Privacy notice — Axolith

Data controller

Axolith is a product of PERAİST İnşaat Yazılım Danışmanlık Ticaret Limited Şirketi. Data controller for the processing described here: PERAİST İnşaat Yazılım Danışmanlık Ticaret Ltd. Şti., MERSİS 0728040533900001, Pancarlı Mah. 58080 Sk. Park No: 4, 27060 Şehitkamil/Gaziantep, Türkiye, [email protected].

What we process, why, and on what legal basis

Data	Purpose	Legal basis
When you open the site: IP address, browser and device information, the page opened and the time	Running the site, keeping it secure and preventing abuse	Legitimate interest (KVKK Art. 5/2-f)
When you fill in the pre-registration form: your full name and mobile phone (required); your email address, company name, sector, province, the product (website, email, e-contracts) and package you are interested in (optional); which page of our site, and which button on it, you opened the form from; the date you sent the form and the pre-registration price shown on the page that day	Recording your pre-registration; contacting you by phone or email at your request to discuss your package and setup; applying your pre-registration price if you meet the conditions of the pre-registration price promise; measuring, in aggregate, which of our pages and products draw interest	Steps towards a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f)
When you write to us by email or on WhatsApp: your name, your email address or phone number and WhatsApp profile name, and the company and needs you write about	Answering your request, holding the pre-registration and quote conversation, providing support	Steps towards a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f)
Your admin panel account: your name, email address, the company you belong to and your role, an irreversible hash of your password	Opening and managing the panel account, sending you your panel address and sign-in link	Performance of our contract with your company (Art. 5/2-c); legitimate interest in managing your account as your company’s staff member (Art. 5/2-f)
When you sign in: IP address, browser information, sign-in time, number of failed attempts and the two-step verification result. In the panel’s security log your IP address is not kept in clear form but as an irreversible digest.	Account security, preventing unauthorised access and abuse; showing sign-in and security events to your company's authorised persons on the panel's "Security log" screen	Legitimate interest (Art. 5/2-f); legal obligation (Art. 5/2-ç)
When a “forgot password” or invitation link is requested: email address, a hash of the one-time link and when it was created	Setting and resetting passwords	Performance of contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
In the “Send my panel address” form: your email address; a hash derived from your IP address to prevent abuse	Emailing your panel address if you are registered	Legitimate interest (Art. 5/2-f)
Actions you take in the panel (who changed what and when), security-related actions (role and user changes, two-step verification, opening, downloading and deleting job applications, accepting the confidentiality pledge) and non-identifying usage counts. Your company's authorised users can see these records.	Service security, providing your company with an activity log, improving the service	Performance of contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
When you accept the AI clause or a service order: your name, email address, role, time of acceptance, version of the accepted text and a digest derived from your IP address	Concluding the contract and proving that it was concluded	Conclusion and performance of contract (Art. 5/2-c); establishment and protection of a right (Art. 5/2-e)
When you publish an AI draft or translation in the panel: your user account, time of publishing, the version of the confirmation text, the published text and whether you opened the translation draft on screen; when you publish several translations with one confirmation, also the number of translations published and the time between first opening the bulk translation screen and confirming	Record of the content’s source and approval, evidence in disputes	Performance of contract (Art. 5/2-c); establishment and protection of a right (Art. 5/2-e)
When you use AI features in the panel: your user account, time of the operation, the feature used and the AI uses spent	Calculating and showing the AI uses in your package, preventing abuse	Performance of contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
When you place a service order: order code, amount, your “for my business” statement, state and time of the confirmation boxes, payment reference, your billing details (name/title, address, tax office, tax ID or national ID), the IBAN you give for a refund on withdrawal or cancellation (stored encrypted)	Concluding and performing the order, invoicing, handling withdrawal and refunds	Performance of contract (Art. 5/2-c); legal obligation (Art. 5/2-ç: tax and consumer law); establishment and protection of a right (Art. 5/2-e)
When you open a support request: your name, email address, company and role; the topic, title and messages of the request; the screenshot you attach; the status of the request and the support staff handling it	Handling and answering your request, justifying a support access session where needed, monitoring service quality, evidence in a dispute	Performance of contract (Art. 5/2-c); legitimate interest (Art. 5/2-f); establishment and protection of a right (Art. 5/2-e)
Each time you connect to our websites, the panel or a customer website hosted with Axolith (traffic log): IP address and port, connection time, the address of the requested page without the query part, result and amount of data, and your internal user and company numbers if you are signed in. See “Traffic log”.	The obligation to retain traffic data under Article 5 of Law No. 5651; disclosure only upon request of the competent authorities	Expressly provided for by law (Art. 5/2-a); legal obligation (Art. 5/2-ç)

Cookies, statistics and third-party tools

axolith.com sets no cookies of its own and uses no analytics, advertising or social media tools. Fonts and images load from our own server; opening the page sends no request to Google or any other third party. Details: cookie policy.

