TR EN

KVKK Privacy NoticeLast Updated: September 28, 2026

English translation. This English version is provided for convenience. The Turkish version is the legally binding text; if there is any discrepancy, the Turkish version prevails. "KVKK" refers to Turkish Law No. 6698 on the Protection of Personal Data.

01 Data Controller

This Privacy Notice has been prepared regarding the personal data processed in connection with the free and paid services offered by HOKAS ("HOKAS", "Platform", "Site") at hokas.net.

The data controller for your personal data is OVVA İLERİ TEKNOLOJİ YAZILIM SANAYİ VE TİCARET LİMİTED ŞİRKETİ, which operates HOKAS.

  • Address: Panayır Mah. 505. Sk. Evke Flex Office Kat:5 No:53 Osmangazi / Bursa
  • Tax Office and No.: Osmangazi Vergi Dairesi - 6491342090
  • Phone: +90 850 309 0621

Contact address for your requests under the KVKK: [email protected]

02 Purpose of this Notice

This Privacy Notice has been prepared under Law No. 6698 on the Protection of Personal Data ("KVKK") to explain:

  • which personal data is processed,
  • for what purposes personal data is processed,
  • by what methods and on what legal grounds personal data is collected,
  • to whom and for what purposes personal data may be transferred,
  • the rights of data subjects under the KVKK.

The obligation to inform is a separate obligation that must be fulfilled whenever personal data is processed. Obtaining explicit consent does not by itself replace the obligation to inform.

03 Personal Data Processed

The following personal data may be processed while you use HOKAS services:

3.1. Identity and Account Information
  • Username
  • Account information
  • Authentication information provided by Clerk
  • Account information transferred to HOKAS by Google if you sign in with a Google account
3.2. Contact Information
  • Email address

HOKAS does not send emails for direct marketing or advertising purposes. Informational emails about the service, payments and your account may be sent.

During registration and sign-in, verification emails may be sent by Clerk for authentication purposes.

3.3. Transaction Security Information
  • IP address (stored in encrypted form)
  • Approximate location derived from the IP address
  • Browser information
  • User-Agent information
  • HTTP header information
  • Session and sign-in information
  • Security and error logs
  • Technical log records related to use of the service
3.4. Hosting and Technical Usage Information

Because users host and deploy their projects and code through HOKAS, the following may be processed in order to provide the service technically:

  • Hosting information associated with the user account,
  • Project/deployment information,
  • Server usage information,
  • Technical logs,
  • Information on resource usage and service status.

The content of projects, files and code uploaded by users may also be processed or stored on servers for technical purposes.

3.5. Order and Payment Information (paid plans)
  • Purchased plan, amount, currency, duration and order/payment status
  • IP address and time information of the payment transaction
  • Information that may be required to issue an invoice under legal obligations

Payment instrument details such as card number, expiry date and CVV are not stored on HOKAS servers; they are processed only by the payment service provider.

3.6. Cookie and Analytics Information

If you consent, anonymized usage statistics (page views, device, approximate location, etc.) are processed through Google Analytics. Details are in Section 6.

04 Methods of Collecting Personal Data

Your personal data may be collected automatically or in electronic form through the following methods:

  • creating a membership on hokas.net,
  • signing in,
  • signing in with Google,
  • the Clerk authentication system,
  • the HOKAS website and API requests,
  • HTTP header and User-Agent information,
  • server and security logs,
  • cookies,
  • hosting and deployment operations,
  • technical system records.

05 Purposes of Processing Personal Data

The personal data collected may be processed for the following purposes:

  1. Creating and managing the HOKAS account,
  2. Verifying user identity,
  3. Carrying out sign-in with Google and other authentication processes,
  4. Providing hosting and deployment services,
  5. Hosting user projects,
  6. Operating server and network services,
  7. Ensuring service security,
  8. Detecting and preventing unauthorized access,
  9. Detecting abuse, spam, attacks and other security threats,
  10. Identifying and resolving technical problems,
  11. Ensuring system performance and service continuity,
  12. Managing user sessions,
  13. Keeping technical records related to use of the service,
  14. Fulfilling legal obligations,
  15. Responding to lawful requests from authorized persons, institutions and organizations,
  16. Managing users' service usage periods and uptime information,
  17. Allowing users to use advertising services to obtain additional uptime,
  18. Keeping HOKAS services secure and operational.

06 Cookies

Cookies and similar technologies are used on the HOKAS website in two groups:

  • Strictly necessary cookies: Required for session management, authentication (Clerk), security and the technical operation of the site. No consent is sought for these.
  • Analytics cookies: Used through Google Analytics to improve the site. They are enabled only with your consent in the cookie notice; if you do not consent, they are not loaded.

You can change or withdraw your preference at any time using the "Cookie Preferences" link at the bottom of the site. You can also block or delete cookies in your browser settings; however, if strictly necessary cookies are blocked, sign-in and session management may not work.

Details on cookies are in the Privacy Policy.

07 Advertising and Additional Uptime Service

HOKAS offers free and paid plans. On the free plan, users may use third-party ad/link services to increase their service usage time. There is no obligation to watch ads on paid plans.

Advertising revenue generated by watching ads belongs to the Company, the data controller.

