Privacy Policy

1. Controller

Privacy enquiries: privacy@oddheron.com
General contact: hello@oddheron.com

2. Website delivery and security

This website is delivered through Cloudflare. When you access it, Cloudflare may process technical connection information such as your IP address, request details, browser information, and security signals to deliver and protect the service. The legal basis is our legitimate interest in providing a reliable and secure website under Article 5(2)(f) of Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK) and, where applicable, Article 6(1)(f) GDPR.

We use Cloudflare Turnstile on our forms to distinguish genuine visitors from automated abuse. Turnstile processes browser and device signals needed for that security check. Odd Heron does not place the raw IP address or Turnstile token in its lead spreadsheet.

3. Waitlist

When you join the Stage waitlist, we process your email address, professional role, consent choice and timestamp, submission identifier, source domain, and confirmation status. We use this data to record your request, send an email-confirmation link, and—only after you confirm the address—send the product updates you requested.

The legal basis for ongoing waitlist updates is your explicit consent under KVKK and, where applicable, Article 6(1)(a) GDPR. You may withdraw consent at any time without affecting processing that occurred before withdrawal. Confirmation links expire after 30 days. Each confirmation email also provides a secure cancellation link, and future waitlist updates must provide an unsubscribe link.

An unconfirmed waitlist entry is deleted 30 days after submission. A confirmed entry is deleted when you withdraw or unsubscribe, or after 24 months without a meaningful interaction, unless a limited record must be kept to honor an opt-out.

4. Demo requests

For a demo request, we process your name, email address, project description, submission details, and follow-up status. If you provide them, we also process your public profile URL, audience range, and collaboration interest. These optional details are reviewed by a person to assess demo fit or a potential collaboration; they are not used for automated eligibility decisions.

Processing is necessary to respond to your request and take steps before a possible contract under Article 5(2)(c) KVKK and, where applicable, Article 6(1)(b) GDPR. Where that basis does not apply, we rely on our legitimate interest in responding to genuine business enquiries under Article 5(2)(f) KVKK and, where applicable, Article 6(1)(f) GDPR.

We retain an active request while follow-up is genuinely ongoing. If it does not become a customer relationship, we delete the lead record 18 months after the last meaningful contact. Customer, contract, and accounting records are subject to a separate retention schedule and applicable legal obligations.

5. Email delivery

We use Resend to deliver waitlist confirmation requests, demo-request confirmations, and internal demo notifications. Resend receives the email address and message information necessary to deliver these messages. Internal demo notifications omit the private project description; that information remains in the restricted lead spreadsheet.

6. Storage and recipients

Form submissions are stored in a restricted Google Workspace spreadsheet. Access is limited to authorized Odd Heron accounts. We do not sell form data. We disclose it only to service providers required for hosting, security, storage, and email delivery, or where disclosure is legally required.

• Cloudflare, Inc. — website delivery, Worker processing, rate limiting, and Turnstile security
• Google — Google Workspace spreadsheet and operational email storage
• Plus Five Five, Inc. (Resend) — transactional email delivery

7. International data transfers

Some service providers or their subprocessors may process data outside the European Economic Area. Where required, transfers are protected by an applicable adequacy decision, the European Commission's Standard Contractual Clauses, or another safeguard recognized under data-protection law. Current provider documentation is available from Cloudflare, Google Workspace, and Resend.

8. Your rights

Under KVKK and, where applicable, GDPR, you may request information about processing and ask for correction or deletion of your personal data. Depending on the applicable law and circumstances, you may also request restriction or transfer of your data and object to processing. You may withdraw consent at any time. To exercise these rights, email privacy@oddheron.com. We may request limited information necessary to verify that the request concerns your data.

9. Right to complain

Please contact us first so we can address your request. Where the conditions under applicable law are met, you may lodge a complaint with the competent data-protection authority. For a controller currently established in Türkiye, this is:

Where GDPR applies, you may also complain to an EU or EEA supervisory authority, particularly in the country of your residence, workplace, or the alleged infringement.

10. Analytics and cookies

We currently do not use optional audience analytics or advertising trackers. Security technology used to protect the forms is limited to what is necessary for abuse prevention. If optional analytics or similar technologies are introduced, this policy and any required consent controls will be updated before activation.

11. Changes to this policy

We will update this policy when our forms, purposes, service providers, legal identity, or applicable requirements change. The date at the top identifies the current version.