Privacy Policy
This site collects almost nothing without asking first. Where it does collect, this page says exactly what, why, and who receives it.
Last updated 18 October 2026
Who we are
WHITEHAND AI TEKNOLOJİ ANONİM ŞİRKETİ (“Whitehand AI”, “we”) operates this website at whitehand.ai and is the data controller for the personal data described here. Our registered address is Reşitpaşa Mah., Katar Cad., İTÜ ARI 1 Teknokent Binası No: 2/5, İç Kapı No: 33, Sarıyer/İstanbul.
For anything on this page, including any request about your own data, write to contact@whitehand.ai.
What this policy covers
This policy covers this website only: what happens when you read a page, write to us, or click through to book a call.
It does not cover client engagement data. If we work together, the handling of your data, your models, and your systems is governed by the engagement agreement we sign, not by this page. Our standing position is that engagement work runs on infrastructure you own and that intellectual property transfers to you in full, but those are contractual commitments, and the contract is where they live.
What you send us
This site has no form and asks you for nothing. If you want to reach us, you choose what to send.
If you email us at contact@whitehand.ai, we receive what any email carries: your name and address as your mail program sends them, and whatever you write.
Please do not put confidential information in a first email. A first conversation does not need it, and we would rather receive it under an NDA.
If you book a call, the booking happens on Calendly rather than here. Whatever you enter there is held by Calendly under its own privacy policy. Our link carries the name of the button you clicked, so we know where the booking came from.
What we receive automatically
Two things, both from the request itself rather than from you: your IP address and your browser user-agent string.
Every website receives them, because a browser cannot fetch a page without sending them. Cloudflare, which hosts this site, uses them to deliver the page and to protect it from abuse. The site runs no server of its own, so we keep no log of your visit.
Google Analytics receives both as well, but only if you accepted it. That is the next section.
Cookies and analytics
This site runs Google Analytics 4, and only if you let it. A notice at the bottom corner of the first page you open asks. Until you answer, and for as long as you decline, no Google script is fetched, no request reaches Google, and no cookie is set.
If you accept, Google Analytics sets two cookies in your browser:
| Cookie | What it does | How long it lasts |
|---|---|---|
| _ga | Tells one browser from another, so your second visit is not counted as a second person | 2 years |
| _ga_E4SGS97EVE | Holds the session state for this property | 2 years |
What comes back to us is a count, not a name: how many people read a page, which site they arrived from, roughly where in the world they are, what kind of device they used. Our tag denies Google advertising storage, ad personalization, and ad user data on every page load, so nothing collected here can be used to target you or build an advertising profile.
You can change your answer whenever you like, and this is the switch:
Switching it off withdraws the signal immediately and deletes both cookies above. Your answer itself is kept as a single entry in this browser, so the notice does not ask again on the next page. Clear your site data and it comes back.
Analytics is the only thing on this site that waits for consent. Everything else on this page happens because it is necessary to serve the page or to answer you when you write, so declining changes none of it.
What we do not collect
This section runs longer than it usually does on a page like this, because here it is the substantive part.
- No cookie you did not agree to. The only cookies this site can set are the two analytics ones above, and only after you accept them. Decline and it sets none at all.
- Almost no browser storage. Two entries, both kept in your browser and sent nowhere: the page you came from, so a back link goes back rather than forward, and your answer to the analytics question, so you are asked once rather than on every page.
- No tag manager, and no second analytics tool. One tag, the one named above. No Plausible, no PostHog, no heatmaps, no session recording.
- No third-party fonts. Typefaces are served from our own domain, so reading this page sends no request to Google or any font host.
- No tracking pixels, no advertising, no profiling, and no automated decision-making.
- No forms and no database. Nothing you do on this site is stored by us, because there is nowhere on it to type and nothing behind it to store into. An email you send us exists as an email in our mailbox, and nowhere else on our side.
- We do not sell personal data, and we do not share it for advertising.
