Privacy Policy &
Data Notice
The security and privacy of your data is BiHediyem's core priority. Below is detailed information prepared in accordance with Turkish Law No. 6698 (KVKK).
1. Data Controller and Legal Basis
BiHediyem processes its users' personal data as the "Data Controller", relying on the legal grounds set out in Article 5 of Turkish Law No. 6698 (KVKK): "being directly related to the establishment or performance of a contract" and "being mandatory for the data controller to fulfill its legal obligation".
Your data is processed in accordance with the law and principles of good faith, for specified, explicit, and legitimate purposes.
Non-essential processing relies on your explicit consent, which you can withdraw at any time: campaign emails (from Settings or the link in the email) and analytics cookies (via the "Cookie preferences" link in the footer). Contact for the data controller: help@webauro.com.
2. What Data Do We Process?
Membership Data
Name, surname, email address. Required to secure your account and manage content specific to you.
Images and Text Content
The images, videos, and messages you upload to your site. Processed solely to present that specific website.
Transaction Security
IP address, device information, login/logout records. Required to be retained under Turkish Law No. 5651.
Payment Security
Your card information is processed on PCI-DSS compliant PayTR infrastructure. Never stored on our servers.
3. Technical and Administrative Measures
BiHediyem uses top-tier technical infrastructure to protect your data:
- ✓
End-to-End Encryption: All data transmissions are encrypted using 256-bit SSL (TLS 1.3).
- ✓
Database Security: Critical user data and passwords are stored one-way hashed using the bcrypt algorithm.
- ✓
Regular Backups: Your data is regularly backed up to secure servers to guard against potential hardware failures.
4. Rights of the Data Subject (KVKK Article 11)
Under KVKK, every user has the following rights:
• Learn whether your data is being processed,
• Request information if it has been processed,
• Learn the purpose of processing,
• Request correction of inaccurately processed data,
• Request deletion or destruction of your data,
• Request compensation for damages arising from unlawful processing.
To exercise these rights, you may open a support request or apply to help@webauro.com from the email address registered to your account, in writing. Requests are answered free of charge within 30 days at the latest, subject to our right to ask for information needed to verify your identity. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority.
5. Data Transfer and Third Parties
Your personal data may only be shared with the following parties, strictly for the purpose of providing the service:
- Payment Providers: With PayTR, to process payment.
- Infrastructure Providers: With data centers providing server and database hosting.
- Email Delivery Provider: To deliver account, payment and (if you opted in) campaign emails.
- AI Providers (Google Gemini or OpenAI): Only when you use the "generate / edit with AI" feature: the text you write, recipient name, relationship type and occasion (photos are not sent).
- Google (Analytics and YouTube): Google Analytics if you accept statistics cookies; if you add YouTube music to your page, the browser of the person opening the page connects to YouTube.
- Legal Authorities: In line with official requests from prosecutors, courts, or relevant public institutions.
Some of these providers have servers outside Türkiye, so your data may be transferred abroad. Transfers are made under the conditions set out in Article 9 of Law No. 6698 and your explicit consent.
Your data is never sold to third parties or advertising networks for commercial purposes.
6. Data Retention Period
Your data continues to be processed for as long as your membership is active. When you delete your account, your sites, uploaded photos and music, support conversations and profile information are deleted, and your identity details (name, email) are removed so the account is anonymized. Payment and invoice records are retained for 10 years under legal obligations, without being linked to your identity.
7. Cookies
We use two kinds of cookies:
- Essential cookies (no consent needed): session (
next-auth), language preference (NEXT_LOCALE), anonymous draft ID (guest_id, 30 days) and your cookie choice (bh_consent, 6 months). - Statistics cookies (only with your consent): Google Analytics (
_ga*) is used for visit statistics. It is not loaded unless you accept. No statistics cookies are used on surprise pages (/s/...).
You can change your choice at any time via the "Cookie preferences" link in the footer.
8. AI-Assisted Content
The "generate with AI" and chat-edit features send the text you write, the recipient name, relationship type and occasion to an AI provider (Google Gemini or OpenAI). Your photos are not sent. Generated text is automatic and may contain mistakes; reviewing it before publishing is your responsibility.
Please do not enter special-category personal data (health, religion, sexual life) or sensitive information about third parties. Using the AI feature is optional.
Your privacy is our top priority. This notice is for information; consent is requested separately for any non-essential processing.