We keep visit statistics on our own server without cookies: we only count, as totals, how many times each page was opened on each day, how many times the pre-registration and WhatsApp buttons were clicked and from which section of the page, and how many pre-registration forms were sent. We do not write your IP address or any identifier that recognises you into this count, we do not track you across sites and we do not share these numbers. If your browser signals that you do not want to be tracked (GPC or DNT), we do not count you. We also use the aggregate traffic figures that Cloudflare, which delivers our site, provides to us without identifying anyone (daily requests and pages, breakdown by country). No extra script is loaded on the page for this and no cookie is set.

The pre-registration form also works without cookies and loads no third-party bot check. To prevent abuse, a digest derived from your IP address is kept in the server cache for at most 1 hour; your IP address is not stored with your pre-registration.

Transfers and recipients abroad

The site, the admin panel, pre-registrations and e-contracts are hosted on Amazon Web Services infrastructure in Istanbul. Backups of this data are encrypted with our key and then stored in the Amazon Web Services Frankfurt (Germany) region; only we hold the key to decrypt them. AWS has not yet signed the Turkish standard contract of the Personal Data Protection Board.

Cloudflare, Inc. (USA): secure and fast delivery of the site. For this, your IP address and browser information pass through the Cloudflare network in encrypted form. Cloudflare has not yet signed the Turkish standard contract of the Personal Data Protection Board.

Hetzner Online GmbH (Germany): company email addresses opened with Axolith and their messages are hosted on Hetzner servers in Germany. For the messages, the customer using the address is the data controller; Peraist acts as data processor on that customer’s instructions and within its service relationship with them. Hetzner has not yet signed the Turkish standard contract of the Personal Data Protection Board; we have asked in writing for it to be signed. Visitor data and pre-registration form records from this site are not sent to these servers.

Panel address, invitation, password reset and notification emails are sent through Axolith’s email server, hosted on Hetzner Online GmbH infrastructure in Germany. Panel traffic passes, together with the sites, through the Cloudflare, Inc. (USA) network in encrypted form.

Amazon Web Services (European Union): the texts you write in the content assistant, the images you select and the published site content you select for translation are processed by an AI model running in AWS data centres in the European Union to prepare drafts and translations. The model provider cannot access this data; it is not used to train models. For this content, the business using the panel is the data controller; Peraist processes it on its behalf. AWS has not yet signed the Turkish standard contract of the Personal Data Protection Board.

Details you send with the pre-registration form are stored in the site’s database (AWS Istanbul). When you email us, your message is stored on Axolith’s email server running on Hetzner Online GmbH infrastructure in Germany; this is also a transfer abroad and the Hetzner situation described above applies. If you choose to message us on WhatsApp, your messages are delivered through the WhatsApp service; you use WhatsApp with your own account under WhatsApp’s terms and privacy policy. Messages are end-to-end encrypted in transit. We keep the conversations in the WhatsApp Business app we use on behalf of our company and in that app’s chat backup. Depending on the device used by our sales line, the backup is kept on servers abroad operated by Google (Google Drive) or Apple (iCloud); this is also a transfer abroad. The Turkish standard contract of the Personal Data Protection Board has not been signed with Google or Apple for this backup. If you prefer not to use WhatsApp, you can use email or the pre-registration form. We do not share your data with anyone for marketing.

Your support requests and their attachments are stored on our servers in Turkey; attachments are additionally encrypted and their backups are kept, encrypted with our key as described above, in the Amazon Web Services Frankfurt (Germany) region. Email notifications sent when a request is opened or answered do not contain the content of the request.

Retention

Detailed server logs are kept for 90 days for security and deleted at the end of that period. The traffic log kept under Law No. 5651 is retained for 400 days (see “Traffic log”). Detailed server logs for the period from 26 October 2026 to 6 November 2026, before the separate traffic log began, are retained for 400 days under Law No. 5651 as the only source of traffic data for that period; they are encrypted with our key and used only for traffic-log purposes. These logs also contain the part of the address after the question mark, browser information and the referring page.

