What we keep, and why.

ilinxa.com is a static export served by Hostinger shared hosting. It sets no cookies of its own, runs no analytics, and loads no advertising pixels or trackers. It carries no chat and no assistant, builds no profile of you, and makes no automated decision about you that has a legal or similarly significant effect. The host keeps ordinary server access logs, your IP address, browser type, the time, and the page requested, under Hostinger's own retention. We do not process those logs ourselves.

This page is written to satisfy two laws at once: the General Data Protection Regulation of the European Union, and Türkiye's Personal Data Protection Law No. 6698, known as the KVKK. Where they differ we follow the stricter of the two rather than choosing between them, so the same page holds whichever of them applies to you. It is written plainly on purpose. A policy nobody reads protects nobody.

Ilinxa, the studio behind ilinxa.com, based in Istanbul, Türkiye, is the controller of the data this page describes. Data protection requests go to studio@ilinxa.com. The GDPR calls that role the controller and the KVKK calls it the data controller, veri sorumlusu. It is the same role and the same responsibility either way.

The site has one form, the project intake at /start, and it sends nothing to us by itself. When you press the button, it opens a new email in your own email app, addressed to studio@ilinxa.com and filled in with your answers: your name, your company if you give one, your email, your timeline, what you need, your budget range, and your project brief. The site itself sends that nowhere, and nothing reaches us until you send the email yourself; you can change or delete any part of it before you do. Once sent, it is an ordinary email, carried by your email provider and ours. The site runs no newsletter and no anti-abuse check. If it ever adds a form that posts to our own systems, a newsletter, or an anti-abuse check, this page will be updated to describe it before it goes live.

If you message us on WhatsApp, that conversation is carried and processed by Meta under Meta's own terms and privacy policy, not ours. What reaches us is an ordinary message: your phone number, the name WhatsApp shows for you, and whatever you write. We keep the conversation for as long as the matter it concerns is open, and then we delete it. We never add anyone to a broadcast list, a marketing group, or any list they did not ask to be on.

For an intake email, whether the form at /start composed it or you wrote it yourself, and for a WhatsApp message, our lawful basis is the steps you ask us to take before we might enter a contract with you, together with our legitimate interest in answering you: Article 6(1)(b) and Article 6(1)(f) of the GDPR, and the equivalent grounds in Article 5 of the KVKK. Where you give consent, such as the explicit consent to a transfer abroad described below, you can withdraw it at any time. Withdrawing that consent is as easy as giving it and does not affect anything done before you withdrew it.

Besides us, only these companies handle the data this page describes: Hostinger, which hosts the site and keeps its access logs; our email provider, which receives the email you send us and carries our reply; and Meta, if you choose to message us on WhatsApp. The email app and email provider you write from are your own choice and work under their own terms. We do not sell your data, we do not share it with advertisers, and we do not pass it to anyone outside that list.

Hostinger, our email provider and, for WhatsApp, Meta process data in their own regions, which may lie outside Türkiye and outside the European Union. For what you send us, that transfer happens only when you choose to email us, including sending the email the form composes, or to message us on WhatsApp. By making that choice you give your explicit consent to the transfer, which is the basis Article 9 of the KVKK provides for it. We claim nothing beyond that.

We keep an intake email, whether the form composed it or you wrote it yourself, for as long as the conversation it started stays active. If no engagement follows, we delete it within twelve months. A WhatsApp conversation is kept as the WhatsApp section above describes: for as long as the matter it concerns is open.

Every page travels over HTTPS, and the site sends security headers with each response. Access to the emails and messages you send us is limited to the people who answer them. We hold no payment details and no special category data, health, beliefs, biometrics or anything like them, and we ask you not to send any by email or message.

Once we are engaged, your project material, code, documents, and data, is treated as confidential. We never show it as our own work, share it with another client, or use it to train shared models.

You can ask what we hold about you, have it corrected, have it deleted, ask us to restrict or stop processing it, object to processing, receive a copy in a portable format, or withdraw consent you have given. Those are your rights under Articles 15 to 22 of the GDPR and Article 11 of the KVKK. Write to studio@ilinxa.com and we answer within thirty days, at no charge. If our answer does not satisfy you, you can complain to the supervisory authority of your own country in the European Union, or to the Personal Data Protection Board, the KVKK Kurulu, in Türkiye.

This site is for businesses, and nothing on it is directed at children. We do not knowingly collect data from them. If you believe a child has sent us something, write to studio@ilinxa.com and we will delete it.

This version, dated October 2026, describes the intake as it works today: the form at /start posts nothing to a server and instead composes an email in your own email app. It removes features the site does not have, the newsletter signup, the quote form and the Cloudflare Turnstile check, together with the automation server the forms were described as posting to, and shortens the transfer and retention sections to match. The version before it added the legal frame the earlier ones lacked: the two laws this page is written to satisfy, a lawful basis and a retention period for each thing we hold, and the WhatsApp channel. The version before that described two forms and no framework, and the one before that said only the intake form collected data while the site still carried a chat feature, since removed. When this page changes again, the date on the section label above changes with it.