This is a translation. The Turkish version of this text is binding (Bu metnin Türkçesi esastır).
Klibim — Privacy Notice on the Processing of Personal Data
Scope: the klibim.com website, the waitlist and support communication
This privacy notice has been prepared by Batuhan Yaraş, as data controller, pursuant to Article 10 of the Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
This notice explains how the personal data of natural persons who visit the website at klibim.com, fill in the waitlist form on the site, or write to destek@klibim.com is processed. The Klibim platform (account creation, campaigns, clip submission, payments) is not yet open for service; when the platform opens, a separate privacy notice will be published for the processing activities relating to those services, and the people on the waitlist will be notified.
1. Identity of the Data Controller
| Data controller | Batuhan Yaraş (natural person) |
|---|---|
| Address | Our postal address for written applications will be sent to you if you write to destek@klibim.com. |
| destek@klibim.com | |
| Website | https://klibim.com |
Once a trading company is established to operate Klibim, that company will become the data controller. In that case this privacy notice will be updated, the people on the waitlist will be notified by email that the data controller has changed, and the records will be transferred to the new data controller in accordance with the Law.
2. Personal Data Processed and Purposes of Processing
Your personal data is processed only for the purposes set out below for each group of data subjects and data category. No personal data other than that listed is collected.
2.1 Website visitors
| Data category | Personal data processed | Purposes of processing |
|---|---|---|
| Data categoryTransaction security | Personal data processedServer request logs: IP address, browser and device information (user-agent), requested page address (including query parameters), request method, response status, request duration, date and time | Purposes of processingRunning the website and serving it to visitors; ensuring the security of the site; detecting errors and misuse; fixing technical problems |
| Data categoryTransaction security | Personal data processedApplication error logs (only the error code and error type; they contain no email address, password or code) | Purposes of processingDetecting and fixing technical errors |
| Data categoryTransaction security | Personal data processedBot check (Cloudflare Turnstile) signals: IP address, browser information, TLS connection characteristics, origin of the page, site key and a temporary verification token carrying the result of the check | Purposes of processingPreventing misuse of the waitlist form by automated software (bots). Turnstile loads when the form approaches the visible area of the screen; these signals are sent to Cloudflare even if you do not submit the form |
| Data categoryCustomer transaction (preference) | Personal data processedCookies: rol, NEXT_LOCALE, theme (see Section 6 for details) | Purposes of processingRemembering the introduction page, language and theme you chose on your next visits |
2.2 People who join the waitlist (clipper, creator, agency)
| Data category | Personal data processed | Mandatory? | Purposes of processing |
|---|---|---|---|
| Data categoryContact | Personal data processedEmail address | Mandatory?Mandatory | Purposes of processingAdding you to the waitlist; sending you this information, at your request, when the platform opens; fulfilling your requests about your record (deletion, correction, etc.). The email service provider that will send the launch notification is added to Section 4.2 before sending, and the current version of this notice is published. If you signed up as a creator or agency: contacting you one-to-one by email before the platform opens so that the first (pilot) campaign you requested in your sign-up can be set up together. This contact is limited to your request; no bulk promotional messages are sent. If you signed up as a clipper: when you open an account on the platform with the same email address, matching your sign-up with your account to apply the founding clipper benefits (no service fee for the first 30 days after the beta launch and a founding clipper badge on your profile). |
