Privacy policy

This policy explains which personal data Aphroa processes when you visit aphroa.com, use a form or become a customer, and why. We collect little. We store no IP addresses in our lead and consent records, and we load Google only after you consent. Our services are for businesses, so the data concerned is mostly business contact data.

1. Who is responsible

The controller is Sedeus, a sole proprietorship, trading as Aphroa. The business owner is Sercan Uslu.

İstiklal Mah. Demirciler Sk. No: 16/2
26120 Odunpazarı / Eskişehir
Türkiye
E-mail: hello@aphroa.com
Phone: +90 530 898 13 11

Write to the e-mail address above for any privacy request. More company details are in the legal notice.

For Fair Lead Hub, Aphroa processes the contacts that our customers collect on their own behalf. In that case we are the processor and our customer is the controller (section 10).

2. How we process your data

Visiting the website

• Data: IP address, date and time, requested page, response status, browser and device information, referring page.
• Purpose: delivering the website, security, finding faults.
• Legal basis: legitimate interest, Art. 6(1)(f) GDPR, in a secure and working website.
• Retention: server logs are kept for 7 days. Cloudflare keeps its own technical logs under its terms.
• Recipients: Hetzner Online GmbH (hosting) and Cloudflare, Inc. (network and security).

Settings stored in your browser

• Data: light or dark mode, whether you saw the dark-mode hint or closed the language suggestion, your cookie choice, and campaign data kept for the form (section 5). The items are listed in the table in section 5.
• Purpose: to give you the settings you chose and to remember your consent.
• Legal basis: legitimate interest, Art. 6(1)(f), in a site that works as you set it. These items stay on your device and we do not read them on our servers, except the campaign data you send with a form.
• Retention: see the table in section 5.

Cookie consent record

• Data: a random client ID, your choices, the policy version, the language and the time. No IP address and no browser details are stored.
• Purpose: proof that you gave or withdrew consent.
• Legal basis: legal obligation to demonstrate consent and legitimate interest, Art. 6(1)(c) and (f).
• Retention: 13 months, then deleted automatically.
• Recipients: Hetzner Online GmbH (hosting).

Forms: free website check, contact, orders, quotes and Fair Lead Hub trial

• Data: website address, e-mail address and what you add yourself: name, company, phone, trade fair, message. We also store the form you used and the plan or service, the language, the time, the first page you visited on our site, the first external referrer and UTM campaign tags. If you consented to marketing, we also keep Google click identifiers (gclid, gbraid, wbraid) that come with the link. We store a hash of your IP address that changes every day. It can only link submissions of one day. It is not your IP address.
• Purpose: answering your request, preparing a quote or check, and running the order.
• Legal basis: steps at your request before a contract and performance of a contract, Art. 6(1)(b). For records of requests and defence of claims, Art. 6(1)(f).
• Retention: 24 months after the request, then deleted automatically. Invoices and accounting records are kept for the period the law requires.
• Recipients: Hetzner Online GmbH (hosting) and our own mail server (below). When you use a form, the spam check of Cloudflare, Inc. (Turnstile) loads and receives technical browser signals. If you tick the optional box, we also send you marketing e-mails (next block).
• Spam protection: a hidden field, a signed time token, Cloudflare Turnstile and a limit on attempts per hour. The limit uses the daily hash, not your IP address.

E-mails

• Data: your e-mail address, the content of the e-mails, and delivery status. For marketing, a record that you ticked the box.
• Purpose: confirming your request, answering you, follow-up e-mails about your request, and, only if you tick the box, occasional marketing e-mails from Aphroa.
• Legal basis: Art. 6(1)(b) for answers and confirmations, legitimate interest Art. 6(1)(f) for follow-up e-mails to business contacts about their request, and consent Art. 6(1)(a) for marketing. You can withdraw consent at any time.
• Unsubscribe: follow-up and marketing e-mails contain an unsubscribe link. We then keep a one-way hash (SHA-256) of your address on a suppression list so we do not write to you again. It is not your address. Confirming again removes it.
• Retention: finished e-mails (sent, cancelled or failed) are deleted from our queue after 30 days. The mail log of our sending plug-in is kept for 14 days. Mailbox content is kept while we need it for our business relationship and for legal duties.
• Recipients: our own mail server, operated on servers of Hetzner Online GmbH. Messages are sent over encrypted connections. Your own e-mail provider receives the e-mails you receive.

