Privacy Policy and Privacy Notice

01Data controller

This notice explains how your personal data is processed when you use Dönüştür.net. It is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Obligation to Inform. It is information only and does not ask for your consent. Anything that does depend on your consent is marked as such and asked for separately.

Dönüştür.net (donustur.net) is run by a private individual. The data controller under the KVKK and the contact details are:

• Data controller: Kerem Karakaş
• Email: privacy@donustur.net
• Website: donustur.net

02Files you upload

We process your files only to carry out the operation you choose. This is how it works:

• Upload: Your file is sent over an encrypted connection (HTTPS) to our server in Frankfurt, Germany. The connection passes through Cloudflare, our content delivery and security provider.
• Processing: The file is processed automatically by software, only for the operation you selected. File contents are never written to log files, and nobody opens or looks at your file.
• Deletion: With most tools your uploaded file is deleted as soon as processing finishes; the generated file is kept only so you can download it and is deleted automatically no later than about 10 minutes later.
• Cancelling: If you stop before the job finishes, the copy on the server is deleted automatically within the same time.
• Download: The result can only be downloaded from the browser session that started the job, or from your account.
• No other use: We do not use your files to train AI models, for advertising or for any other purpose.

03What we process and why

For each group of data below you will find the purpose, the legal basis under the KVKK and how long we keep it.

• Files and their contents

  ≈ 10 min

  The files you upload to convert, compress or edit. They may contain personal data about you or other people; we process it automatically and only for the operation you asked for.

  • Purpose: To carry out the operation you requested and deliver the result to you.
  • Legal basis: KVKK Art. 5(2)(c): establishing and performing the service (contract) you requested.
  • Retention: No later than about 10 minutes after processing finishes. Files are not backed up separately (see the note below).

• Job records

  For each job: the tool used, file size, job status, date and time, and the names of the uploaded and generated files.

  • Purpose: To run the job, deliver the result, count your daily allowance and, if you are a member, show your jobs on your History page.
  • Legal basis: KVKK Art. 5(2)(c) (performing the service) and Art. 5(2)(f) (legitimate interest in the security and fair use of the service).
  • Retention: For guests, file names are removed from the record about 15 minutes after the job (after the file itself is deleted). Members' job history stays on the History page until the account is deleted. Statistics with IP address and browser details removed, which cannot be linked to anyone (job type, size, status, time), may be kept longer.

• IP address and session ID

  30 days

  The IP address and a randomly generated session ID attached to job records. Your browser details (user agent) are not written to these records.

  • Purpose: To apply the daily limit for guests, prevent abuse and attacks, and keep the service secure.
  • Legal basis: KVKK Art. 5(2)(f): legitimate interest in the security and fair use of the service.
  • Retention: 30 days; then deleted. The guest limit only looks at the last 24 hours.

• Account details

  Until account deletion

  Username, email address, your password (stored only as an irreversible hash; we cannot see it either), and registration and last login date.

  • Purpose: To create and manage your account, verify your login, send password reset emails and apply the higher daily allowance for members.
  • Legal basis: KVKK Art. 5(2)(c): establishing and performing the membership contract.
  • Retention: Until you delete your account or ask us to delete it.

• Contact form

  Your name, email address, subject, message and, if you add one, a screenshot. Your IP address is also recorded to apply the daily message limit.

  • Purpose: To answer your question or report, and to prevent abuse of the form.
  • Legal basis: KVKK Art. 5(2)(f): legitimate interest in answering your request; for requests about your account, Art. 5(2)(c).
  • Retention: The message and attachment stay in our mailbox for at most 1 year after we reply; the IP record for 30 days. The attachment is kept on the server only until the email has been sent.

• Cookies

  Essential cookies (session, form security, your cookie choice) and, only if you allow them, Google Analytics and Google Ads measurement cookies.

  • Purpose: To run the site and keep it secure; with your consent, to measure how the site is used and whether our ads work.
  • Legal basis: Essential cookies: KVKK Art. 5(2)(c) and 5(2)(f). Analytics and ad measurement: only your explicit consent (KVKK Art. 5(1)).
  • Retention: As listed for each cookie in the Cookie Policy.