While advertising services are provided, third-party ad or link service providers may process some technical information about the user. The providers' own privacy and data processing policies apply separately.

Independently of the data that the ad service provider processes on its own systems, HOKAS aims to carry out the processing within its own data controller responsibility in accordance with the KVKK.

08 Legal Bases for Processing Personal Data

Depending on the nature of the specific processing activity, your personal data may be processed under the legal grounds in Article 5 of the KVKK.

These may in particular be based on the following legal grounds:

  • it is expressly provided for by law,
  • it is directly related to the establishment or performance of a contract,
  • it is necessary for the data controller to fulfill its legal obligation,
  • processing is necessary for the establishment, exercise or protection of a right,
  • processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,
  • explicit consent, where required.

For processing activities that require explicit consent, explicit consent may be obtained separately from the data subject.

09 Transfer of Personal Data

As a rule, HOKAS does not sell personal data to third parties or share it for marketing purposes.

To operate HOKAS services technically, personal data may be transferred to the systems of the service providers used or may be processed by them. The service providers used or that may be used include:

  • Clerk: Authentication, account and session management,
  • Google: Authentication if you sign in with a Google account; usage statistics through Google Analytics if you consent,
  • Payment service provider: Collection of paid plans and payment security,
  • Cloudflare: DNS, CDN, security, traffic management and technical infrastructure,
  • Code library CDN providers (jsDelivr, cdnjs, etc.): Loading of some components of the site,
  • Server and hosting providers: Hosting of HOKAS services,
  • Network and VPN service providers: Technical routing of server and network traffic,
  • ShrinkMe or other ad/URL services used: Provision of advertising and additional uptime services,
  • Internal notification services (e.g. Telegram): Delivery of technical and security alerts to administrators,

and similar third-party services. In addition, information may be provided to authorized public institutions and judicial authorities under legal obligations.

Some of these providers may be located abroad or may process personal data on systems abroad. Transfers abroad are carried out in accordance with the KVKK provisions on transfers of data abroad (including the standard contracts determined by the Board).

10 Content Uploaded by Hosting Users

HOKAS gives its users the ability to host and deploy their projects, code and files.

If content that users upload to HOKAS systems contains personal data, the user who uploaded the content is primarily responsible for the lawful processing of that data.

HOKAS may technically host, store, run, process or transfer between the relevant servers the content uploaded by the user, on the user's behalf.

If users upload personal data belonging to third parties to HOKAS systems, it is the user's responsibility to ensure that the rights of the persons concerned are not violated and that the necessary legal conditions are met.

11 Retention Period of Personal Data

Personal data is retained for as long as the purposes of processing require, taking into account the retention periods set out in the relevant legislation. The main periods applied at HOKAS are:

  • Account and hosting data: Until the account is deleted. It is permanently deleted upon a deletion request.
  • Access/session and transaction security logs (including IP): 365 days, then deleted automatically.
  • Technical error logs: 30 days, then deleted automatically.
  • Containers that have expired or have no time limit defined and have been stopped for 3 days, and the data within them: Deleted automatically.
  • Order, payment and invoice records: For the statutory retention period under tax and commercial legislation (10 years).

When the retention period ends or the reason requiring processing ceases to exist, data is deleted, destroyed or anonymized in accordance with the legislation.

12 Security of Personal Data

HOKAS endeavors to apply technical and administrative security measures to prevent unlawful processing of and access to personal data and to ensure its safekeeping.

In this context, security measures such as the following may be applied:

  • access controls,
  • authentication mechanisms,
  • server security measures,
  • network security,
  • security logs,
  • detection of unauthorized access,
  • technical updates.

Absolute security cannot be guaranteed for any system operated over the internet.

13 Your Rights under the KVKK

Under Article 11 of the KVKK, data subjects have the right to:

  1. Learn whether their personal data is processed,
  2. Request information if their personal data has been processed,
  3. Learn the purpose of processing and whether the data is used in accordance with that purpose,
  4. Know the third parties to whom personal data is transferred in Türkiye or abroad,
  5. Request correction of personal data if it is incomplete or inaccurately processed,
  6. Request deletion or destruction of personal data within the framework of the relevant provisions of the KVKK,
  7. Request that the correction, deletion or destruction of personal data be notified to the third parties to whom the data has been transferred,
  8. Object to the occurrence of a result against the person by analysis of the processed data exclusively through automated systems,
  9. Claim compensation for damages if they suffer loss due to unlawful processing of personal data.

14 How to Apply

To exercise your rights under the KVKK, you can send your requests to the following contact address:

Email: [email protected]

Post: OVVA İLERİ TEKNOLOJİ YAZILIM SANAYİ VE TİCARET LİMİTED ŞİRKETİ, Panayır Mah. 505. Sk. Evke Flex Office Kat:5 No:53 Osmangazi / Bursa

While evaluating an application, reasonable additional information or documents may be requested to verify that the applicant is in fact the data subject.

Applications are evaluated within the procedures and time limits (30 days at the latest) set out in the KVKK and the relevant secondary legislation.

15 Changes to this Privacy Notice

This Privacy Notice may be updated if there are changes to HOKAS's services, technical infrastructure, third-party services used or applicable legislation.

The current text is published at hokas.net.

Last updated: September 28, 2026

Contact: [email protected]