Personal Data Protection Disclosure

1. Data controller

Within this disclosure, the 'Data Controller' is Bilgetek, developer and provider of BulkPro. Contact: privacy@bilgetek.com (Istanbul, Turkey).

2. Categories of personal data processed

BulkPro is a local-first application. Only the following minimum data is processed for it to function and for our services to be delivered:

• Transaction security data: device identifier (an irreversible SHA-256 derived from a hardware signature; not tied to identity), app version, operating system type, license status.
• Identity and contact data: name, email address and message content you share via the contact form, license activation or a KVKK request.
• Customer transaction data: if you buy a Pro license, your license key and the associated email address. Because there is no automated checkout on the site, card data is never collected or processed at any stage.

3. Processing purposes

• Ensuring the license stays active on a single device at a time, and activation.
• Effective distribution of security updates.
• Version-based aggregated usage measurement.
• Delivering activation and transactional emails.
• Responding to user requests and applications.

4. Legal basis

Processing is carried out under KVKK art.5/2-(c) necessity for performance of a contract (licensing, activation, transactional email), art.5/2-(f) legitimate interest not harming the data subject's fundamental rights (security, aggregate usage measurement), and explicit consent where required (contact form content).

5. Transfer and cross-border transfer

Your personal data is not transferred to third parties for marketing or sales. Limited data is shared only with sub-processors (data processors) that are necessary to deliver the service:

• Cloudflare: hosting, CDN, email routing and form security (Turnstile).
• Resend: delivery of activation and transactional emails.
• GitHub: hosting of installer releases.

6. Retention period

Device identifier and version data (heartbeat) is retained for at most 12 months. License records are kept for the license term and statutory retention obligations. Contact-form correspondence is kept for at most 3 years after the request is resolved, then deleted or anonymized.

7. Your rights under KVKK Article 11

• Learn whether personal data is being processed.
• If so, request information about it.
• Learn the processing purpose and whether it's used in line with that purpose.
• Know the third parties to whom data is transferred domestically/abroad.
• Request correction if processing is incomplete/incorrect.
• Request deletion or destruction.
• Request that corrections/deletions/destructions be notified to third parties to whom data was transferred.
• Object to results arising from analysis through automated systems.
• Request compensation for damage caused by processing in violation of the law.

8. How to apply

Send your written application for the rights above to privacy@bilgetek.com. We respond within 30 days at the latest. Under the Communiqué on the Procedures and Principles for Application to the Data Controller, written applications may require identity-verifying documents.