Privacy Policy and KVKK Information Notice

This policy explains how Reaktör Teknoloji Ticaret Limited Şirketi, trading as Reactll ("Reactll", "we", "us"), processes personal data when you visit reactll.com, write to us, use our free Security Check, receive email from us, use the Reactll app, or work with us as a client or business contact.

It is our privacy notice under the EU General Data Protection Regulation (GDPR, Art. 13 and 14), the UK GDPR and the Swiss Federal Act on Data Protection. It is also our only information notice (aydınlatma metni) under Art. 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). The Turkish and English texts give the same information; for the information notice under the KVKK, the Turkish text prevails.

Hosting, providers and security measures are described in more detail on our Data protection and security page (/data-protection). That page is background for clients' procurement teams. It is not a privacy notice, and this policy prevails over it.

This policy does not cover the Racool app, which has its own privacy policy at /apps/racool/privacy.

1. Who is responsible

The controller (veri sorumlusu) is:

• Reaktör Teknoloji Ticaret Limited Şirketi (trading as Reactll)
• Şahkulu Mah. Serdar-ı Ekrem Cad. No: 15/A, Galata, 34430 Beyoğlu, İstanbul, Türkiye
• Istanbul Trade Registry no. 298746-5 · MERSİS no. 0734209102400001
• Email: [email protected] · Phone: +90 538 827 21 47

We have not appointed a data protection officer. Privacy questions go to [email protected].

When we are not the controller. We build and run websites, stores and apps for clients. The data of a client's own visitors and customers is processed by us on the client's behalf, as their processor (veri işleyen), under our Data Processing Agreement (/legal/dpa). Examples are enquiries sent through the client's site, orders and visits. For that data the client is the controller. Please read the client's own privacy notice and send your requests to the client; we will help them answer.

2. What we process, why, and on what legal basis

For each feature below, we set out what we process and why. "KVKK" refers to the legal bases in Art. 5(2) of Law 6698 (explicit consent: Art. 5(1)). "GDPR" refers to Art. 6(1).

Acting for yourself or for a company. Most people who write to us act for a company. If you are personally a party to a contract with us, we rely on the steps before, and the performance of, that contract (KVKK 5(2)(c); GDPR 6(1)(b)). If you act for a company (as an employee, signatory or app user), we rely on our legitimate interest in dealing with the company you represent (KVKK 5(2)(f); GDPR 6(1)(f)).

Do you have to give us data? No. However, we cannot answer an enquiry without an email address, and we cannot send a Security Check report or provide the app without the data marked as required.

2.1 Enquiries: contact form, meeting request, lead form

• Data: your name, email address, company, website, industry and message. A meeting request also records the topic, whether you want a video meeting or email only, your preferred days, time window and time zone. We also record the answers you pick in the form (situation, timeline), the page and button you sent it from, and the language of the page.
• Linked to the enquiry: your visit to our site (the pages you viewed before writing and how you arrived; see 2.4). If you chose an industry in the site's industry selector, we record that too.
• Purpose: to reply, to prepare and hold a meeting, to prepare an offer, and to keep a record of the conversation.
• Preparing our reply: to understand who has written, we read public information about the company behind your email domain or website: its website, its public DNS and mail set-up, and its public domain registration (RDAP) data. Our team may use an AI service to draft a reply: Anthropic, or OpenAI as an alternative (see section 4). A person reviews every reply before it is sent.
• Receipt: we email you a confirmation that we have received your message.
• Legal basis: as stated in the introduction to section 2 (contract or legitimate interest). Preparing our reply is based on our legitimate interest in answering business enquiries and understanding who they come from (KVKK 5(2)(f); GDPR 6(1)(f)).

2.2 Free Security Check (/tools/security-check)

• To run a check, you give us a web address and confirm that you own the site or have permission to check it. We fetch that page and the scripts it loads, as a browser does. The result is kept for one hour so that a report can be generated, and is then deleted. Our analytics records that a check was run and for which host.
• If you ask for the PDF report, you give us your name and email address. We then keep, as an enquiry: your name, your email address, the checked host, and a summary of the findings (the counts, and up to six critical or warning findings). Section 2.1 then applies.
• Legal basis: providing the tool you asked for (KVKK 5(2)(c), or 5(2)(f) where you act for a company; GDPR 6(1)(b)/(f)). Following up the report is based on our legitimate interest in following up a security problem you asked us to look at (KVKK 5(2)(f); GDPR 6(1)(f)).