| Data categoryCustomer transaction | Personal data processedThe role you chose (clipper / creator / agency) | Mandatory?Mandatory | Purposes of processingPlanning the launch by role; sending you information relevant to your role |
| Data categoryContact / identity | Personal data processedProfile, channel or website link (the link may contain your username) | Mandatory?Mandatory for creators; optional for clippers and agencies | Purposes of processingPlanning the first campaigns; preparing to verify the creator's channel when the platform opens. This link is not shown anywhere on the site |
| Data categoryCustomer transaction | Personal data processed"Do you work with an agency?" (yes/no) | Mandatory?Mandatory for creators | Purposes of processingEstimating the number of accounts that will open campaigns at launch |
| Data categoryIdentity / professional experience | Personal data processedAgency name (in agency sign-ups; optional in creator sign-ups if "yes" is answered). Where the agency is a sole proprietorship, this field may contain the name of a natural person | Mandatory?Mandatory for agencies; optional for creators | Purposes of processingCounting agencies and creators; launch planning |
| Data categoryCustomer transaction | Personal data processedRange of the number of creators the agency works with (1–3 / 4–10 / 11+) | Mandatory?Mandatory for agencies | Purposes of processingDemand estimation and launch planning |
| Data categoryCustomer transaction | Personal data processedApproximate size of your clipper community (in agency sign-ups: none / under 100 / 100–1,000 / over 1,000) | Mandatory?Optional | Purposes of processingLaunch and pilot planning |
| Data categoryCustomer transaction | Personal data processedDate and time of sign-up, randomly generated record ID | Mandatory?Automatic | Purposes of processingRecord management; calculating the retention period |
The total number of waitlist records (for example, the number of clipper sign-ups) may be shown on the site, only as a total that does not identify anyone.
The waitlist form does not ask for your name, phone number, date of birth or age; the IP address and browser information from which the form is submitted are not written to the waitlist record (this information is processed only in the server logs and bot check described in Section 2.1).
2.3 People who write to destek@klibim.com
| Data category | Personal data processed | Purposes of processing |
|---|---|---|
| Data categoryIdentity, contact | Personal data processedSender's email address, your name as it appears in the email | Purposes of processingResponding to your request |
| Data categoryContact (content) | Personal data processedSubject, content and attachments of the email, including any information you share in them of your own free will | Purposes of processingResponding to your request, question or complaint; concluding your applications under the Law; protecting rights in case of a dispute |
Please do not share more personal data in your support emails than your request requires (in particular, information such as your Turkish ID number or bank details).
2.4 Data not collected and technologies not used
The website uses no analytics, advertising, social media plug-ins or tracking pixels. Fonts are loaded from the site's own server. Special categories of personal data (Article 6 of the Law) are neither requested nor processed. No consent to commercial electronic messages is requested when you join the waitlist; the "the platform is open" notification in Section 2.2 is a one-time notification that you request when signing up, and that email contains a link to leave the list.
2.5 Processing based on explicit consent
None of the processing activities covered by this notice is based on your explicit consent. All activities rely on the legal grounds in Article 5(2) of the Law, as set out in Section 3. Sending commercial electronic messages for marketing purposes is outside the scope of this notice; such messages may only be sent after the platform opens, based on your separate consent obtained at that time.
3. Method of Collecting Personal Data and Legal Grounds
Your personal data is collected electronically, by partly automated means, through the methods below. Server logs, the bot check and cookies are fully automated; the waitlist form and support emails are collected by automatically recording the data that you fill in and send.
