1. Controller

Controller: Akkod (PDFResim brand). For electronic privacy requests, contact iletisim@pdfresim.com, the registered electronic mail (KEP) address sule.kaya.6@hs01.kep.tr, or use the contact page.

2. Personal Data Categories

Identity data: If you create an account, name and email address.
Security data: Browser/device details, session identifiers, a salted IP digest used for quota and abuse controls, and error/performance logs.
Operation data: Limited technical metadata such as the tool, operation date and status, file name/type/size and account identifier.
Content: The uploaded file and generated result used to perform the selected operation, for the plan-based download window described below.

3. Purposes

Providing the service you requested
Keeping accounts secure and preventing abuse
Meeting legal obligations
Producing anonymous statistics to improve the service

4. Transfers and International Transfers

We do not sell or share your personal data for third parties' own purposes. Transfers are made only as strictly necessary and limited to the relevant purpose, to the following service providers:

Hosting and file processing infrastructure: Servers, database/file storage and PDF/image processing engines, so the service can run.
Site measurement (conditional): Plausible or Umami only when the relevant production setting is enabled; Vercel Web Analytics when the application runs on Vercel. These services may process technical visit data such as page views, referrers and browser/device details for aggregate usage statistics.
Error and performance monitoring (conditional): Sentry only when a Sentry connection is configured. It may process error, runtime and performance records; default transmission of personal data is disabled in the application.
Payment provider (Lemon Squeezy): If you purchase a premium plan, your email address and account identifier are transferred to Lemon Squeezy (USA) to process payment and billing.
Advertising (only if enabled): When ad display is explicitly enabled, Google advertising services (Google AdSense, USA) may process cookie and device/IP data. In that case, separate cookie consent is obtained.

Transfers to providers located abroad (such as the USA) are carried out under Article 9 of Law No. 6698, on the basis of performance of the service/contract and, where required, your explicit consent. No advertising-related transfer abroad takes place unless ad services are explicitly enabled.

5. Collection Method and Legal Basis

Data is collected automatically or partly automatically while you create an account or use the service. Legal bases may include contract performance, legal obligations and legitimate interests.

6. Retention Periods

We keep your personal data only for as long as the processing purpose requires and applicable law prescribes:

Uploaded and generated file contents: Input and downloadable result files may be kept in private storage for the processing/download window: 1 hour for guests, 6 hours for free accounts, and 24 hours for premium and API accounts. They are deleted by the first successful automatic cleanup run after that window expires.
Account data (name, email): Kept while your membership is active; deleted or anonymized within a reasonable period after you delete your account.
Operation and security records: Separately from file contents, limited technical metadata such as tool, time, status, file name/type/size, account identifier and salted IP digest may be kept for security, quota, debugging and operation-history purposes. Deleting file contents does not mean these records are deleted at the same time.
Payment and billing records: Kept for the period legally required by tax and commercial law.

File contents are deleted through the download windows and automatic cleanup flow described above. Other technical records are deleted, destroyed or anonymized when their processing purpose and applicable legal obligations end.

7. Your Rights (Law No. 6698, Art. 11)

Under Article 11 of Law No. 6698, you have the right to:

Learn whether your personal data is processed
Request information if it has been processed
Learn the purpose of processing and whether the data is used in line with that purpose
Know the third parties, in Türkiye or abroad, to whom your data is transferred
Request correction of incomplete or inaccurate data
Request deletion or destruction under the conditions set out in the law
Request that correction, deletion and destruction be notified to third parties to whom the data was transferred
Object to a result adverse to you arising from analysis of your data solely by automated systems
Claim compensation for damage arising from unlawful processing of your personal data

8. How to Apply

To exercise these rights, send your request via the form on the contact page, to iletisim@pdfresim.com, or to our registered electronic mail (KEP) address sule.kaya.6@hs01.kep.tr.

Your request should include your name and surname, your signature (for written applications), your Turkish ID number (or passport/ID number for foreign nationals), your address or email for notification, and the subject of your request (per the Communiqué on Application Procedures to Data Controllers).

We respond within 30 days at the latest and free of charge, pursuant to Article 13 of the KVKK. If the request requires additional cost, a fee set by the Board's tariff may apply. If your application is rejected, you retain the right to complain to the Personal Data Protection Authority.

9. Age and Children's Data

PDFResim is not directed at children under 18 and does not knowingly collect personal data from anyone under 18. Users under 18 should not create an account; use should occur under the supervision and consent of a parent or guardian. If we become aware that we hold data belonging to someone under 18, we delete it within a reasonable period.