Privacy Policy

This document is a working draft pending final legal review. It describes our intended practices; the finalized version will be published here.

Who we are

Udeha ("we", "us") operates the Udeha diagnostic funnel, website, and mobile application. For the purposes of Türkiye's Personal Data Protection Law (KVKK, Law No. 6698) and the EU General Data Protection Regulation (GDPR), Udeha Studio is the data controller for the personal data described below. You can reach our data protection contact at privacy@udeha.com.

What we collect

• Contact details — the email address and (optionally) the name you provide at the diagnostic gate, so we can send your results and, if you consent, occasional product emails.
• Diagnostic answers — the responses you give in the diagnostic quiz, used to compute and deliver your personalized result.
• Analytics data — anonymized/pseudonymized usage events (for example, pages viewed and funnel steps completed) collected via our analytics provider to understand and improve the product. See our Cookie & Analytics Notice.

We do not collect special-category data, and your private in-app journal entries are stored encrypted on your device — never on our servers.

Why we use it (lawful basis)

• To deliver your diagnostic result and operate the service — performance of a contract / provision of a service you requested (KVKK Art. 5; GDPR Art. 6(1)(b)).
• To send marketing emails — only with your explicit consent given at the gate, which you can withdraw at any time (KVKK Art. 5(1); GDPR Art. 6(1)(a)).
• To measure and improve the product — our legitimate interest in a functioning, well-designed service, balanced against your rights (GDPR Art. 6(1)(f)).

Marketing consent

Marketing emails are sent only if you tick the marketing-consent box. Consent is recorded in a dedicated consent ledger with a timestamp. Every marketing email includes an unsubscribe link, and withdrawing consent is as easy as giving it.

How long we keep it

• Leads (email/name captured at the gate without a completed sign-up) are retained for a limited window and then purged automatically.
• Account and diagnostic data are retained while your account is active and deleted on request or after a defined period of inactivity.
• Analytics data is retained per our analytics provider's configured retention.

Your rights

Under KVKK and GDPR you may request to access the personal data we hold about you, correct it, delete it, restrict or object to processing, and receive a portable copy. You also have the right to lodge a complaint with a supervisory authority (in Türkiye, the KVKK Authority; in the EU, your local data protection authority). To exercise any right, email privacy@udeha.com — we support data export and deletion directly.

Changes

We may update this policy; the effective date is shown as "last updated" above. Material changes will be communicated through the app or by email where appropriate.