| Personal data | Collection method | Legal ground (Law Art. 5/2) | Explanation |
|---|---|---|---|
| Personal dataServer request logs (IP, browser information, address, date-time) and application error logs | Collection methodAutomatically, by the web server and the hosting infrastructure | Legal ground (Law Art. 5/2)(f) Legitimate interest of the data controller | ExplanationServing the site securely, detecting attacks and errors; this is limited-duration, technical processing that does not harm your fundamental rights and freedoms |
| Personal dataBot check (Turnstile) signals and verification token | Collection methodAutomatically, by the Cloudflare script on the page containing the form | Legal ground (Law Art. 5/2)(f) Legitimate interest | ExplanationPreventing the form from being filled in by automated software and preventing fake sign-ups |
Personal dataCookies (rol, NEXT_LOCALE, theme) | Collection methodWritten to your browser only when you choose a role, language or theme | Legal ground (Law Art. 5/2)(f) Legitimate interest | ExplanationThese cookies are strictly necessary to remember a preference you have made yourself; under the Personal Data Protection Authority's Guide on Cookie Practices, explicit consent is not required |
| Personal dataWaitlist: email address, role, sign-up date and ID | Collection methodThe waitlist form on the site | Legal ground (Law Art. 5/2)(f) Legitimate interest | ExplanationManaging the waitlist you joined at your own request and fulfilling your request when the platform opens |
| Personal dataWaitlist: profile/channel/web link, whether you work with an agency, agency name, range of number of creators | Collection methodThe waitlist form on the site | Legal ground (Law Art. 5/2)(f) Legitimate interest | ExplanationPlanning launch capacity and the first campaigns; processing is limited to the minimum data, and this data is not shown to third parties |
| Personal dataWaitlist: email address of creators and agencies (pilot contact) | Collection methodThe waitlist form on the site | Legal ground (Law Art. 5/2)(c) Directly related to the conclusion or performance of a contract | ExplanationOne-to-one contact before the platform opens so that the first (pilot) campaign you requested in your sign-up can be set up together; no bulk promotional messages are sent |
| Personal dataWaitlist: email address of clippers (founding clipper matching) | Collection methodThe waitlist form on the site; the match is made automatically when you open an account on the platform with the same email address | Legal ground (Law Art. 5/2)(c) Directly related to the conclusion or performance of a contract | ExplanationApplying the founding clipper benefits (no service fee for the first 30 days after the beta launch and a founding clipper badge on your profile) to your platform account |
| Personal dataWaitlist: approximate size of the agency's clipper community; total number of records | Collection methodThe waitlist form on the site; the total is calculated on the server from the records | Legal ground (Law Art. 5/2)(f) Legitimate interest | ExplanationLaunch and pilot planning; showing the total number of records on the site in a way that does not identify anyone |
| Personal dataSupport email: sender address, name, subject, content, attachments | Collection methodEmail you send to destek@klibim.com | Legal ground (Law Art. 5/2)(f) Legitimate interest; where your application falls under Article 11 of the Law, (ç) compliance with a legal obligation; in case of a dispute, (e) establishment, exercise or protection of a right | ExplanationResponding to your request and fulfilling our obligations under the Law |
4. To Whom and for What Purpose Personal Data May Be Transferred
4.1 Transfers within Türkiye
Your personal data is not transferred, sold or rented to any third party within Türkiye for commercial purposes. Data may be transferred only to legally authorised public institutions and organisations upon their lawful written request, limited to the data requested (Law Art. 5/2-ç and Art. 8).
4.2 Transfers abroad
Service providers whose headquarters or servers are located abroad are used for hosting the website, storing data, the bot check and email communication. Except for the exceptions stated below, these providers act as data processors that process personal data only on behalf of and on the instructions of Klibim.
