Privacy notice, GDPR and KVKK.

01Controller

This site is operated by Innovative Teknoloji. Innovative Teknoloji is the controller of the personal data processed on this site under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK).

02Scope of this notice

This notice covers the public site: its pages, the demo request form, the demo opened by email, the coach chat with Santi and Milo, and the sample games.

If your employer uses ScopeHR and you enter a workspace, the employee app or a game link your employer sent you, your employer decides why and how your data is processed. In that case your employer's privacy notice applies.

03What we process and why

For each activity we state which data we process, for what purpose and on which legal basis.

• Visiting the site

  Data

  IP address, browser and device information, the page requested and the time.

  Purpose

  Delivering pages to you and protecting the site against errors and attacks.

  GDPR

  Article 6(1)(f): our legitimate interest in keeping the site secure and working.

  KVKK

  Article 5(2)(f): legitimate interest.

  Retention

  For the period our hosting provider sets. We keep no separate copy.

  Recipients

  Vercel.

• Language

  Data

  The language you chose or of the address you opened. On your first visit, your browser's language setting and the country derived from your IP address, used only to choose the language and not stored.

  Purpose

  Showing the site in your language and keeping that language from page to page.

  GDPR

  Article 6(1)(f): our legitimate interest in presenting the site in a language you understand.

  KVKK

  Article 5(2)(f): legitimate interest.

  Retention

  Language cookies 1 year.

  Recipients

  Vercel.

• Demo request

  Data

  Name, work email, company, role, phone (optional), company size, sector, areas of interest, your note, and the time and status of the request.

  Purpose

  Replying to your request, confirming that the email address is yours, opening the demo and telling our team about the new request.

  GDPR

  Article 6(1)(b): steps taken at your request before entering into a contract.

  KVKK

  Article 5(2)(c): directly related to the establishment of a contract.

  Retention

  Until your request is settled and for as long as we correspond about the demo; erased earlier if you ask.

  Recipients

  Turso (database), Resend (email), our team.

• Verification and demo links

  Data

  One-way hashes of the links and the times they were created, used and expire. A copy of the emails we sent you: recipient, subject and text, with the links removed.

  Purpose

  Making sure only you can use the link, applying sending limits (one a minute, at most five a day) and being able to show what we sent.

  GDPR

  Article 6(1)(b), and Article 6(1)(f): our legitimate interest in preventing the form from being misused to send email.

  KVKK

  Article 5(2)(c) and Article 5(2)(f).

  Retention

  The verification link is valid for 24 hours and the demo link for 3 days. The records are kept and erased together with the demo request.

  Recipients

  Turso, Resend.

• Demo session

  Data

  Start, end and last activity of the session, the role viewed in the demo, the pages you opened and the games you started in the demo.

  Purpose

  Running the demo and ending it on time. When the demo ends, sending our team a short summary of what you looked at so that we can follow up on the right topic.

  GDPR

  Article 6(1)(b) to run the demo; Article 6(1)(f) for the summary, our legitimate interest in following up on your request appropriately.

  KVKK

  Article 5(2)(c) and Article 5(2)(f).

  Retention

  Kept and erased together with the demo request.

  Recipients

  Turso, Resend, our team.

• Coach chat with Santi and Milo

  Data

  The messages you write and the last few messages of the chat. A one-way hash of your IP address for abuse limits.

  Purpose

  Generating answers to your questions about the product and protecting the service against overuse (at most 20 messages in 10 minutes).

  GDPR

  Article 6(1)(f): our legitimate interest in answering your questions and protecting the service.

  KVKK

  Article 5(2)(f): legitimate interest.

  Retention

  The chat is not stored; messages are sent only to generate the answer. The IP hash is deleted after 10 minutes.

  Recipients

  Anthropic (directly or through Vercel AI Gateway), Upstash or Turso (counter), and Langfuse if switched on (quality monitoring, with personal identifiers masked).

• Cookieless usage measurement

  Data

  The address of the page opened (with link keys and personal identifiers removed), the referring page, browser, operating system, device type, country, and the names of a few events such as opening the brochure or the coaches.

  Purpose

  Counting which pages are used and improving the site.

  GDPR

  Article 6(1)(f): our legitimate interest in improving the site.

  KVKK

  Article 5(2)(f): legitimate interest.

  Retention

  For the period Vercel sets for the service.

  Recipients

  Vercel (Web Analytics).

• Microsoft Clarity, only with your consent

  Data

  Clicks, scrolling and mouse movements, the pages opened, device and browser information, IP address. Anything you type into the demo form and the chat is hidden in the recordings. Clarity never runs on game, invitation or kit links.

  Purpose

  Understanding how the site is used and finding problems.

  GDPR

  Article 6(1)(a): your consent. You can withdraw it at any time.

  KVKK

  Article 5(1): your explicit consent.

  Retention

  For the period Microsoft sets for Clarity. The lifetimes of the Clarity cookies are in the cookie policy.

  Recipients

  Microsoft.

• Your cookie choice

  Data

  Whether you consented to analytics, the policy version and the date. Kept only in your browser and not sent to us.

  Purpose

  Remembering your choice and asking again when the policy changes.

  GDPR

  Article 6(1)(f): our legitimate interest in respecting your choice.

  KVKK

  Article 5(2)(f): legitimate interest.

  Retention

  Until you change it or delete it from your browser.

  Recipients

  None.

• When you write to us

  Data

  Your name, email address, your message and information related to your request.

  Purpose

  Answering your message and your request about your rights.

