Privacy notice

1. Scope

This notice explains the personal data processed when you use your account and the platform on Cohie (cohie.app). It is prepared under the duty to inform in Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

When you apply to an organization's program or take on a role in a program, the organization running that program is the data controller for the program's data. Its own privacy notice is shown on the program page and in the application form.

2. Data controller

For account data, the data controller is Fauna Venture Studio (Fauna). Its trade name, address, MERSIS number and KEP address are at the end of this page. For data protection requests, write to: kvkk@fauna-studio.com

Two separate records can exist for the same person:

• Account record: created so you can log in to Cohie. Fauna is the controller; this notice covers this record.
• Program data: created when you apply to a program or take part as a juror, mentor, trainer or startup member. It includes form answers, uploaded files, scores, deliverables, attendance and absence excuses, the alumni follow-up survey and alumni directory membership. The organization running the program is the controller. Fauna processes this data only on that organization's instructions, as a processor.

3. Data we process

• Account: full name, email address, password hash (we never store the password itself), email verification status
• Profile (optional): title, organization, phone, LinkedIn link, biography
• Community content: posts and comments you write
• Preferences: language, theme, notification and email preferences
• Sign-in and security: session records (including the address where the session was opened and the sign-in method), IP address, browser information, login attempts
• Two-step verification (if you turn it on): the secret of your authenticator app, stored encrypted, and your recovery codes
• Passwordless sign-in (if you use it): a digest of the email sign-in link and its validity (15 minutes); the name, public key, date added and date last used of the passkeys you add. Your fingerprint, face or PIN never leaves your device and never reaches Cohie
• Organization single sign-on (if you use it): your user ID and email address at your organization's identity provider
• Status verification (if your organization turned it on): your verified organization email address and the verification date
• Calendar subscription (if you use it): the personal subscription link you add to your calendar app
• Communication records: recipient, subject and delivery status of emails sent to you; in-app notifications
• Agreement acceptance: if you accepted the Terms of use and the Data Processing Agreement on behalf of an organization, the time of acceptance, the versions of the texts and your IP address
• Audit log: who performed an important action in an organization's admin area, when, and from which IP address

Limited data is processed even without signing in: your IP address and browser signals during bot protection, and a hash of a random value that recognizes you if you ask the program assistant a question without signing in (section 6).

Your profile and community content can be visible to the teams of programs you take part in and, if the program directory is open, to other participants. The My account page at your organization's address says which information is visible to whom.

4. How we collect data

Data is collected electronically and directly from you through the forms and screens on Cohie. Sign-in, security and communication records are created automatically while you use the platform. If you use organization single sign-on, your user ID and email address come from your organization's identity provider.

5. Purposes and legal bases

• Opening your account, letting you sign in and providing the service: account, profile, preference and community data; two-step verification, passwordless sign-in, single sign-on, status verification and calendar subscription data. Legal basis: establishing and performing a contract (KVKK art. 5/2-c).
• Sending emails and notifications about the service: account data, preferences and communication records. Legal basis: performing a contract (KVKK art. 5/2-c).
• Keeping information secure and preventing abuse and unauthorized access: sign-in and security records, bot protection data, audit log. Legal basis: Fauna's legitimate interest, provided it does not harm your fundamental rights and freedoms (KVKK art. 5/2-f).
• Meeting record-keeping obligations under the law and answering requests from authorized public bodies: sign-in and security records. Legal basis: legal obligation (KVKK art. 5/2-ç), in particular Law No. 5651.
• Answering data protection requests: the information you give in your request. Legal basis: legal obligation (KVKK art. 5/2-ç and art. 13).
• Proving an agreement accepted on behalf of an organization and protecting rights in a possible dispute: agreement acceptance records and the audit log. Legal basis: establishing, exercising or protecting a right (KVKK art. 5/2-e).

Your account data is not used for advertising, is not sold and is not processed to build a profile of you.

6. Cookies and browser storage

Cohie uses only the cookies the service needs to work. There are no analytics, advertising or third-party tracking cookies.

On the public pages of the root domain (such as the product page, open calls, help and legal pages) Cloudflare Web Analytics runs to count visits. It uses no cookies, stores no identifier in your browser and does not recognize you across visits. Cloudflare receives the address of the page you open, the page you came from, your browser and device type, the page load time and the country derived from your IP address. It does not run on the login page, in dashboards or on organization addresses. Legal basis: Fauna's legitimate interest in improving the service (KVKK art. 5/2-f).

• cohie_oturum (__Host-cohie_oturum in production): your login session. HttpOnly, SameSite=Lax, 30 days at most; it ends after 14 days of inactivity. It works only on the address where it was set: each organization's subdomain has its own session, and a session on one organization's address cannot be used on another's.
• cohie_dil: language preference (tr or en), 1 year. It applies across all subdomains of the root domain.
• cohie_tema: light, dark or system theme, 1 year.
• cohie_giris_tarayici (__Host-cohie_giris_tarayici in production): a random value that recognizes the browser that asked for an email sign-in link. HttpOnly, 15 minutes; if you open the link in the same browser, no code is asked.
• cohie_iki_adim (__Host-cohie_iki_adim in production): a single-use value kept while you enter your two-step verification code after your password. HttpOnly, 10 minutes; deleted once the code is verified.
• cohie_oidc (__Host-cohie_oidc in production): a single-use value that matches your request when you sign in with your organization's single sign-on and come back from its identity provider. HttpOnly, 10 minutes.
• cohie_asistan (__Host-cohie_asistan in production): a random value that recognizes a visitor who asks the program assistant a question without signing in. HttpOnly, 30 days; only a hash of it is stored in the database.