2.3 Emails we send you

Emails our team sends from our system (replies, proposals, reports and follow-ups):

• Tracked links. Links in these emails pass through our server, so that we can see which link was clicked. We log the time, the link, your browser's user-agent string and a shortened IP address (with the last part removed).
• Open tracking outside Europe. For recipients outside the EU/EEA, the UK and Switzerland, these emails also contain a small image that tells us when the email was opened. We log the same details for an open. You can block the image by turning off remote images in your email program.
• No open tracking in Europe. Emails to recipients in the EU/EEA, the UK and Switzerland contain no such image.
• Purpose: to know whether our correspondence arrives and is read, to tell people apart from automated link scanners, and to follow up at the right time.
• Legal basis: our legitimate interest in following up our business correspondence (KVKK 5(2)(f); GDPR 6(1)(f)). You can object at any time by replying to the email. We then stop tracking emails to you.

The hq_contact cookie

• Clicking a link to reactll.com in one of these emails can set the first-party hq_contact cookie, which lasts one year. The cookie connects your later visits to our site to your contact record.
• We set and read it only if you have accepted analytics cookies in our cookie banner.
• If you withdraw that consent in Cookie Settings, we stop reading the cookie.
• Legal basis: your consent (KVKK 5(1); GDPR 6(1)(a); ePrivacy Directive Art. 5(3), as implemented in your country).

Emails to people who have not written to us first

• These business emails are written and sent by a person, never automatically.
• Every marketing or sales email carries a link to stop further emails. We act on it within three business days.
• Service emails about a project, an invoice or an incident do not carry this link.
• We do not send unsolicited business email to recipients in Germany. In the Netherlands, we send it only to general company addresses, never to a named person's address.
• Legal basis: our legitimate interest in developing business relationships (KVKK 5(2)(f); GDPR 6(1)(f)). You can object at any time.

2.4 Website analytics

Without cookies, for every visitor

Our own analytics records:

• the pages you view and the time you spend on them;
• the referring site and campaign tags (UTM);
• your language, device type, browser, operating system and screen width;
• your country, taken from Cloudflare's network headers (and, where our network provider supplies them, your region and city).

How we count a visit without storing your IP address:

• We combine your IP address and browser identifier with a random value, then turn the result into a hash.
• The random value is replaced every day.
• We do not store the IP address. Once the day is over, we cannot link the hash back to an address.

We record events with the visit, such as pressing a button, opening a form or downloading a file.

Visitors from Germany and Austria: we count visits only after you consent.

Only if you accept analytics cookies

• A random identifier (reactll_visitor, 395 days) lets us recognise a return visit.

Other points

• How long your cookie choice lasts: we keep it for 12 months and then ask again.
• When you write to us: we link your visit to your enquiry, so that we can see what you read before writing.
• Retention: our own analytics is deleted automatically after 24 months.

Legal basis

• Cookieless counting: our legitimate interest in measuring and improving our site (KVKK 5(2)(f); GDPR 6(1)(f)). In Germany and Austria, your consent.
• Cookies: your consent (KVKK 5(1) and the KVKK Cookie Guidelines; GDPR 6(1)(a); ePrivacy Art. 5(3)).

The Cookie Policy (/cookie-policy) lists every cookie and local-storage entry, including the strictly necessary ones: session, security token, your cookie choice and your industry choice.

2.5 Clients and business contacts (our CRM)

• Data: your name, business email and phone, job title and company; our correspondence and meeting notes; projects, tasks, and proposals (including whether they were opened); invoices and payments; and acceptances of our DPA. For people we deal with, our team may add professional information that the person has made public, such as a LinkedIn profile link. We use it only to keep in touch with you about business.

• We do not import profile photos from LinkedIn or other public sources.

• Sources: you; your colleagues; and public sources (your company's website, public business registers and profiles, LinkedIn).

• Lead scoring: we rank enquiries and contacts to decide whom to reply to first. The ranking uses signals such as the source, form answers, visits and email engagement. It never produces a decision with legal or similarly significant effects; a person decides.

• Purpose: to make, perform and manage our contracts, to invoice, to keep the business records the law requires, and to develop business relationships.

• Legal basis: as stated in the introduction to section 2 (contract or legitimate interest), plus:

  • legal obligations, such as keeping commercial and tax records (KVKK 5(2)(ç); GDPR 6(1)(c));
  • establishing, exercising or defending legal claims (KVKK 5(2)(e));
  • for professional information the person has made public: KVKK 5(2)(d), limited to the purpose for which it was made public.

  Where we obtain your data from someone other than you, this section is our notice under GDPR Art. 14.

2.6 The Reactll app (iOS and Android)

The app is for our clients and for people who check a website with it.

