Privacy Policy

1. Controller

The controller responsible for your personal data under the EU/UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK) is identified below.

We are a small operation and do not have a Data Protection Officer; write to destek@nefena.com for anything in this policy.

2. What We Collect

We collect only what is needed to run the service:

• Account data — your name and email address. If you sign in with Google, we receive the name and email Google shares with us. We never receive your Google password.
• Site content — the business description you write and any images you upload to build your website.
• Purchase records — which package you bought, the amount and a transaction reference. We never receive your card number, expiry date or security code (see section 5).
• Domain registration details — if you buy a domain, the contact details the registrar is legally required to collect.
• Visitor data from your modules — if you enable appointment booking, association membership or a contact form, the names, phone numbers and messages your own visitors submit. This data is shown to you; we do not use it for any purpose of our own.
• Technical data — IP address and request timestamps, used only for rate limiting and abuse prevention.

We do not use advertising or tracking cookies. The only cookie we set is the one that keeps you signed in, which is strictly necessary for the service to work and therefore does not require your consent.

3. Why We Process It, and Our Legal Basis

We do not sell or rent your personal data, and we do not use it for profiling or automated decision-making that produces legal effects for you.

4. AI Processing

The business description you write is sent to our AI provider (Anthropic) to generate your website. It is processed to produce your result and is not used to train AI models. Do not put sensitive personal data (health information, government ID numbers, payment details) into the description field — it is not needed to build a website.

5. Payments

Payments are processed by Dodo Payments, Inc., which acts as merchant of record. Your card details are entered on Dodo Payments, Inc.'s own secure screen and never pass through or get stored on our servers. Dodo Payments, Inc. is an independent controller for the payment data it collects and applies its own privacy policy. Your card statement will show DODOPAY.

6. Who Else Receives Your Data

We share data only with providers needed to deliver the service:

• Dodo Payments, Inc. — payment processing, invoicing and tax
• Vercel — publishing and serving your website
• Render, Neon — application hosting and database
• Anthropic — AI generation of site content
• Twilio — SMS delivery, only if you use a module that sends messages
• Google — only if you choose to sign in with Google
• Competent public authorities — only where legally required

7. International Transfers

Our providers are located outside Türkiye and outside the European Economic Area, primarily in the United States and the European Union. This means your data is transferred internationally.

Where data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable to each provider. Where the transfer is from Türkiye, it takes place on the basis of your explicit consent or because the transfer is necessary for the performance of our contract with you (KVKK Art. 9). You may ask us for details of the safeguards that apply to a particular provider.

8. How Long We Keep It

• While your account is active — your account and site data are kept so the service can work.
• After you delete your account — your published site goes offline immediately; your data is kept for 30 days so an accidental deletion can be reversed, then permanently deleted.
• Abandoned drafts — previews from visitors who never created an account are deleted automatically after a short period.
• Accounting records — kept for the period required by tax law, even after account deletion.
• Rate-limiting records — deleted automatically within days.

9. Your Rights

You have the right to:

• know whether we process your data, and obtain a copy of it (access);
• have inaccurate or incomplete data corrected (rectification);
• have your data deleted (erasure / "right to be forgotten");
• restrict processing, or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where processing is based on consent;
• not be subject to a decision based solely on automated processing that produces legal effects for you.

Use the contact page or email destek@nefena.com. We respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

You may also complain to a supervisory authority. In the EU this is the data protection authority of your country of residence; in the UK, the Information Commissioner's Office (ICO); in Türkiye, the Personal Data Protection Authority (KVKK Kurumu).

10. Security

The whole site is served over an encrypted TLS connection. Passwords are never stored, because we do not use them — sign-in is by Google or by a single-use email link. Session cookies are signed, HTTP-only, and marked secure in production. Access to the production database is limited to the operator.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the competent authority as required by law.

11. Children

The service is not directed at children. You must be at least 18, or the age of majority where you live, to create an account. If we learn that we hold data about a child, we delete it.

12. Changes

We may update this policy. Material changes are announced by email to your registered address; the current version is always published here with its date.

Son güncelleme: 10.08.2026