Privacy Notice
Last updated: 31 August 2026
What personal data we process, why, and for how long. We have kept it short; if anything is unclear, write to us and we will explain.
Who we are
Versamigo is the data controller for everything described here. We are a two-person team working in human resources, training and consulting.
| Tax number | 9251059255 |
| Address | Hz. Fakirullah St. No: 113/4, Siirt, Türkiye |
| contact@versamigo.com | |
| Phone | +90 542 419 41 95 |
What this covers
Two addresses: our brochure site versamigo.com, and our free habit programme plan.versamigo.com. They process different data, so they are described separately below.
One thing it does not cover: if we have a consulting or training relationship with you, the data processed in that relationship falls under a separate agreement and is not the subject of this notice.
versamigo.com — the contact form
| Data | Why | Lawful basis |
|---|---|---|
| Name, email address, your message | To answer you | Steps taken at your request — KVKK Art. 5/2, GDPR Art. 6(1)(b) |
| Phone (optional) | If you would rather we called than wrote | Same; you may leave it blank |
| Your IP address and browser characteristics | To protect the form from automated submissions | Legitimate interests — KVKK Art. 5/2(f), GDPR Art. 6(1)(f) |
When you submit the form your message reaches us as an email and stays in our inbox. It is not written to any database.
The “are you human” check under the form is Cloudflare Turnstile. It evaluates your IP address and your browser’s technical characteristics to tell people from bots. It does not track you across sites and is not used for advertising.
plan.versamigo.com — the 21-day plan
By default the programme runs only on your device. What you write stays in your browser’s storage; no account is needed and none of what you write reaches us. (The app makes a short request to the server on opening — with backup off, that request carries no part of your plan.)
Backup happens only if you turn it on. When you do, we process:
| Data | Why | Lawful basis |
|---|---|---|
| Your email address | To send your sign-in code and to attach the backup to you | Performance of the service you asked for — KVKK Art. 5/2(c), GDPR Art. 6(1)(b) |
| Your plan: your habit, your daily marks, and the free text you write | To back it up and carry it to your other devices | Same |
| Which day you are on, how many days you marked, which language you chose | To see in aggregate whether the programme works | Legitimate interests — KVKK Art. 5/2(f), GDPR Art. 6(1)(f) |
| Timestamps: when your account was created, when you last signed in, when you last wrote something | To see that backup is working and to manage your record | Performance of the service you asked for |
| A digest of your email and IP address, not the addresses themselves | To limit sign-in and backup requests — abuse protection | Legitimate interests — security |
The programme deliberately has no sleep, energy or mood rating fields, and never will. We do not collect health data. What you write in the free-text fields is up to you — if you would rather not write anything about your health, don’t.
Who we share it with
We do not sell personal data. We use these providers to run the service:
| Provider | What it does | Where |
|---|---|---|
| Cloudflare | Hosts the sites, runs the database, performs the bot check | Database pinned to the EU; pages served from the global network |
| Resend | Delivers contact-form and sign-in-code emails | European Union |
| Amazon SES | Resend’s email infrastructure — a sub-processor | European Union (Ireland) |
| Zoho Mail | Our inboxes — where your form messages rest | European Union |
We share your data with no one else. If a legal obligation arises, we share only to the extent required.
Transfers outside Türkiye
Versamigo is established in Türkiye, and none of the providers above are in Türkiye. Your personal data is therefore transferred abroad.
Where it goes depends on the data. The database holding your plan backup is pinned to the European Union jurisdiction; that is chosen once at creation and cannot be changed afterwards. Our email providers are in EU regions too. The pages themselves and the form handling are served from Cloudflare’s global network — you get the page from the server nearest you, and that server may be outside the European Union.
Choosing EU regions is deliberate: it keeps what you write, and your address, inside the EU data-protection regime.
How long we keep it
| Data | Period |
|---|---|
| Your contact-form messages | As long as needed to answer you and to keep a record of our correspondence. Deleted on request. |
| Your plan backup and email address | Until you delete it. “Delete my data” in the programme does it in one step. |
| Sign-in codes | The code itself is valid for 10 minutes. The record holding it is deleted when you sign in, or by the next sweep if you never do. |
| Rate-limit digests | A one-hour window, then deleted by the first sweep after it closes. |
| Session cookie | 180 days, refreshed on each use |
| Our old site’s archive | We hold a copy of form submissions sent to our former WordPress site between 2023 and 2026. Those records also contain the sender’s IP address and browser details, and most of them are spam. Deleted on request. |
Unless you delete it yourself, we keep your backup indefinitely — we do not delete it for inactivity, because someone returning after months and finding their writing gone is the worse outcome. Deleting is always one tap away.
Your rights
Under KVKK Art. 11 and the GDPR you may ask us to:
- Tell you whether we process your personal data, and give you a copy
- Correct it if it is wrong or incomplete
- Delete it
- Stop processing it, where you object
- Give you your data as a structured file (portability)
- Restrict how we process it
To delete your plan backup you need not write to anyone: “Delete my data” in the programme’s menu deletes your record on the server, then asks separately whether to clear this device too.
For anything else, write to contact@versamigo.com. We answer within 30 days at the latest. If you want a machine-readable copy of your data, we prepare and send it when you ask at that address — there is no download button inside the programme.
If our answer does not satisfy you, you may complain to the Personal Data Protection Authority in Türkiye (kvkk.gov.tr), or to the data protection authority of your country in the European Union.
Changes
If we update this notice we change the date above. For a significant change — a new provider, for instance — we also announce it on the site.