• Account: your email address (you sign in with a one-time code sent to it), your name and, if you add it, your phone number.
• Profile (optional): job title, city, LinkedIn link, birthday, how you prefer to be contacted, whether you want our emails, and a profile photo.
• Support requests: the text, photos, PDF files and voice notes you send to our team.
• What you add: competitors you ask us to track (names and links), "I'm interested" notes you send us, and the website addresses you check. Screenshots from website checks are deleted after 30 days, except for the latest check of each site.
• Device: a push notification token and your device name, so that notifications reach the right phone.
• Messages from us: whether a message from Reactll was delivered, seen, opened, tapped or dismissed.
• AI:
  • When you record a voice note, the recording is sent to OpenAI (model gpt-4o-transcribe) to be turned into text. The app asks for your consent before the first recording.
  • Plain-language summaries of a website check, and draft replies to Google reviews that our team may suggest, are written by an AI model (Anthropic, or OpenAI as an alternative). The model works from the check results and the public review text, including the reviewer's public name.
  • We use these providers' APIs under their business terms, under which API data is not used to train their models.
• The app shows no ads and does not track you across other companies' apps or websites. We do not sell any of this data.
• Deleting your account: you can delete your account in the app.
  • This removes your app sign-in, devices, notifications and message history, and your profile photo. It also removes the phone, job title, city, LinkedIn, birthday, contact preferences and email opt-in on your profile.
  • We keep your name, email address and company on our client record, together with your support requests and invoices, because we need them to serve and bill your company (see section 6).
  • Website checks you ran are kept, but no longer linked to your account.
  • To have the rest removed as well, write to [email protected].
• Follow-up emails after a website check report: if you ask for a website check report in the app, we may send two short emails, on day 3 and day 10.
  • They are sent automatically only to an address on the checked site's domain. Any other address receives them only after you tap "Remind me".
  • Each email has an opt-out link.
  • The emails stop when you write to us, become a client or opt out.
• Weekly re-check: if you asked for it, we re-check the site you follow every week and send you the new score as a notification.
• Legal basis:
  • providing the app: contract, or legitimate interest where you act for a company (introduction to section 2);
  • voice notes and notifications: your consent (KVKK 5(1); GDPR 6(1)(a));
  • follow-ups you started: our legitimate interest (KVKK 5(2)(f); GDPR 6(1)(f)).
• Data we process for your company (enquiries, visits, orders, reviews of your own business): we act as your processor; see section 1.

2.7 Security, abuse prevention and legal compliance

What we do:

• We keep server and error logs.
• We limit how often forms and the Security Check can be used.
• We run hidden spam traps in forms.

Legal basis: our legitimate interest in keeping our systems secure (KVKK 5(2)(f); GDPR 6(1)(f)), and our legal obligations (KVKK 5(2)(ç); GDPR 6(1)(c)). The retention period for server logs is in section 6.

We do not intend to process special categories of personal data (KVKK Art. 6; GDPR Art. 9). Please do not send them to us. We do not build or run systems that process such data for clients unless the Board's measures for special categories (decision 2018/10) are in place.

2.8 Buying a package on the site

• Data: your company's name, address and tax or VAT number; your name, work email and phone; the address of the system to review, and any notes; the package, price and currency; when you accepted the terms, which version, and from which IP address; the result of the payment.
• Card details: you type them into the form of our payment provider, iyzico. They go directly to iyzico and never reach us. We receive only the result of the payment.
• Purpose: to take the order and the payment, deliver the review, issue the invoice and keep the records the law requires.
• Receipt: when the payment succeeds, we email you a confirmation.
• Legal basis: the contract (KVKK 5(2)(c); GDPR 6(1)(b)) and our legal obligations (KVKK 5(2)(ç); GDPR 6(1)(c)).

3. How we collect data

• By automated means: through the forms, the Security Check, the app, our analytics and cookies, and our email system.
• By partly automated means: through the entries our team makes in our CRM.
• From public sources: as described in 2.1 and 2.5.

4. Who receives your data

We do not sell or rent personal data, and we do not share it for targeted or cross-context behavioural advertising.

Our service providers receive data and act on our instructions as processors. Each provider receives only the data its purpose requires.

Recipients in Türkiye:

• iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), our licensed payment institution, which receives your order's billing details, name, email and phone and the card details you give it, to take the payment and prevent fraud (KVKK 8(2)(a), 5(2)(c), 5(2)(ç));
• our accountant and banks, which receive invoice and payment data to meet our legal obligations (KVKK 8(2)(a), 5(2)(ç));
• courts, public prosecutors and other authorities, where the law requires it (KVKK 8(2)(a), 5(2)(ç); GDPR 6(1)(c));
• our legal and tax advisers, to establish, exercise or defend a right (KVKK 5(2)(e)).

Sale of the business: if all or part of the business is sold or merged, the buyer receives the data and is bound by this policy.

5. Transfers abroad

Our registered office and most of our team are in Istanbul. Our managing director works from the Netherlands. No one accesses client or CRM personal data from the United States.