One exception, stated here rather than buried: the home page displays technology logos loaded from cdn.simpleicons.org. Those image requests tell that host your IP address, your user-agent, and that you arrived from whitehand.ai. They happen on the home page and on no other page of this site. Apart from those logos and the analytics you accepted, nothing on any page reaches a third party.
Why we process it, and on what legal basis
| What | Why | Legal basis |
|---|---|---|
| Your email to us, and a call you book | To read your message, hold the call, and reply | KVKK Art. 5(2)(c): necessary for the establishment of a contract; GDPR Art. 6(1)(b) |
| IP address and user-agent | To serve the page and protect the site from abuse | KVKK Art. 5(2)(f): legitimate interest; GDPR Art. 6(1)(f) |
| Analytics: pages read, referring site, approximate location, device type | To see which pages are read and where readers arrive from | KVKK Art. 5(1): explicit consent; GDPR Art. 6(1)(a) |
Consent is the basis for the last row and for nothing above it, which is why the notice asks about analytics and asks about nothing else.
Who receives it
We use a small number of service providers. Each is named with what it actually does, rather than grouped behind the phrase “service providers”:
| Provider | What it does | What it receives |
|---|---|---|
| Cloudflare (Cloudflare Pages) | Hosts and serves this website | Your IP address and request metadata, as part of serving the page |
| Google (Google Workspace) | Holds the email you send us, in the mailbox that receives it | Your email: your name, your address, and what you write |
| Google (Google Analytics) | Counts page views, and only if you accepted analytics | Your IP address, which it turns into an approximate location and then discards, your user-agent, the pages you read, and the site you arrived from |
| Simple Icons CDN | Serves the technology logos on the home page | Your IP address, user-agent, and referring origin |
| Calendly | Handles call bookings (only if you click a booking button) | Whatever you enter on their page, plus which button you came from |
Beyond these, we disclose personal data only where the law requires it of us.
Where it goes
Every provider above is established outside Türkiye, so an email to us, a booking, or analytics you accepted leaves the country in the ordinary course. We transfer personal data only to the providers named above, for the purposes named above.
How long we keep it
- An email you send us stays in our mailbox while the conversation is live, and for 12 months after it ends.
- A booking stays in our Calendly account on the same terms: while the conversation is live, and for 12 months after it ends.
- The analytics data at Google is deleted after two months. That is the shortest window the property offers, and the one it is set to. The two cookies expire two years after your last visit, and go the moment you switch analytics off.
Ask us to delete your email or your booking and we will remove it from our mailbox and our Calendly account.
Your rights
Under Article 11 of the Turkish Personal Data Protection Law (KVKK) you have the right to learn whether we process your personal data; to request information about that processing; to know its purpose and whether your data is used accordingly; to know who it has been transferred to, in Türkiye or abroad; to have inaccurate data corrected; to have data erased or destroyed; to have any correction or erasure notified to those it was transferred to; to object to a result produced solely by automated analysis; and to claim compensation for damage caused by unlawful processing.
If the GDPR applies to you, you also hold its rights of access, rectification, erasure, portability, restriction, and objection.
To exercise any of these, email contact@whitehand.ai. We read every request ourselves and reply within thirty days at the latest, usually much sooner. You may also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), or to your own supervisory authority if you are in the EU or the UK.
Security
What we actually do, without overstating it:
- The site is served over HTTPS only, with HSTS preloaded.
- The site is static: no server-side code, no form, and no database. There is no store on our side to breach.
- Response headers deny the page access to camera, microphone, geolocation, and payment, and prevent another domain from framing it.
No system is perfectly secure and we do not claim this one is. If you find a vulnerability, tell us at contact@whitehand.ai. We would rather hear it from you than not.
Children
This site addresses people evaluating an R&D partner for their organization. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
Changes
If we change this policy, the date under the title changes with it. We do not publish an archive of previous versions; ask us if you need one.
Contact
WHITEHAND AI TEKNOLOJİ ANONİM ŞİRKETİ, Reşitpaşa Mah., Katar Cad., İTÜ ARI 1 Teknokent Binası No: 2/5, İç Kapı No: 33, Sarıyer/İstanbul · contact@whitehand.ai