Panel sign-in records are kept for 1 year, security and activity records for 2 years (the "Activity history" included in your plan for 1 year), and records of the confidentiality pledge and of user, role and account ownership changes for 3 years. The latest pledge accepted by a user who still works in the panel and the record of the company's current account owner are not deleted while that remains the case. Expired records are deleted daily.

Pre-registrations (form, email or WhatsApp) are deleted 2 years after they are sent. Each WhatsApp chat backup replaces the previous one, so a conversation we delete in the app is also removed from the backup with the next backup. If the request becomes a contract, it becomes part of our customer records.

Password reset links are valid for 60 minutes and invitation links for 72 hours; once used or expired they become invalid and their records are deleted by an hourly clean-up. A panel account is deleted when your company closes the account or the contract ends.

Inputs sent to AI are deleted after 30 days; drafts 30 days after they are deleted or published, and at the latest 30 days after the contract ends. Contract acceptance and publication approval records, and order, invoice and refund records, are kept for the relevant statutory periods (10 years for commercial books and documents, Turkish Commercial Code Art. 82). User information in AI use records is removed after 2 years or when the user account is deleted; the record without personal link is kept as proof of package usage.

Support requests and their messages are deleted 2 years after the request is closed, and their attachments 90 days after it is closed. Requests containing a withdrawal, refund, termination, invoice objection or complaint are kept with their attachments, together with the related order and subscription records, for the statutory period (10 years, Turkish Commercial Code Art. 82). A request awaiting a reply from the customer is closed after 30 days without activity.

Deleted records are removed from backups when the backup retention period ends.

Your rights and how to apply

Under KVKK Art. 11 you have the right to learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the recipients, request correction, deletion or destruction, request that recipients are notified, object to an adverse result of automated analysis, and claim compensation for unlawful processing.

Send your request in writing to [email protected] or to the postal address above. We conclude requests within 30 days at the latest.

Traffic log (Law No. 5651)

This section covers people who use axolith.com, the admin panel and the e-contract pages, and visitors of customer websites hosted with Axolith. On customer websites the data controller for this log is PERAİST, because of its own obligation as a hosting provider under Law No. 5651; for the rest of the website the privacy notice of the company operating it applies.

Data processed: each time you connect to our websites or the panel, your IP address and connection port, the address and port of the server you connect to, the start and end time of the connection, the domain name, the address of the requested page or action (excluding the part after the question mark and one-time link codes), the request type (e.g. opening a page, submitting a form), the result code, the amount of data transferred, the connection reference and, if you are signed in, your internal user and company numbers. Page and form contents, cookies, browser information and the referring page are not written to this log.

Purpose: to fulfil our obligation as a hosting provider to retain traffic data under Article 5 of Law No. 5651, and to disclose it only upon a duly made request of the competent authorities. We do not use this log for any other purpose.

Legal basis: expressly provided for by law (KVKK Art. 5/2-a) and necessary to comply with our legal obligation (Art. 5/2-ç).

Collection method: automatically, from the record created during the connection by our server and by our network security provider Cloudflare.

We disclose the traffic log only to authorities empowered by law, upon their request and within their powers: courts and chief public prosecutor’s offices, the Cyber Security Directorate and the Information and Communication Technologies Authority. We record every disclosure.

The traffic log is stored on our server in Türkiye; each day’s log is encrypted with our key at the end of the day, and a digest is added for that day so that it can be shown the log was not altered afterwards. The log is kept for 400 days and deleted at the end of that period. The law requires this period to be no less than 1 year and no more than 2 years; the margin is for archiving and official correspondence. As the law obliges us to keep this log, we cannot fulfil a deletion request for it before the period ends; we will tell you the reason in writing. A record requested by a competent authority is not deleted until it is handed over; this never exceeds 2 years.

If you request your own traffic log, after verifying your identity we provide only the records linked to your account. Records that rely only on an IP address are not provided, as they may belong to other people.

Change of company name

Our company name changed from “Peraist İnşaat Yazılım Ticaret Limited Şirketi” to “PERAİST İnşaat Yazılım Danışmanlık Ticaret Limited Şirketi” (Turkish Trade Registry Gazette, 28 October 2026, no. 11697). The legal entity and MERSIS number are unchanged. The former name appearing in texts you have accepted, or will accept before they are updated (AI annex, support access clause, confidentiality pledge, order pre-information), refers to the same company; no new acceptance is needed.