Privacy Policy
This text is a translation for information only; the Turkish text prevails in case of conflict. Read the Turkish text
This text is a draft: 34 fields in square brackets have not been filled in yet and it awaits legal review.
This policy explains in plain language what data we collect, why, and what we do with it. The statutory notice under Personal Data Protection Law No. 6698 is in the Personal Data Notice.
1. Who is responsible
The data controller for personal data collected through this website (https://zone9.cloud), the console (https://app.zone9.cloud), the API and the MCP server is [COMPANY LEGAL NAME]. For privacy questions: [DATA PROTECTION E-MAIL].
2. What we collect
When you visit the website
- Server logs: IP address, browser details, the page requested and the time. These are kept to run and secure the site and are deleted after [SITE LOG RETENTION — e.g. 30 days].
- Visit statistics: if enabled, aggregate page view counts from an analytics tool that uses no cookies and does not identify you. [ANALYTICS PROVIDER — remove this item if not used]
- In your browser: your light or dark theme choice is stored only in your browser and is never sent to us. Details: Cookie Policy.
The website has no forms, ad trackers or third-party tracking code.
When you create an account and use the Service
- Account details: first name, last name, e-mail address, [OTHER SIGN-UP FIELDS — e.g. phone, company name].
- Billing details: billing name and address, tax office and tax number or national ID number [LEGAL: fields required for e-invoicing]. Your card details never reach us; they are processed by [PAYMENT PROVIDER].
- Usage and metering records: the resources you create, their sizes, running times and the metering events needed for billing.
- Audit records: who performed which action on your account, when, and from which surface (console, API, assistant). These are kept for your security and to resolve disputes.
- Technical logs: IP address, time and request ID of sessions and API requests.
- Support correspondence: the e-mails you send us and their attachments.
Data on your servers and storage
You own, and are the data controller for, the data you keep on your virtual servers, Kubernetes clusters and object storage. We store and process it only to provide the Service; we do not look at, analyse or sell its contents. The exceptions are listed in section 6 of the Terms of Service.
3. Why we use it
- To open your account and provide the Service,
- To meter usage, deduct it from your plan and invoice you,
- To keep your account and the platform secure and prevent abuse,
- To answer your support requests,
- To send mandatory service notices (invoices, maintenance, security, changes to terms),
- To meet our legal obligations (such as tax, commercial and Law No. 5651 records).
We send you promotional e-mail only with your explicit consent, and you can withdraw it with the link in every such e-mail. [COMMERCIAL MESSAGES — İYS registration and consent method]
4. Who we share it with
We do not sell your personal data. To provide the Service, we share it only as needed with these service providers:
| Recipient | Why | Location |
|---|---|---|
| [PAYMENT PROVIDER] | Taking payments | [COUNTRY] |
| [E-MAIL DELIVERY PROVIDER] | Sending service notices | [COUNTRY] |
| [DNS PROVIDER] | Publishing your records if you use DNS management | [COUNTRY] |
| [DOMAIN REGISTRAR] | Registration details of domains managed in the panel | [COUNTRY] |
| [CERTIFICATE AUTHORITY] | Obtaining TLS certificates for load balancers (domain name only) | [COUNTRY] |
| [ACCOUNTING / E-INVOICE PROVIDER] | Issuing invoices | [COUNTRY] |
| [ANALYTICS PROVIDER] | Aggregate visit statistics | [COUNTRY] |
| Competent public authorities | Legal obligations and requests | Türkiye |
Transfers to recipients abroad are made in line with Article 9 of Law No. 6698. [CROSS-BORDER TRANSFER BASIS — e.g. standard contract and date of notification to the Authority]
5. Where your data is
The Service and its records are hosted in our own datacenters. [DATACENTER LOCATIONS — regions and their countries; if a region is abroad, the transfer basis in section 4 for data held there]
You choose which region your servers run in; your data stays in the region you choose.
6. How long we keep it
| Data | Retention |
|---|---|
| Account details | While the account is open and [PERIOD] after it closes |
| Invoices and payment records | As required by tax and commercial law (generally 10 years) |
| Usage and metering records | [PERIOD] |
| Audit records | [PERIOD] |
| Technical and access logs | [PERIOD — considering the minimum periods under Law No. 5651] |
| Support correspondence | [PERIOD] |
| Server and storage contents | Permanently deleted when you delete the resource, or [PERIOD] after the account closes |
When a retention period ends, the data is deleted, destroyed or anonymised.
7. Security
All communication with the console and API goes over encrypted connections. API tokens and session keys are stored hashed, not in plain text. One-time secrets such as kubeconfigs and access keys are shown only at the moment they are generated. [ADDITIONAL TECHNICAL AND ORGANISATIONAL MEASURES — e.g. database encryption at rest, access control, backups]
In the event of a data breach, we notify the Personal Data Protection Board and the people affected as the law requires.
8. Your rights
How to access your data, ask for it to be corrected or deleted, and exercise your other rights under Article 11 of Law No. 6698 is explained in the Personal Data Notice. To apply: [DATA PROTECTION E-MAIL].
9. Children
The Service is not intended for anyone under 18, and we do not knowingly collect their data.
10. Changes
When we change this policy, we update the effective date. We announce significant changes to the e-mail address on your account and in the console.