Privacy Policy & PDPL

Data controller — PostBase.tv platform. Legal entity: Alican Tarımcı (sole proprietorship, Türkiye). Business address: TBD (registered address to be published). VERBİS registration status: We are below the Turkish DPA's mandatory-registration threshold (annual net revenue 100M TRY or staff > 50) and therefore exempt; once we cross the threshold we will publish the VERBİS registration number on this page. For all data protection inquiries:

info@postbase.tv

We collect only what is necessary to provide the service:

• Account info: name, email, password (hashed), role (freelancer / company).
• Profile info: title, bio, credits, software/workflow tags, city, avatar.
• Usage data: login IP, browser info, page views (for security and performance).
• Communication: messages, contact requests, applications — shared only between parties.

We only use your data for these purposes:

• Creating and maintaining your account.
• Publishing your profile at the visibility level you choose.
• Helping producers discover you (based on information you permit).
• Platform security, moderation, and legal compliance.

We process personal data on the lawful bases of GDPR Article 6 (consent, contract performance, legitimate interest) and KVKK Article 5 (explicit consent, contract necessity, legitimate interest). For special-category data we rely on GDPR Article 9 / KVKK Article 6 explicit consent. You can withdraw consent at any time.

We do not sell your data. To deliver the service we share data with the following categories of recipients:

• Hosting and content delivery: Cloudflare (routing, DDoS protection) and Oracle Cloud Infrastructure (Frankfurt — photo, portfolio, avatar bucket).
• Error monitoring: Sentry (production error logs only when you have given consent — no behavioural tracking).
• Authentication: Google OAuth (only when you choose Sign in with Google — profile + email).
• Email delivery: Zoho Mail (transactional notifications, verification, password resets).
• Deployment infrastructure: GitHub Actions (code and deploy pipeline — no end-user data).
• Push notification delivery: Google FCM (Android/Chrome), Mozilla autopush (Firefox), Apple APNs (Safari/iOS) — your endpoint URL is forwarded only when you have granted browser notification permission.
• Authorities: government bodies when required by court order or statutory obligation.

Some sub-processors (Cloudflare, Sentry, Google, GitHub) are based outside Türkiye and the EEA. These transfers are governed by GDPR Article 46 Standard Contractual Clauses (Module 2) and KVKK Article 9 explicit consent.

We retain your data while the account is active. If you delete your account, profile and credit info is anonymized within 30 days; data with legal retention obligations is kept for the required period.

Under GDPR (Articles 15–22) and KVKK (Article 11), you have the right to:

• Learn whether your data is processed.
• Know the purpose and whether it's being used accordingly.
• Request correction, deletion, or destruction of your data.
• Know the third parties your data has been shared with.
• Object to processing and claim compensation for damages.

To exercise your rights: info@postbase.tv

We run an automated ranking algorithm on the Discover page that sorts profiles, makes suggestions, and biases search results. The algorithm produces a score based on profile completeness, recent activity, software/role tags you've added, and availability status. This processing constitutes "profiling" under GDPR Article 22 and KVKK Article 11. If you are adversely affected by the outcome you have the right to request manual review and to object to the algorithmic decision — write to info@postbase.tv.

You have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVK Kurumu — kvkk.gov.tr) about how we process your data. If you reside in the European Economic Area you may also complain to your local supervisory authority (e.g. ICO/UK, CNIL/FR, BfDI/DE). We ask that you contact info@postbase.tv first — we resolve most issues within 30 days.

Passwords are stored with secure hashing; data in transit is encrypted over HTTPS. No system is 100% secure, but industry-standard measures are applied.

We use only functional cookies for session management and language preference. We do not use advertising or third-party tracking cookies.

If we update this policy, we will announce material changes via in-app notification.