Some screens use your browser's own storage. These records stay in your browser:

• cohie_kayit_taslagi: if you leave the organization sign-up form unfinished, the organization name, type and address you entered, for 1 hour
• View preferences on the jury evaluation screen and the state of the animation on the product page
• cohie_uyelik_karti and cohie_cerez_bildirimi: the date the sign-up card on the product pages was shown or closed, and the date you closed the cookie notice, so they are not shown again; at most 180 days

Cloudflare Turnstile runs for bot protection on forms that can be sent without signing in: sign-up, login, password reset, program application, event registration and voting, accepting an invitation, personal data requests, sales requests, following an open call and the program assistant. During verification your IP address and browser signals go to Cloudflare. Turnstile's own identifiers are subject to Cloudflare's privacy policy.

7. Transfers

Within Türkiye:

• When you apply to a program or take on a role in it, your data is visible to the organization running it and to the jurors, mentors, trainers and team members working on it. The organization's privacy notice explains that transfer.
• Where the law requires, your data is given to authorized public bodies.

Apart from these, your data is not shared with third parties.

Service providers (subprocessors):

• Cloudflare, Inc. (headquartered in the USA): hosting, database, file storage, bot protection and cookieless visit measurement on public pages
• Resend, Inc. (headquartered in the USA): transactional email
• Anthropic, PBC (headquartered in the USA): AI features. Used only on the Enterprise plan and only if the organization has turned these features on; personal fields are not sent

Services an organization connects: If an organization has connected its own email infrastructure or identity provider, the related data goes to that service. If an organization has put a YouTube or Vimeo video on its page, the video loads only when you press "Play video". Cookie-free embed addresses are used; nothing is sent to the provider before you press play. When you play it, your IP address and browser details go to the provider.

The Subprocessors page lists the data each service provider and service processes.

8. Transfers abroad

The service providers are outside Türkiye, so your data is transferred abroad. The database is kept on Cloudflare's infrastructure in the European Union. Files are processed in Cloudflare storage created in Europe, and emails on Resend's infrastructure, including in the USA.

Transfers are made under the rules of KVKK art. 9. The Subprocessors page lists each recipient's headquarters, where the data is kept and the data involved.

9. Retention

• Account data: for as long as your account is open. You can delete your account from the My account page at your organization's address or by writing to kvkk@fauna-studio.com.
• Session records: deleted when the session ends (30 days at most).
• Login attempts: 12 months.
• Notifications and preferences: until your account is deleted.
• Email delivery records and the audit log: the period the organization sets on its data protection screen (1-60 months for email records, 12-120 months for the audit log). If the organization has not set one, until the organization's account is deleted.
• Program assistant conversations: a conversation written without signing in, 30 days; a conversation written while signed in, until you delete it.
• Backups: encrypted database backups are taken weekly and kept for 90 days at most. Deleted data leaves the backups at the end of that period.

When you delete your account, your name, email address, profile details, preferences and notifications are deleted; your sessions are closed; your two-step verification, passkeys, single sign-on and calendar links are deleted. Your address is removed from email records, and your IP address from the audit log and agreement acceptances. Applications, scores, messages and content you sent in programs remain under the name "Deleted user"; the organization running the program decides how long they are kept.

When a period ends, the data is deleted or anonymized.

10. Your rights

Under KVKK art. 11 you can apply to Fauna to:

• Find out whether your personal data is processed
• Ask for information if it is processed
• Learn the purpose of processing and whether it is used accordingly
• Know the third parties your data is transferred to, in Türkiye or abroad
• Ask for correction if it is incomplete or wrong
• Ask for deletion or destruction under the conditions of KVKK art. 7
• Ask that corrections and deletions be notified to the third parties your data was transferred to
• Object to a result against you that comes from analysis exclusively by automated systems
• Claim compensation if you suffer damage because your data was processed unlawfully

You can download a copy of your data from the My account page at your organization's address or request it at kvkk@fauna-studio.com.

11. How to apply

• Email: write to kvkk@fauna-studio.com from the email address registered on your account.
• KEP: send it by KEP (registered electronic mail) to the KEP address at the end of this page.
• Post or in person: send a petition with your wet signature to the address at the end of this page.

Your application should include your full name; your Turkish ID number if you are a Turkish citizen, or otherwise your nationality and passport or ID number; your postal address; your email address or phone; and the subject of your request. A written application also needs your signature. We may ask for extra information to verify your identity.

We answer free of charge within 30 days at most. If the answer is longer than 10 pages, a fee of 1 TL per extra page may be charged; if you want the answer on a recording medium such as a CD or USB stick, the cost of that medium may be charged.

For requests about program data, apply first to the organization running the program. Its data protection email and personal data request form are on the program page. If you write to us, we pass the request on to the organization.

12. Complaints to the Board

If your application is rejected, you find the answer insufficient or you get no answer within 30 days, you can complain to the Personal Data Protection Board. The complaint period is 30 days from learning the answer and in any case 60 days from the date of your application (KVKK art. 14).