| Recipient | Country / data location | Personal data transferred | Purpose of transfer |
|---|---|---|---|
| RecipientGoogle Cloud EMEA Limited (Ireland) and Google LLC (USA) — Google Cloud / Firebase App Hosting | Country / data locationApplication server: Netherlands (europe-west4). Load balancer and content delivery network: Google's edge locations worldwide (may be outside the EU). Server logs (Cloud Logging): Google's global infrastructure | Personal data transferredEvery request made to the site (IP, browser information, address, form content — in transit); server request and error logs | Purpose of transferHosting the website and serving it to visitors; keeping security and error logs |
| RecipientSupabase Pte. Ltd. (Singapore) | Country / data locationDatabase and backups: Ireland (AWS eu-west-1). Support access: Singapore and the USA. Some sub-processors are in the USA | Personal data transferredAll waitlist records (Section 2.2) | Purpose of transferStoring waitlist records (database service) |
| RecipientCloudflare, Inc. (USA) | Country / data locationGlobal network | Personal data transferredBot check (Turnstile) signals: IP address, browser information, TLS connection characteristics, page origin, verification token. Request information relating to domain name (DNS) resolution and the www redirect. Forwarding of emails sent to destek@klibim.com: sender, recipient, subject and delivery status logs (Cloudflare does not store email content) | Purpose of transferBot check; operating the domain name; forwarding support emails. Note: Cloudflare also processes part of the Turnstile signals on its own behalf, as an independent data controller, to improve its bot detection product (Cloudflare Turnstile Privacy Addendum: cloudflare.com/turnstile-privacy-policy) |
| RecipientGoogle LLC (USA) — Gmail | Country / data locationUSA and Google's global infrastructure | Personal data transferredThe entire email you send to destek@klibim.com (address, name, subject, content, attachments) and the reply sent to you | Purpose of transferReceiving, reading and replying to support emails (the support mailbox runs on Gmail) |
Since, under Article 9 of the Law, there is not yet any country for which an adequacy decision has been announced by the Personal Data Protection Board, the transfers above are transfers abroad within the meaning of the Law even where the servers are located in the European Union. A process is under way to put in place, for each provider, the appropriate safeguards provided for in Article 9(4) of the Law (the standard contracts announced by the Board) and to notify them to the Authority. Which safeguard has been put in place for which transfer is published and kept up to date in this section; you can also obtain information on this by writing to destek@klibim.com.
5. Retention Periods
| Personal data | Retention period |
|---|---|
| Personal dataWaitlist record (Section 2.2) | Retention periodDeleted 6 months after the platform launch notification is sent, or at the latest 24 months after the sign-up date (whichever comes first). Deleted immediately if you request deletion. If you open an account when the platform opens, the data relating to your account is subject to the platform privacy notice. If the platform opens in stages (by invitation), the launch notification is deemed sent on the date the platform opens for you. When you open an account on the platform with the same email address, your sign-up is matched with your account and deleted from the waitlist; for clipper sign-ups, the founding clipper information is first transferred to your account. |
| Personal dataServer request and error logs | Retention period30 days (Google Cloud Logging) |
| Personal dataBot check (Turnstile) signals | Retention periodDetermined by Cloudflare; Klibim does not access or store this data (see the Cloudflare Turnstile Privacy Addendum) |
| Personal dataCookies | Retention period1 year in your browser; you can delete them at any time in your browser settings |
| Personal dataEmails sent to destek@klibim.com and the replies | Retention period2 years from the conclusion of the request; applications under Article 11 of the Law and the replies to them, 3 years because of the burden of proof |
| Personal dataEmail forwarding logs (Cloudflare) | Retention periodDetermined by Cloudflare |
Personal data whose retention period has expired or whose purpose of processing no longer exists is deleted, destroyed or anonymised in accordance with Article 7 of the Law.
6. Cookies and Similar Technologies
Only the cookies below are used on klibim.com. None of them serves analytics, advertising or tracking purposes; none of them is transferred to third parties.
| Cookie name | Set by | Purpose | When it is set | Duration | Type |
|---|---|---|---|---|---|
Cookie namerol | Set byklibim.com (first party) | PurposeRemembering your choice of the clipper or creator introduction page and taking you directly to that page on your next visit | When it is setOnly when you choose a role | Duration1 year | TypePreference cookie (user preference) |
Cookie nameNEXT_LOCALE | Set byklibim.com (first party) | PurposeRemembering the language you chose (Turkish/English) | When it is setOnly when you choose a language in the language switcher | Duration1 year | TypePreference cookie (user preference) |
Cookie nametheme | Set byklibim.com (first party) | PurposeRemembering the display theme you chose (light/dark) | When it is setOnly when you make a choice in the theme menu; deleted if "System" is chosen | Duration1 year | TypePreference cookie (user preference) |
Cloudflare Turnstile: On pages containing the waitlist form, a script and frame are loaded from the challenges.cloudflare.com domain when the form approaches the visible area. This component does not set cookies on the klibim.com domain; Cloudflare processes the browser signals listed in Section 2.1 for the bot check through its own domain. This check is a strictly necessary security technology to prevent misuse of the form.