• Visit statistics (cookieless, aggregated)

  Cookieless

  We count how the site is used on our server, with a method that does not recognise you. Each time a page is opened, only the following is added to aggregate counters: the page opened and the site language; only the domain name of the site that referred you (e.g. google.com; the rest of the address is not collected); the source and medium of the campaign tag in the link (utm_source, utm_medium) and the campaign name (utm_campaign; only if it is one of our own campaigns, other names are not recorded); whether you came from an ad (only the presence of a click ID, not its value); the country code reported by Cloudflare; the device type (phone, tablet, computer); and only the family of your browser and operating system (no version). For this count we write no cookies or any other record to your browser, add no measurement script to the page and do no fingerprinting; your IP address and full browser details are not written to these counters. To tell automated request floods (bots) apart, a short, irreversible digest of your IP address is created with a secret key that changes every day and is kept only in the server's memory; this digest is deleted after 60 seconds and is not written to the counters. How often each choice in the cookie banner is made is counted only for visits from outside the European Economic Area, the United Kingdom and Switzerland, and again only in aggregate. Visits by the site owner, administrators and test devices are recognised only by the dn_noads cookie present on those devices or by an administrator session, and are excluded from the count.

  • Purpose: To see, in aggregate, which pages and tools are used and which sites and campaigns visitors come from; to filter out bot traffic; to monitor capacity and errors; to improve the service.
  • Legal basis: KVKK Art. 5(2)(f): legitimate interest in running and improving the service. Because the method does not recognise you and does no cross-site tracking, it does not depend on your cookie consent. Your rights regarding this data remain unaffected.
  • Retention: Daily totals that cannot be linked to a person are kept for at most 25 months; the names of sites that bring few visits are merged into “other sites” after 30 days. Raw daily counters stay in the server's memory for at most 3 days, and the page, source and country breakdown of the last few minutes for 10 minutes. As protection against crashes, this memory is also written to a persistence file on the server's disk; the file is automatically rewritten to shrink it, and records deleted from memory usually disappear from it within a day, and at the latest within about two days. This file is not backed up separately; only the server's daily disk snapshot, kept for 7 days, may contain its state at that moment (the short digests in it cannot be reversed, because their key is never written to disk). The data is not shared with anyone.

• Security check (Google reCAPTCHA)

  Google reCAPTCHA is loaded on the login, registration and contact pages to tell people from bots. On those pages Google processes your IP address, browser details and your interaction with the check, and may use its own cookies.

  • Purpose: To stop fake accounts, automated login attempts and spam messages.
  • Legal basis: KVKK Art. 5(2)(f): legitimate interest in the security of accounts and the service.
  • Retention: We only use the result of the check (passed or not) and do not store it. Data kept by Google is covered by Google's privacy policy.

• Technical logs

  7 days

  The web server and the application record, for requests, the IP address, date and time, requested address, response code and browser details, and for failed login attempts the username entered. File contents are never written to these logs.

  • Purpose: To fix errors and detect attacks and abuse.
  • Legal basis: KVKK Art. 5(2)(f): legitimate interest in the security of our systems.
  • Retention: Rotated automatically (older entries are deleted) and kept for at most 7 days.

• “Open with Dönüştür” browser extension (Chrome, Edge)

  No data collected

  An optional extension: when you right-click a link or an image and pick an action, it downloads that file from its address inside your browser, opens the matching donustur.net tool in a new tab and places the file in that page's upload area; a file you choose or drop in the extension's popup takes the same path to the tool. The file is requested the way your browser would download that link: if you are signed in to that site, your session cookies are sent with this request to that site only; they are never passed to us or anyone else. Permissions it uses: the right-click menu (contextMenus); local storage (storage), to keep your settings and your 5 most recent tools in your browser only; a timer (alarms), to delete an expired file copy within 10 minutes at the latest; access to donustur.net (to place the file on the tool page); and, only when you choose to open a file hosted on another site, optional access to that one site, asked at that moment. The extension collects no personal data, browsing history or usage statistics; it contains no analytics, ad or remotely loaded code; it sends nothing to us or to third parties.

  • Purpose: To bring the file you open to the right tool without you downloading and uploading it again.
  • Legal basis: The extension does not process personal data on our behalf: the file is moved only on your device, at your request. When you start a job on a tool that runs on our server, the file is uploaded to our server and the “Files and their contents” item above applies (with tools that run on your device, the file never leaves it).
  • Retention: The extension's copy of the file stays in your browser for at most 10 minutes and is deleted as soon as it is handed to the tool page. Your settings (interface language, the file families shown in the right-click menu) and your 5 most recent tools stay only in your browser's local storage (chrome.storage.local) and are never sent anywhere; they are deleted with “Delete all local data” in the extension's settings or when you remove the extension. You can revoke the extension's permissions at any time in your browser's extension settings or in the extension's own settings.