Customers: orders, invoices and payment

• Data: business and contact data, billing and tax data, service ordered, payment reference. For payment in USDT, the transaction data.
• Purpose: fulfilling the contract, invoicing, accounting and tax.
• Legal basis: performance of a contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c).
• Retention: for the period that accounting and tax law require.
• Recipients: your bank and ours for bank transfers. USDT transactions are recorded on a public blockchain and can be seen by anyone there.
• Access to your systems: if you give us access to your website or accounts for a job, we use it only for that job. Section 10 and our data processing agreement apply to personal data that we can see there.

Google Tag Manager and Google Analytics 4 (only with your consent)

• Data: online identifiers, pages viewed, approximate location, device and browser data, and, with marketing consent, campaign data.
• Purpose: understanding how the website is used, and measuring campaigns.
• Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time with “Cookie preferences”.
• Retention: according to the retention settings of our Google Analytics property. Items in your browser are listed in section 5.
• Recipients: Google. Nothing is requested from Google before you consent. We use Google Consent Mode v2 with every purpose denied by default.

Technology on our own server

The Rank Math plug-in creates page titles, structured data and the sitemap on our server. With its instant indexing module, it tells search engines that a page has changed. These messages contain page addresses only. A Redis object cache and a Varnish page cache run on our server. Cached pages are the same for every visitor and hold no personal data. Our team signs in to the administration area. Visitors do not get an account.

3. Who receives data

We do not sell personal data. We pass data to authorities only when the law requires it.

4. Transfers to other countries

Cloudflare, Inc. and Google LLC are based in the United States. When data goes to them, we rely on the EU–US Data Privacy Framework where the recipient is certified under it, and on Standard Contractual Clauses of the European Commission in the providers’ terms. Google is used only after your consent.

For Fair Lead Hub, business-card reading and the personalisation of follow-up e-mails are done by Anthropic, an artificial intelligence service provider based in the United States. Data sent for this purpose therefore leaves the European Economic Area. We transfer it only with appropriate safeguards.

Access from Türkiye. Our data is stored on servers of Hetzner Online GmbH in Germany. We, the controller, are based in Türkiye and open the data from there to run the business. The European Commission has not issued an adequacy decision for Türkiye. We therefore limit access to the people who need it, use encrypted connections, and keep retention short, as described in this policy.

5. Cookies and browser storage

This website sets no cookies of its own. It uses the browser storage items below. Items from Google are stored only if you accept analytics or marketing. You can change your choice at any time with “Cookie preferences”. More details are in the cookie policy.

6. Your rights

You have the right to:

• access to your data and a copy of it (Art. 15),
• correction of wrong data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• receive your data in a common format (Art. 20),
• object to processing that rests on legitimate interest (Art. 21),
• withdraw consent at any time, without effect on the earlier processing (Art. 7(3)).

Send your request to legal@aphroa.com. We reply within one month. If you contacted us by e-mail address only, we may ask you to confirm that the address is yours before we share data.

Complaints. You can complain to the data protection authority of the EU member state where you live or work or where you think a breach happened. You may also contact the Turkish Personal Data Protection Authority (KVKK). We would appreciate the chance to solve the problem first.

7. Turkish law (KVKK)

Sedeus is a data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK). People concerned have the rights in Article 11 of that law: to learn whether data is processed, to ask for information, to learn the purpose and whether it is used as intended, to know the recipients at home and abroad, to ask for correction, deletion or destruction, to ask that third parties be informed, to object to results produced only by automated analysis, and to claim compensation for loss from unlawful processing. Send applications to legal@aphroa.com. You can also complain to the Personal Data Protection Board.

8. Security

• The website and the forms work over HTTPS only.
• We do not store IP addresses in lead and consent records. We store a daily changing hash.
• Forms are protected by a hidden field, a signed time token, Cloudflare Turnstile and a rate limit.
• Database access in our code uses prepared statements. File editing in the administration area is off, the XML-RPC interface is off, and lists of user names are not exposed.
• Records are deleted automatically after the retention periods in section 2.

No system is fully risk-free. We will notify you and the authorities of a personal data breach as the law requires.

9. Children

Our services are for businesses. We do not knowingly collect data from children.

10. Fair Lead Hub and work on customer websites: we act as processor

When you use Fair Lead Hub, you decide why and how the contacts you collect are used. You are the controller of these contacts and Aphroa is your processor. The same is true if we see personal data on your website or systems while working for you. The data processing agreement (Art. 28 GDPR) applies. The processing of your own request data (your trial or order form) is covered by this policy. Fair Lead Hub is hosted by Hetzner Online GmbH, with data centres in Finland. The business cards are read, and follow-up e-mails are personalised, by Anthropic (United States).

11. Changes

We update this policy when our processing changes. The date under the heading shows the last update. If we add a new analytics or marketing item, we ask for your consent again.