Privacy Policy

1. Who is responsible for your data

The data controller is Yiğit Alp Yazıcı, İstanbul, Türkiye, who operates ProjectHub. For any privacy question or request, email yigitalpyazici53@gmail.com.

2. ProjectHub is for people aged 18 and over

You must be at least 18 to create an account or submit the application form. We ask you to confirm this at signup and record when you did. If we learn that an account belongs to someone under 18, we delete it. Members can report a profile that appears to belong to a minor.

3. What we collect

We don't collect your date of birth, school grade, phone number or payment details. Please don't put sensitive personal data (health, religion, political opinions, etc.) in your profile or messages.

4. Why we use it and on what legal basis

• Running your account and the platform (profile, projects, applications, connections, messages, endorsements, notification emails): necessary to provide the service you signed up for (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• Showing your public profile and projects so others can find and contact you: part of the service; you can hide your profile at any time (see section 6).
• Safety and abuse prevention (reports, blocks, message rules, keeping a copy of a reported message, rate limits, server logs): our legitimate interest in keeping members safe and the service secure (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• Email log: our legitimate interest in not sending duplicate emails and in diagnosing delivery problems.
• Reviewing applications submitted through /apply: steps taken at your request before you join (KVKK Art. 5(2)(c)).
• Recording your 18+ and policy confirmations: to establish and defend our rights and meet our obligations (KVKK Art. 5(2)(ç), (e)).
• Analytics: only with your consent, given in the cookie banner (KVKK Art. 5(1); GDPR Art. 6(1)(a)). You can withdraw it at any time with “Cookie settings” in the footer.

We don't sell your data, we don't use it for advertising, and we don't make automated decisions about you.

5. Emails

We send sign-in codes, signup confirmation, password reset and email change emails, and notification emails about activity on your account (connection requests and acceptances, applications and their outcome, new messages). All of them are sent from noreply@projecthubstudents.com through our email provider Resend (USA), which processes your email address and the content of the email. These are service emails, not marketing. You can turn notification emails off in your profile settings or with the unsubscribe link in every email; sign-in and security emails can't be turned off. We don't send marketing emails.

6. What is public and what is private

Visible to everyone, including search engines (unless you hide your profile): your full name, username, university, role, bio, skills, availability, links, profile photo and join date; your projects and project updates; endorsements.

Hide my profile: in your profile settings you can hide your profile. Signed-out visitors and search engines then can't see it, it is removed from the sitemap and link previews, and only signed-in members can view it. Your projects stay visible, but without your name for signed-out visitors.

Never public: your email address, messages, applications and their messages, connection requests, notifications, settings, reports and blocks. Messages are visible only to the two people in the conversation; applications only to the applicant and the project owner.

7. Who we share it with, and where it goes

We use the following service providers to run ProjectHub. They process data on our behalf and only to provide their service:

Other members see what is described in section 6. We may disclose data to authorities where the law requires it.

Transfers abroad. Using these providers means your personal data is transferred outside Türkiye: to Ireland (EU) for Supabase and Vercel, and to the USA for Resend and Google, and potentially to the USA for Supabase and Vercel too, as US companies that may access the data. The table above lists which provider receives which data and why.

For Google Analytics the transfer is based on your explicit consent, given in the cookie banner (KVKK Art. 9(6)(a)). The other transfers are necessary to provide the service you signed up for (KVKK Art. 9(6)(b)). This exception is meant for transfers that are not regular or repeated. For ongoing transfers, the KVKK expects standard contracts notified to the Personal Data Protection Authority. We have not yet signed KVKK standard contracts with these providers or notified the Authority; we will update this policy when we do.

Supabase, Vercel and Resend each have a data processing agreement that forms part of their terms of service and incorporates the European Commission's Standard Contractual Clauses (2021/914). These are the providers' EU-law safeguards. They are not KVKK standard contracts.

8. How long we keep it

• Account, profile, projects, messages, connections, applications, endorsements, notifications, settings and confirmations: until you delete your account. Deletion is immediate.
• Email log: 90 days, then deleted automatically.
• Application form (/apply): until we decide on it, then 12 months after the decision, then deleted automatically. It is also deleted when you delete an account with the same email.
• Reports: 12 months after they are filed, then deleted automatically. If you delete your account, reports you filed or that concern you are kept without your account link until then.
• Server logs and backups: for the limited periods set by our hosting providers; deleted data can remain in their backups until those are overwritten.
• Analytics: according to the data retention setting of our Google Analytics property.

9. Deleting your account

You can delete your account yourself in Profile settings → Delete account. This permanently deletes your profile and photo, your projects and their updates and applications, your messages (for both people in the conversation), your applications, connections, endorsements, notifications, blocks, email log, confirmations, and any /apply submission made with your email address.

10. Your rights

Under Article 11 of the KVKK (and the GDPR, where it applies) you can:

• learn whether we process your data and request information about it;
• learn the purpose of processing and whether data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask us to correct incomplete or inaccurate data (you can also edit your profile yourself);
• ask us to delete or destroy your data (you can also delete your account yourself) and to notify third parties of this;
• object to a result against you arising from analysis exclusively by automated systems;
• claim compensation if you suffer damage from unlawful processing;
• get a copy of your data in a portable format;
• withdraw your consent to analytics cookies at any time.

To make a request, including a request for a copy of your data, email yigitalpyazici53@gmail.com from the email address on your account. We reply within 30 days at the latest. If you're not satisfied, you can complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) in Türkiye, or to your local data protection authority.

11. Cookies

We use cookies that are strictly necessary to keep you signed in, and Google Analytics cookies only if you accept them in the cookie banner. Details of every cookie are in the Cookie Policy.

12. Security

Data is encrypted in transit, access is restricted by database row-level security so members can only read what this policy says they can, and passwords are stored only as hashes. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

13. Changes to this policy

When we change this policy materially we update the date above and ask you to confirm the new version the next time you use ProjectHub.