Your browser's local storage areas (localStorage, sessionStorage) are not used.
Because the cookies above are set only to remember a preference you have made and are necessary for the site to work as you requested, they are not subject to explicit consent under the Personal Data Protection Authority's Guide on Cookie Practices; for this reason there is no cookie consent banner on the site. You can delete or block cookies at any time in your browser settings; in that case only your preferences will not be remembered, and the site will continue to work.
7. Data Security
In accordance with Article 12 of the Law, appropriate technical and organisational measures are taken to prevent the unlawful processing of your personal data and unlawful access to it. These include: establishing all connections encrypted (HTTPS/HSTS); security headers (CSP) that restrict the sources from which content can be loaded into the browser; no direct access to the database from the browser; keeping the secret keys used on the server side in an encrypted key management service; applying row-level access rules on the waitlist table and the server application having only insert and read permissions on this table; not writing email addresses, passwords or codes to application error logs; and pages not being cached in the content delivery network.
8. Age Limit
Klibim's services and the waitlist are intended for people aged 18 or over. If you are under 18, please do not join the waitlist. If we learn that a record belongs to a person under 18, the record is deleted.
9. Rights of the Data Subject under Article 11 of the Law
Under Article 11 of the Law, by applying to the data controller you have the right to:
- a) learn whether your personal data is processed,
- b) request information if your personal data has been processed,
- c) learn the purpose of processing your personal data and whether it is used in line with that purpose,
- ç) know the third parties in Türkiye or abroad to whom your personal data is transferred,
- d) request the correction of your personal data if it is incomplete or inaccurate,
- e) request the deletion or destruction of your personal data under the conditions set out in Article 7 of the Law,
- f) request that the operations carried out under subparagraphs (d) and (e) be notified to third parties to whom your personal data has been transferred,
- g) object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
- ğ) claim compensation for damage if you suffer damage because your personal data is processed unlawfully
Note on automated systems: The bot check (Cloudflare Turnstile) on the waitlist form runs fully automatically and may prevent the form from being submitted if it considers your browser to be a bot. If this happens, you can write to destek@klibim.com to request that your record be created manually and to object to this result.
How to apply
You can submit your applications, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, through the following channels:
- In writing: by requesting our postal address from destek@klibim.com, with a petition bearing your wet signature.
- By email: from the email address you gave when joining the waitlist (registered in our system) to destek@klibim.com.
Your application must include your name, surname, your signature if the application is in writing, your Turkish ID number (if you are a foreign national, your nationality and passport or identity number), your residential or business address for notifications, your email address and phone number for notifications if any, and the subject of your request. Your application must be made in Turkish. To verify your identity, applications made by email must come from the email address registered in our system; where necessary, additional confirmation may be requested through a verification link sent to your registered address. We recommend that you do not share personal data in your application beyond the mandatory information listed in the Communiqué.
Your application is concluded free of charge as soon as possible depending on its nature, and within 30 days at the latest. If the reply is given in writing, the first 10 pages are free of charge; a fee of TRY 1 may be charged for each page after 10 pages. If the reply is given on a recording medium such as a CD or flash drive, only the cost of the recording medium may be charged. If your application is rejected, you find the reply insufficient, or no reply is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the Law.
10. Changes to This Notice
This notice is updated if there are changes in the processing activities, the service providers used or the legislation. The current version and effective date are always shown on this page; material changes that affect the people on the waitlist are notified by email.
30/10/2026: one-to-one pilot contact with creators and agencies, founding clipper matching, the agency community size field, showing the total count, and staged opening were added.
30/10/2026 (second version): A profile badge was added to the founding clipper benefits.