Privacy policy
This policy explains what personal data we process when you visit this website, subscribe to our newsletter or write to us, why we process it, and the rights you have. We apply the same strict rules to every visitor, wherever they are.
Who we are
The data controllers are Oğuzhan Yıldıko and Samet Sevindik. For any privacy question or request, write to info@braceica.com.
Braceica is a research project in development. We do not sell products on this website and we do not ask for health information.
Summary
- We collect your email address only if you subscribe to the newsletter.
- We run analytics only if you allow it, and we use our own analytics — no advertising or third-party trackers.
- We do not store IP addresses or full browser identifiers in our databases.
- We do not sell or share personal information, and we do not use it for advertising.
- You can withdraw consent, unsubscribe or ask us to delete your data at any time.
What data we collect
Newsletter. If you subscribe, we store:
- your email address;
- your confirmations (privacy policy read, age 16 or older, consent to receive the newsletter) and the version of the consent text you agreed to;
- where on the page you subscribed (top or bottom of the page) and the site language;
- the subscription status and the dates you subscribed, confirmed or unsubscribed;
- random tokens used for the confirmation and unsubscribe links.
We never ask for your name, age, date of birth, diagnosis or any other health information. Please do not send us health information by email.
Analytics (only with your consent). We record a random visitor identifier, a session identifier, the pages and sections you view, how far you scroll, clicks on our contact links, whether a newsletter signup succeeded (never the email address), the domain of external links you follow, the domain of the site that referred you, campaign (UTM) parameters, your device type, browser family, operating system family and browser language, and the time of each event. We do not store your IP address, your full browser identifier (user agent), your precise location or anything you type into forms. Analytics data is never linked to your email address.
Consent records. When you make a choice in the privacy banner, we record the choice, the categories, the version of the text you saw, whether your browser sent a Global Privacy Control signal and the time. If you accept, the record contains your random visitor identifier; if you reject, it does not.
Bot protection. When you use the newsletter form, Cloudflare Turnstile checks whether the request comes from a person. Cloudflare processes technical data such as your IP address and browser characteristics for this purpose; we only receive the result of the check.
Technical data. Our hosting and backend providers necessarily process technical data such as IP addresses to deliver pages and keep the service secure. We do not store this data in our own databases.
Email. If you write to us, we process your email address, your message and any information you choose to include, in order to reply.
Purposes and lawful bases
| Processing | Purpose | Lawful basis |
|---|---|---|
| Newsletter | Sending you updates about the project | Your consent |
| Analytics | Understanding how the website is used, to improve it | Your consent |
| Bot protection (Cloudflare Turnstile) | Protecting our forms from automated abuse | Our legitimate interest in security; strictly necessary |
| Storing your privacy choice and consent records | Remembering your choice and being able to prove consent | Strictly necessary; legal obligation |
| Replying to your email | Answering your message | Our legitimate interest; steps at your request |
Recipients and sub-processors
We use the following service providers, who process data on our behalf under data processing agreements:
| Provider | Service | Data |
|---|---|---|
| Supabase | Database and server functions | Newsletter, analytics and consent records |
| Google (Firebase Hosting) | Website hosting | Technical request data |
| Cloudflare (Turnstile) | Bot protection | Technical data during the check |
When we start sending newsletters, we will add the email provider we use to this list before the first send.
We do not sell or share personal information, and we do not disclose it to advertisers or data brokers. We may disclose data where the law requires it.
International transfers
Our database is hosted in the European Union. Our hosting and bot protection providers operate globally. Depending on where you are, using this website therefore involves a transfer of personal data to another country.
Where data leaves the EU/EEA, the United Kingdom or Switzerland, we rely on adequacy decisions or on the European Commission’s Standard Contractual Clauses (and their UK and Swiss equivalents) or the EU–US Data Privacy Framework where the provider is certified. For transfers from Türkiye we rely on the safeguards in Article 9 of Law No. 6698 (KVKK), such as standard contracts notified to the Personal Data Protection Authority, or on your explicit consent where applicable. For visitors in China, see the PIPL section below.
