Privacy Policy

This Privacy Policy explains how we collect, process, and safeguard your personal data when you visit our websites at cerebrai-vortx.com and its subdomains (the "Site"), and how you can exercise your rights.

The data controller is CerebrAI VortX Nöroteknoloji ve Yazılım Sistemleri Ltd. Şti. ("CerebrAI-VortX", "we"), which processes your data under Turkish Personal Data Protection Law No. 6698 ("KVKK"), the EU General Data Protection Regulation ("GDPR"), and other applicable regulations.

Note: Privacy policy for our mobile applications is separate and available at /legal/apps-privacy-policy. Biometric data processed by BCI/EEG devices such as NeuroFlow is governed by an additional in-app privacy notice.

1.1 Automatically Collected Data

• •IP address and approximate location (country/region only)
• •Browser and device data (User-Agent, OS, screen size, language)
• •Traffic data (page views, visit time, referrer URL)
• •Cookies and similar technologies (session, language, consent state)
• •Security logs via Cloudflare (bot detection, DDoS mitigation, suspicious access)

1.2 Information You Provide

Through contact forms or other channels, you may share:

• •Name and surname
• •Email address
• •Message/inquiry content
• •Other optional information (phone, organization, etc.)

This data is used solely to respond to your inquiry and, when relevant, follow up.

We process data to:

• •Respond to your inquiries
• •Operate the Site securely (session management, bot/attack mitigation)
• •Measure performance and improve user experience (aggregate, anonymized)
• •Comply with legal obligations
• •Prevent and investigate security incidents
• •Send notifications or updates with your explicit consent

We do not sell your data and do not share it with third parties for direct marketing.

Under KVKK

• •Contractual necessity (Art. 5/2-c): technical data required to run the Site
• •Legal obligation (Art. 5/2-ç): retention/reporting required by law
• •Legitimate interest (Art. 5/2-f): Site security, fraud prevention, aggregate analytics
• •Explicit consent (Art. 5/1): non-essential cookies and optional communications — withdrawable any time

Under GDPR (EEA / UK / Switzerland visitors)

• •Performance of contract — Art. 6(1)(b)
• •Legal obligation — Art. 6(1)(c)
• •Legitimate interest — Art. 6(1)(f)
• •Consent — Art. 6(1)(a)

We use only essential cookies and, with your consent, preference/analytics cookies. For categorized details and preference management, see:

• •Cookie Policy

You can update cookie preferences any time via your browser settings or the "Cookie Preferences" link in the Site footer.

Cloudflare (Infrastructure, CDN, Security)

The Site is hosted on Cloudflare Workers. Cloudflare processes your IP address and basic connection metadata for content delivery, DDoS protection, bot detection, and TLS certification.

• •Cloudflare Privacy Policy: cloudflare.com/privacypolicy

• •Contact form data: up to 2 years after resolution, then deleted or anonymized
• •Server/security logs: typically 30–90 days, longer only when forensic/legal needs require it
• •Cookies: from session-only to 12 months depending on type — see Cookie Policy
• •Legally mandated retention: for the period required by applicable law

Technical and organizational measures we apply:

• •TLS 1.3 encryption for all data in transit
• •Cloudflare WAF, DDoS protection, and bot mitigation
• •Access-controlled server infrastructure with least-privilege principle
• •Regular security audits and patch management
• •Access logs and change tracking
• •KVKK awareness training for authorized personnel

We aim to design our security architecture in line with international frameworks such as ISO 27001 and NIST CSF. We do not formally claim certification until the process is completed.

No system is absolutely secure. In the event of a breach, we will notify the relevant authorities and affected data subjects in accordance with KVKK Art. 12/5 and GDPR Art. 33–34.

• •Learn whether your data is being processed
• •Request information about the processing
• •Be informed of the purpose and proper use
• •Know third parties to whom data is transferred (domestically or abroad)
• •Request correction of incomplete or inaccurate data
• •Request deletion or destruction within legal limits
• •Request notification of correction/deletion to third parties
• •Object to outcomes derived solely from automated analysis
• •Claim compensation for damages caused by unlawful processing

How to apply: Send a written request to info@cerebrai-vortx.com. We respond within 30 days as required by the Communiqué on the Procedures and Principles of Application to the Data Controller. If unsatisfied with the outcome, you may file a complaint with the Personal Data Protection Authority (kvkk.gov.tr).

• •Access (Art. 15) — request a copy of your data
• •Rectification (Art. 16)
• •Erasure / Right to be Forgotten (Art. 17)
• •Restriction of processing (Art. 18)
• •Data portability (Art. 20)
• •Object (Art. 21) — to processing based on legitimate interest
• •Withdraw consent (Art. 7(3)) — without retroactive effect
• •Lodge a complaint (Art. 77) — with your local data protection authority

Because Cloudflare operates a global infrastructure, connection metadata such as IP addresses may be processed transiently on Cloudflare edge servers in the EU, the US, and elsewhere. Transfers comply with KVKK Art. 9 and GDPR Art. 44–49 using Standard Contractual Clauses (SCCs) and appropriate technical safeguards.

The Site is not directed at children under 13 (16 in some EEA jurisdictions) and we do not knowingly collect data from this age group. If you believe a child has shared data with us, contact info@cerebrai-vortx.com and we will delete it without delay.

The Site may contain links to partners, social media, or source materials. We are not responsible for the privacy practices of these external sites; we recommend reviewing their policies before visiting.

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. For material changes, we will post a visible notice on the Site. Continued use of the Site signifies acceptance of the updated policy.