is currently kept in browser local storage, not in this cloud data category
• Authentication identity (Supabase Auth): Not deleted by the in-app data deletion action; identity deletion is a separate KVKK application/process
• Share links: academic term end + 60 days (180 days after creation when academic calendar data is unavailable)
• Browser local storage (localStorage): Academic History remains only on your device because its separate cloud capability is currently disabled. Supported planner/GPA data is not automatically sent until Cloud Sync is ready; after that, it is synced automatically
• Consent records: At least 10 years with a pseudonymous reference for legal proof
• PostHog data: Up to 90 days
• Sentry error records: Up to 90 days

Deletion of gerekli.tr cloud/app data removes course plans, semester/attendance data, GPA, profile data, share links owned by that account, and account-linked course-usage records; Academic History is currently local and its copy on this device is also cleared. If a previously created Academic History cloud copy is present, the same action removes it. Cookie/analytics preferences and browser data outside this scope remain. The Supabase authentication identity and Google account are not deleted by this action. Consent audit records may be retained for a limited period after removing the direct user id, keeping a pseudonymous reference, document version, and timestamp. These records are not anonymous; they are pseudonymous records kept for legal proof.

Existing external analytics, platform telemetry, and error records are not retroactively deleted by the in-app data deletion action; system and provider retention periods apply.

Withdrawal of analytics consent applies going forward. Anonymous aggregate outputs that already passed small-group thresholds before withdrawal may remain because they cannot be separated back into individual contributions.

8. Data Subject Rights (KVKK Art. 11)

Under Article 11 of the Personal Data Protection Law (KVKK) No. 6698, you have the following rights:

• To learn whether your personal data is being processed
• To request information if it has been processed
• To learn the purpose of processing and whether it is used in accordance with that purpose
• To know the third parties to whom data is transferred domestically or abroad
• To request rectification if processed incompletely or inaccurately
• To request erasure or destruction under KVKK Art. 7
• To request notification of rectification and erasure to third parties to whom data was transferred
• To object to a result against you arising solely from automated analysis of processed data
• To claim compensation for damages arising from unlawful processing

To exercise your rights, you may apply to hacettepeliyegerekli@gmail.com or follow the instructions on our Data Subject Application (KVKK) page. Applications are concluded within 30 days at the latest.

9. Special Notice on Analytics Tools

The following tools are loaded on the client side only when you grant the relevant preference in the cookie banner:

• PostHog (analytics category): Page views, page leave, and selected product use; session replay is disabled in the current public product.
• Vercel Analytics (analytics category): Traffic and page view measurement
• Google Analytics 4 (analytics category): Page view and basic traffic measurement; Google Signals and advertising personalization signals are disabled
• Sentry (performance category): Client JavaScript errors; session recording disabled; limited performance trace sampling may apply
• Vercel Speed Insights (performance category): Core Web Vitals and page load performance

Server-side Sentry error logs are processed under legitimate interest independently of cookie consent.

You can change your preferences via the Cookie Preferences link in the page footer. For details, see our Cookie Policy.

10. Profiling and Automated Decision-Making

gerekli.tr does not perform profiling or automated decision-making that produces legal or similarly significant effects against you by analyzing your personal data exclusively through automated systems.