  GDPR

  Article 6(1)(c): our legal obligation for requests about your rights; Article 6(1)(f) for other messages.

  KVKK

  Article 5(2)(ç): legal obligation; Article 5(2)(f) for other messages.

  Retention

  Until the request is settled and for as long as we need to show that we answered.

  Recipients

  Our team.

04Recipients and service providers

We share your data only with the providers below, which process it on our behalf and on our instructions to deliver the service. Where the law requires it, we may also disclose data to competent authorities and courts.

• VercelHosting, cookieless usage measurement and forwarding of AI requests (AI Gateway).
• TursoDatabase for demo requests, sessions and request counters.
• UpstashCounter for the coach chat's rate limit.
• ResendSending verification, demo and team emails.
• AnthropicThe AI model that generates the coaches' answers.
• MicrosoftClarity usage recordings, only with your consent.
• LangfuseQuality monitoring of AI answers, only if switched on and with personal identifiers masked.

05International transfers

Some of our providers are based in the United States and may process data outside the European Economic Area, the United Kingdom and Türkiye.

Transfers from the European Economic Area and the United Kingdom rely on the safeguards the GDPR provides (an adequacy decision or Standard Contractual Clauses). Transfers from Türkiye rely on the safeguards provided in Article 9 KVKK.

You can ask for a copy of these safeguards by writing to the contact address below.

06How long we keep data

• Demo request, demo session and copies of the emails we sent: until your request is settled and for as long as we correspond with you about the demo. We erase them earlier if you ask.
• The email verification link is valid for 24 hours and the demo link for 3 days. We store links only as one-way hashes.
• One-way hash of your IP address for abuse limits: for the length of the limit, 10 minutes for the coach chat and at most 24 hours for other requests. It is deleted when that time ends.
• Coach chat: not stored.
• Language cookies 1 year, demo cookies for the length of the demo plus 7 days. Details are in the cookie policy.
• Your cookie choice: only in your browser, until you change or delete it.
• Hosting logs, Vercel Web Analytics and Microsoft Clarity data: for the period the provider sets for its service. We keep no separate copy.
• Requests you send us: until the request is settled and for as long as we need to show that we answered.

07Your rights

The GDPR, the UK GDPR and the KVKK give you the rights below. The scope of a right can depend on the legal basis of the processing.

• AccessFind out whether we process your data, and receive a copy and information about the processing.Art. 15 GDPR, Art. 11(1)(a) to (ç) KVKK
• RectificationHave inaccurate or incomplete data corrected.Art. 16 GDPR, Art. 11(1)(d) KVKK
• ErasureHave your data erased or destroyed.Art. 17 GDPR, Art. 7 and 11(1)(e) KVKK
• RestrictionHave your data only stored while a dispute is resolved.Art. 18 GDPR
• Notification of recipientsHave recipients of your data told about a rectification or erasure.Art. 19 GDPR, Art. 11(1)(f) KVKK
• PortabilityReceive the data you gave us in a common, machine-readable format, or have it sent elsewhere.Art. 20 GDPR
• ObjectionObject at any time, on grounds relating to your particular situation, to processing based on legitimate interest.Art. 21 GDPR
• Automated decisionsNot be subject to a decision based solely on automated processing, and object to a result against you.Art. 22 GDPR, Art. 11(1)(g) KVKK
• Withdrawal of consentWithdraw your consent at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing before it.Art. 7(3) GDPR
• CompensationClaim compensation for damage caused by unlawful processing.Art. 82 GDPR, Art. 11(1)(ğ) KVKK
• ComplaintLodge a complaint with a supervisory authority.Art. 77 GDPR, Art. 14 KVKK

08How to exercise your rights

You can send your request to the email address below or in writing to our postal address. Requests are free of charge. We may ask for additional information to confirm that the request comes from you.

We answer requests under the GDPR within one month. If a request is complex or there are many, this period can be extended by two further months; we will tell you within the first month.

You can make a request under the KVKK in writing, from a registered electronic mail (KEP) address, with a secure electronic or mobile signature, or from an email address you gave us before and that is registered in our system. We answer within 30 days at the latest.

09Right to lodge a complaint

If you believe that the processing of your data breaches the law, you can lodge a complaint with a supervisory authority. In the EU and the United Kingdom this is in particular the authority where you live or work.

In Türkiye, Article 14 KVKK requires you to apply to us first. If your request is rejected, you find the answer insufficient or you receive no answer in time, you can complain to the Personal Data Protection Board within 60 days of learning of our answer or, if there was none, of the date of your request.

• Autoriteit PersoonsgegevensNetherlandsautoriteitpersoonsgegevens.nl
• State data protection authoritiesGermany, the authority of the federal state where you live or where your employer is located
• Information Commissioner's Office (ICO)United Kingdomico.org.uk
• Personal Data Protection Board (Kişisel Verileri Koruma Kurulu)Türkiyekvkk.gov.tr
• Authorities of other EU countriesList of members of the European Data Protection Boardedpb.europa.eu

10Do you have to provide data

No. No law or contract obliges you to provide data. A demo request needs your name, work email and company name; without them we cannot reply to you or open the demo. The other fields are optional.

Using the coach chat and consenting to analytics are optional. You can use the site without them.

11Automated decisions

On the public site we make no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR), and we do not create profiles.

The demo form automatically checks that the domain of your email address can receive mail and is not a disposable address. If your address is not accepted, you can write to us.

12Changes to this notice

We update this notice when our service or the law changes. The current version is always on this page and its date is shown at the top. If something changes about cookies, the cookie window asks for your choice again.