We transfer personal data to the following countries:

Under Turkish law (KVKK). These are transfers abroad within the meaning of KVKK Art. 9. The Personal Data Protection Board has not issued an adequacy decision for any of these countries.

Under the GDPR (EU, UK, Switzerland). When we collect your data directly from you, the GDPR applies to us directly (Art. 3(2)). Your data is then processed by us in Türkiye and by the providers listed above, some of them in the United States. For data we process on a client's behalf, the transfer terms are in our Data Processing Agreement (/legal/dpa), which incorporates the EU Standard Contractual Clauses.

You can ask us for more information about these transfers at [email protected].

6. How long we keep data

When a period ends, we delete, destroy or anonymise the data (KVKK Art. 7 and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data). The exception is data we need to establish, exercise or defend a legal claim, which we keep until the limitation period for that claim ends.

7. Your rights

If Turkish law applies (KVKK Art. 11)

You have the right to:

• learn whether your personal data is processed;
• request information about it, if it is;
• learn the purpose of the processing, and whether your data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom your data is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for your data to be erased or destroyed under the conditions of KVKK Art. 7;
• ask that the third parties who received your data are told about a correction, erasure or destruction;
• object to a result against you that arises from analysis exclusively by automated systems;
• claim compensation for damage you suffer because of unlawful processing.

If the GDPR, UK GDPR or Swiss law applies

You have the right to:

• access your data (Art. 15);
• have it corrected (Art. 16);
• have it erased (Art. 17);
• restrict its processing (Art. 18);
• data portability (Art. 20).

Right to object: you can object at any time to processing based on our legitimate interests, and to direct marketing (Art. 21).

Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect processing that happened before (Art. 7(3)). We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22).

Visitors in the United States

We do not sell or share personal information as those terms are defined in US state privacy laws, and we do not use it for targeted advertising. You can ask us for access to, correction of or deletion of your personal information at [email protected]. We answer within 45 days, and we will not treat you differently for asking.

8. How to exercise your rights

Under the KVKK. Send your request in Turkish, as set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of these methods:

• in writing, signed in wet ink, to the registered office address in section 1;
• with a secure electronic signature or mobile signature;
• by email to [email protected], from the email address you have previously given us and that is registered in our systems.

Your request must include:

• your name and surname, and your signature (for written requests);
• your Turkish ID number, or, for foreign nationals, your nationality and passport or ID number;
• your residential or business address for notification;
• your email address or phone number, if you have one;
• what you are asking for.

We record every request.

• Deadline: we answer within 30 days at the latest.
• Cost: answering is free. If it causes an additional cost, we may charge the fee set by the Board: up to 10 pages free, then 1 TL for each further page; for a recording medium, its cost.
• Complaint: if we reject your request, our answer is insufficient, or we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr). You must do so within 30 days of learning our answer, and in any case within 60 days of your request (KVKK Art. 14). You must apply to us before you can complain to the Board (KVKK Art. 14(2)).

Under the GDPR, UK GDPR or Swiss law. Write to [email protected] by any means.

• We answer within one month. For complex requests we can extend this by two months (Art. 12(3)).
• We may ask you to confirm your identity.
• You can also complain to the data protection authority where you live or work (Art. 77). Examples: the Dutch Autoriteit Persoonsgegevens, the authority of your German state, the UK Information Commissioner's Office, or the Swiss FDPIC.

9. Security

• Encryption in transit: traffic to our site is encrypted (TLS, with HSTS).
• Separate servers for client systems: client systems run on their own separate servers.
• Access to our own server: our own server holds our own projects, development and test work, and Reactll Connect data. Only our core team can access it, and access is removed when someone leaves the team.
• Backups: database backups are deleted after 30 days at the latest.
• Availability: we check every five minutes that our websites are reachable. Results for the services we list publicly are at /status.

More detail is on our Data protection and security page (/data-protection).

Personal data breaches:

• Under the KVKK: we notify the Board without undue delay and at the latest within 72 hours, and the people affected as soon as reasonably possible (KVKK Art. 12(5); Board decision no. 2019/10 of 24 January 2019).
• Under the GDPR: we notify the competent authority, and we notify you where the GDPR requires it (Art. 33–34).

10. Children

Our services are for businesses and are not directed at anyone under 16. We do not knowingly collect data from children. If we learn that we have, we delete it.

11. Changes

We publish every change on this page, with a new date and version. We will not use personal data we already hold in a materially different way from what this policy said when we collected it, without first asking for your consent.

12. Contact

Reaktör Teknoloji Ticaret Limited Şirketi · Şahkulu Mah. Serdar-ı Ekrem Cad. No: 15/A, Galata, 34430 Beyoğlu, İstanbul, Türkiye · [email protected]