Privacy Policy

This page explains, in plain language, what data is collected when you use İyziWeb, what it is used for and who it is shared with. If anything is unclear, write to us.

Data we collect

Account information

When you sign up we take your email address and password. The password is never stored in plain text; it is hashed with PBKDF2-SHA256. An optional name is used only to address you. If you sign in with Google, we receive only your name, email address and profile information from Google — we never see your Google password.

Content you create

The request you write, your answers to the questions, the colours you pick and your chat history are stored. Without them your site cannot be built and you cannot pick up where you left off.

Files you upload

Images you upload are placed into your site. From documents we extract only the text, which is used to write your site's content; the document itself is never placed on the site or served publicly. Uploads that don't turn into a build are deleted within an hour at the latest.

Usage and security data

Credits spent per build, duration and model usage are recorded for billing and capacity planning. IP addresses and access logs are kept for security. For published sites we also retain the traffic records that hosting providers are required to keep under Turkish law (minimum one year, maximum two years).

Rejected requests

When a request is not built because it was found unlawful, a summary of it is recorded together with the reason. This exists both to spot abuse and to correct a wrong rejection; it is kept for at most two years.

Visitors to the sites you publish

A small counter is added to the site you publish. It records page views, messages sent through the site's forms and WhatsApp order clicks so that you can see them in your admin panel. It uses no cookies and does not track visitors across sites. You are the controller of the data you collect from your visitors (for example a name or phone number in a form message); we host that data on your behalf.

Why we collect it

• To open your account and keep you signed in
• To build, store and publish your site
• To keep the credit balance and to prevent abuse and prohibited content
• To keep the service running and to fix faults
• To keep records the law requires us to keep (such as traffic data)

We do not use your data for advertising, we do not sell it, and we do not open it to third parties for profiling.

Third parties we share with

To build your site and run the service, some of your data goes to these providers:

• Anthropic (Claude) — your requests and answers are sent to generate site copy, design and blog posts (United States)
• Runware — only image descriptions are sent, to generate AI images (United Kingdom)
• Resend — verification and password-reset emails are sent from here; your email address is processed (EU infrastructure, US-based company)
• Cloudflare — domain, CDN, firewall and email routing; your IP address passes through this network (global)
• Google — only if you use Sign in with Google, for authentication; our pages also load typefaces from Google Fonts (United States)

We do not share your data with anyone else. If a legal obligation arises we provide only what is strictly required, and only to the competent authority.

Where it is stored

Your account and content data are held in a MongoDB database on our own access-restricted server, hosted in Türkiye (Hostabil Bilişim Teknolojileri data centre). The site files you generate are stored on the same infrastructure. Connections are encrypted with HTTPS.

If you are located in the European Economic Area or the United Kingdom, please note that using İyziWeb involves a transfer of your data to Türkiye and to the providers listed above.

How long it is kept

For as long as your account is open. When you delete your account, the sites you built, your chats and your uploads are deleted; only records we are legally required to retain (traffic data for one to two years; once sales begin, invoice records for the periods set by tax and commercial law) are kept until their retention period expires.

Cookies

We use only one strictly necessary session cookie for signing in; we have no advertising or tracking cookies. See the Cookie Policy for details.

Your rights

You can ask us to give you a copy of your data, to correct it, to delete it, or to object to how it is processed. Depending on where you live you may have further rights under local law. To exercise any of them, write to info@appfellas.dev from the email address registered to your account. We respond free of charge and within thirty days at the latest.