Data whose retention period has ended is deleted or anonymised. Nightly database backups, accessible only to the site administrator, are kept for 14 days, so information deleted from the live database (e.g. IP addresses removed after 30 days, or deleted accounts) may remain in backups for up to 14 more days before being deleted. Your uploaded files are not backed up separately; only the server's daily disk snapshot, kept for 7 days, may contain a file that happens to be processing at that moment.

In addition, we may use the relevant records where the law expressly provides for it or to comply with a legal obligation (KVKK Art. 5(2)(a) and (ç)), and where it is necessary to establish, exercise or defend a legal claim (Art. 5(2)(e)).

04How we collect data

Your personal data is collected electronically, partly by automated means, while you use the site: what you type into forms (registration, login, contact), the files you upload, the technical information your browser sends with every request (IP address, browser details) and cookies.

05Who we share data with

We do not sell your personal data. To run the site we use the service providers below; they access data only as far as needed to provide their service:

• Hosting: Amazon Web Services (AWS Lightsail, Frankfurt, Germany). The server that holds the site, the database, the backups and the files being processed.
• Content delivery and security: Cloudflare, Inc. (US-based, global network). All traffic to the site, including the files you upload, passes through Cloudflare. To secure the connection and block attacks, Cloudflare processes the traffic on its own servers and sees your IP address and request details. During a transition period, Cloudflare also added a cookieless measurement script (Cloudflare Web Analytics) to our pages: it sent the page address, the referring address and page-load measurements to Cloudflare, was used only for aggregate reporting and did not run for visitors from the European Union. This script was switched off completely in October 2026 and is no longer added to our pages. In addition, if a connection error occurs, your browser may send Cloudflare a technical error report (Network Error Logging).
• Email: Brevo (France) delivers password reset emails and contact form messages; Zoho (EU data centre) hosts the mailbox that receives email sent to @donustur.net addresses.
• Security check: Google (reCAPTCHA). Only on the login, registration and contact pages.
• Analytics and ad measurement: Google (Google Analytics 4, Google Ads). Only if you allow it in the cookie banner. Personalised advertising is off; your file names and contents are never sent to Google.
• Authorities: Public authorities or courts, only when they make a lawful request and only to the extent requested.

06Transfers outside Turkey

Our server is in Germany, so when you use the site your data is processed outside Turkey. Cloudflare and Google are US-based companies and may process data on servers in various countries; Brevo and Zoho provide their services from the EU. These transfers are made only for the purposes listed above, to provide the service (hosting, content delivery and Cloudflare's cookieless measurement during the transition period, email, security and, if you allow it, measurement).

07Your rights

Under Article 11 of the KVKK you can contact us to:

• find out whether your personal data is processed,
• request information about it if it is,
• find out the purpose of the processing and whether the data is used accordingly,
• know the third parties in Turkey or abroad to whom it is transferred,
• ask for it to be corrected if it is incomplete or inaccurate,
• ask for it to be deleted or destroyed under the conditions of Article 7 of the KVKK,
• ask for corrections, deletions and destructions to be notified to the third parties it was transferred to,
• object to a result against you that arises solely from automated analysis,
• claim compensation if you suffer damage because of unlawful processing.

How to apply You can send your request by email to privacy@donustur.net from the email address registered on the site, or in writing to the data controller (a signed letter, registered electronic mail (KEP), secure electronic signature or mobile signature). Please state your full name, contact details and your request clearly; if you are a member, also include your username. We will respond free of charge within 30 days at the latest, depending on the nature of the request. If handling it involves an additional cost, only the fee set by the Turkish Personal Data Protection Board may be charged. If you are not satisfied with our reply, you can complain to the Board.

08Cookies

Essential cookies (session, form security, your cookie choice) do not require consent. Google Analytics and Google Ads measurement cookies only run if you allow them in the cookie banner; you can withdraw your consent at any time from the same banner or the Cookie Policy page. Google reCAPTCHA is loaded for security on the login, registration and contact pages. We also count page views in aggregate, without cookies and with a method that does not recognise you; this count is not affected by your cookie choice (details: “Visit statistics”).

Cookie Policy

09Children

Dönüştür.net is not a service directed at children, and we do not knowingly collect children's data. If you are under 18, please use the site under the supervision of a parent or guardian.

10Changes to this notice

We update this notice when the way we process data changes. The current version is always on this page; the date of the last update is shown at the top.