How long we keep data
| Data | Retention |
|---|---|
| Newsletter subscription | Until you unsubscribe. After that we keep a minimal record that you unsubscribed, so we do not email you again. |
| Analytics events | 13 months, then deleted automatically |
| Consent records | 3 years, then deleted automatically |
| Emails you send us | As long as needed to handle your message |
| Analytics identifiers in your browser | Until you withdraw consent, or 12 months at most |
Your rights
Depending on where you live, you have the right to: know whether we process your data and get a copy of it; have it corrected; have it deleted; restrict or object to processing; receive it in a portable format; and withdraw your consent at any time, without affecting processing that happened before.
To unsubscribe, use the link in any newsletter email. To withdraw analytics consent or delete your analytics data, use “Privacy choices” in the footer of every page. For any other request, write to info@braceica.com. We answer within the period required by law, and in any case within 30 days. We may ask for information to confirm your identity; we will never ask for more than needed.
You also have the right to lodge a complaint with a data protection authority, for example in the country where you live or work.
Children
This website is not directed at children under 13, and the newsletter is only available to people aged 16 or older. If you believe a child has given us personal data, write to info@braceica.com and we will delete it.
Security
Our databases are not accessible from the website directly: data can only be written through our server functions, which validate every request. Access to the data is limited to the people who need it.
Türkiye (KVKK)
This section is our information notice (aydınlatma metni) under Article 10 of Law No. 6698 on the Protection of Personal Data.
- Data controllers: Oğuzhan Yıldıko and Samet Sevindik. Contact: info@braceica.com.
- Purposes: sending the newsletter, website analytics, security of our forms, and replying to messages, as described above.
- Recipients and purposes of transfer: our service providers listed above, including providers abroad, solely to provide these services.
- Method and legal reason of collection: electronically, through the website forms, the privacy banner and email; based on your explicit consent (newsletter, analytics), our legitimate interest (security, replies) and our legal obligations.
- Your rights under Article 11: to learn whether your data is processed and request information; to learn the purpose and whether data is used accordingly; to know the recipients in Türkiye or abroad; to request correction, deletion or destruction and notification of these to recipients; to object to results against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
Commercial electronic messages are sent only with your consent under Law No. 6563. Before sending any bulk commercial email we will register with the Message Management System (İYS) as required.
European Union, EEA and United Kingdom (GDPR, UK GDPR)
We process your data on the lawful bases listed above. Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interest, you can object. We do not make decisions about you based solely on automated processing. Device storage used for analytics is set only after you opt in, in line with the ePrivacy Directive and PECR.
Switzerland (nFADP)
The rights and transfer safeguards described above also apply to visitors in Switzerland under the revised Federal Act on Data Protection.
United States
Notice at collection. We collect identifiers (your email address, if you subscribe) and internet activity information (analytics, only with your consent) for the purposes described above, and keep them for the periods listed in “How long we keep data”.
We do not sell or share personal information, as those terms are defined under California law and other state privacy laws, and we do not use it for targeted advertising or profiling. We honor the Global Privacy Control (GPC) signal: if your browser sends it, analytics stays off unless you turn it on yourself.
Residents of California and other states with privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas and Oregon) can ask to know, access, correct and delete their personal information, and will not be discriminated against for exercising these rights. You may use an authorized agent. If we decline a request, you can appeal by replying to our decision at info@braceica.com. Our emails comply with the CAN-SPAM Act and always contain an unsubscribe link and our postal address.
Canada (PIPEDA, CASL)
We send commercial electronic messages only with your express consent. Every message identifies us, includes our contact details and lets you unsubscribe.
China (PIPL)
If you are in mainland China, we process your personal information only with your consent. Your data is transferred to and stored outside China, by the overseas recipients listed in “Recipients and sub-processors” (contact: info@braceica.com), for the purposes described above. You can exercise your rights against these recipients by writing to the same address. You have the right to access, copy, correct and delete your personal information and to withdraw consent.
Brazil (LGPD)
The lawful bases and rights described above apply to visitors in Brazil under the General Data Protection Law. You can contact our privacy contact at info@braceica.com.
Other regions
The same rules apply to visitors everywhere else, including under Japan’s APPI, South Korea’s PIPA, India’s Digital Personal Data Protection Act 2023 and Australia’s Privacy Act. If your local law gives you additional rights, write to info@braceica.com.
Changes to this policy
If we change this policy, we will update the date and version at the top of this page. If a change affects what you consented to, we will ask for your consent again.