This Privacy Policy explains how the sora-ik.com website operated by Sora Yazılım Teknolojileri ("Sora Yazılım", "we"), and the company registration, login and request forms on this website, use your personal data. The information required by law on the processing of your personal data, including processing purposes, legal grounds, retention periods and your rights, is set out in detail in the KVKK Privacy Notice.
1. What does this policy cover?
This policy covers the sora-ik.com website, the api.sora-ik.com endpoints used by the website and the communication you establish with us through these channels. Employee, job candidate and user data that customer companies upload to the Sora İK application is not covered by this policy: the data controller for this data is the relevant customer company, and its processing is governed by the Data Processing Agreement.
2. Which information is processed, and when?
| When? | What information? | Why? |
|---|---|---|
| When you visit the website | IP address, browser and device information, the requested page, necessary cookies | Operation and security of the website |
| When you consent to analytics cookies | Page view and usage statistics, online identifiers | Improving the website |
| When you register a company | Company name, employee count range, full name, email, phone, password hash, website language, approval records | Opening the account and evaluating the application |
| When you log in | Session records, IP address, browser information, last login time | Session management and account security |
| When you submit billing details | Trade name, tax office and number, billing address, e-invoice information | Issuing invoices |
| When you submit a contact, demo or quote form | Full name, business email, phone, company name, employee count range, subject, message, module of interest, consent preferences | Responding to your request |
| When you file a KVKK request | Full name, email, phone, request type and description; optionally an address for notifications and identity information | Concluding your request |
3. When you visit the website
The website is delivered through Cloudflare. With each request, your IP address, the information sent by your browser and the requested address pass through Cloudflare's network and our servers in order to deliver the page to you and to protect against attacks and bot traffic. Cookies other than the necessary cookies required for the website to operate are placed only if you consent in the cookie preferences.
4. When you create an account and log in
- The information you provide during company registration is used to open your account, verify your email address and start the trial period. The tax number provided at registration is stored to check that a trial is opened only once per number. If the registration details are incomplete or inconsistent, our team may suspend the account.
- Your password is not stored in plain text; it is converted into an irreversible hash using the argon2id algorithm.
- When you log in, your session is managed with cookies that browser scripts cannot read (httpOnly) and that are sent only over encrypted connections (Secure).
- The records showing that you read the privacy notice and approved the sales agreement during registration are stored together with the approval type, the version number of the text, the date, IP address and browser information.
- When you submit billing details from the account page, this information is used to issue invoices.
5. When you use the forms
In contact, demo and quote forms, in addition to the fields you fill in, the page from which you submitted the form, the source and campaign (UTM) information that brought you to the website, the website language, your IP address and browser information are also recorded. This information helps us route your request to the right team and prevent misuse. Your request is notified to our team by email, and you receive an acknowledgement email.
The forms are protected against automated submissions with Cloudflare Turnstile. According to Cloudflare's documentation, Turnstile examines signals about the visitor's browser environment and does not access the information you enter in the form fields. In addition, a large number of submissions from the same IP address within a short time is limited.
The Turkish national identity number or passport number that you optionally provide in the KVKK request form is not written to logs, is masked in the notification email sent to our team and on administration screens, is not included in exported lists and is deleted together with the request record.
Consent to marketing communications is optional in the forms and is not pre-ticked. Not giving consent does not affect the response to your request.
6. Cookies and local storage
The names, purposes and durations of the cookies we use on the website are listed in a table in the Cookie Policy. On your first visit, the banner at the bottom of the page offers "Accept", "Reject" and "Customize" equally; analytics cookies are off by default. You can change your preferences at any time via the "Cookie preferences" link at the bottom of the page. Your cookie preference is also backed up in your browser's local storage (localStorage) in case the cookie is deleted.
7. Third-party services and links
We use the following service providers to operate the website. These providers process your data only to the extent necessary to deliver the service.
| Provider | What for? | When? |
|---|---|---|
| (to be confirmed) | Hosting servers and databases | Always |
| (to be confirmed) | Sending verification, notification and response emails | When an email is sent |
| Cloudflare | Content delivery, protection against attacks and bots | On every request |
| Cloudflare Turnstile | Bot verification on forms | On form pages |
| Google Analytics 4 | Website usage statistics | Only if you give analytics consent |
| Ahrefs Web Analytics | Measuring website traffic (cookieless) | Only if you give analytics consent |
Some of these providers deliver their services through servers located abroad. Information on transfers abroad is set out in Section 5 of the KVKK Privacy Notice. Links on our website to other websites (for example, sorayazilim.com or official legislation sources) are subject to those websites' own privacy policies.
8. How do we protect your data?
- Website and API traffic is encrypted with TLS; connections are established over HTTPS.
- Passwords are stored irreversibly with argon2id.
- Access to data is restricted on the basis of roles and permissions; administrative operations are written to the audit log.
- Rate limiting is applied to the registration, login, password reset and form endpoints.
- Personal data in logs is kept to a minimum: email addresses are masked and query strings are not recorded.
No system can guarantee complete security; in the event of a security breach, we make the notifications required by legislation. The product's approach to security is described on the Security and data protection page.
9. Retention periods and your rights
Your personal data is kept for as long as necessary for the purpose for which it is processed and in accordance with the retention obligations under legislation; the periods are listed in a table in Section 6 of the KVKK Privacy Notice. To exercise your rights under Article 11 of the Kişisel Verilerin Korunması Kanunu No. 6698 (Türkiye's Personal Data Protection Law, KVKK), you can use the KVKK request form or write to kvkk@sora-ik.com.
10. Children's privacy
Sora İK is a service for businesses; it is not offered to anyone under 18. We do not knowingly collect personal data from persons under 18; if we notice that we have received such data, we delete it. Employee data that customer companies upload to the application is outside the scope of this section and is subject to the Data Processing Agreement.
11. How does this policy change?
We may update this policy in line with changes to the website or to our service providers. The current version is always published on this page, and the "Last updated" date at the top of the page changes. We notify our registered users of significant changes by email. Version of this policy: 1.1.
12. How can you contact us?
For questions about privacy, you can write to kvkk@sora-ik.com or use the contact page. Our postal address: Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul C1 Blok No: 2B İç Kapı No: 376, Ataşehir/İstanbul.
This text is a translation of the Turkish original; in case of any discrepancy, the Turkish version prevails.