ÖnGar
Sign inAccount

Personal data protection — privacy notice

Draft text. This page is a draft prepared before legal review (lawyer approval); the final version will be published before going live. Last updated: 14 October 2026.

Convenience translation. This English version is provided for convenience only; the Turkish text prevails.

1. Data controller

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller for personal data processed on this site (the ÖnGar demo / sandbox environment) is İsmail HATİPOĞLU (Ev Akıllı Otomasyon Sistemi Ltd. Şti.). Contact: ismail@preorderone.com.

2. Nature of this site

ÖnGar is the demo / sandbox version of a guarantee infrastructure for pre-order sales. No real payments are taken on the site and no card or bank account details are requested; the "partner bank" is simulated by software in the demo environment. The platform never holds customer money at any stage. Records in the demo environment are not real commercial transactions and may be deleted when the service goes live.

3. Personal data processed

  • Account data: role (buyer, seller, operations, administrator) and the linked institution / seller record. The e-mail address (for contact) of institution staff and of accounts opened before the WhatsApp sign-in, and the irreversible hashes of the passwords they set earlier. Sign-in is with WhatsApp; sign-in with e-mail and password stays open only for a short transition so that these accounts can link their WhatsApp number, then closes, and the password hashes are not used for any sign-in.
  • WhatsApp sign-in data: your phone number (it becomes your account's identity; when you link it to an existing account, it becomes that account's way to sign in), your WhatsApp profile name (used as the name on your account; you can change it), the one-time code you send and the WhatsApp message id (only as an irreversible hash), the time of the sign-in attempt and the page language. The company e-mail you may add (not verified; free e-mail addresses are not accepted).
  • Session data: the session identifier created when you sign in (stored as a hash), its creation, last activity, last identity check (sign-in or re-confirmation with a WhatsApp code) and expiry time.
  • Seller application data: company / business details, sector, product or project description, collateral declaration and the limit set by the partner institution.
  • Order and transaction records: pre-orders, payment plans, delivery confirmations, refund requests and the related instruction / ledger records (demo amounts; there is no real money movement).
  • Assistant interactions: the questions you write to the ÖnGar assistant and the short audio recording you send for a spoken question. The recording is processed only to convert it to text and is not stored on the site. Questions may be logged by the infrastructure provider (Cloudflare AI Gateway) when they are passed to the AI model.
  • Confidentiality Agreement acceptance record: when you accept the Confidentiality Agreement to see the confidential content (the details dossier) or to sign in with WhatsApp: your account (user id; at WhatsApp sign-in first tied to the sign-in attempt, then to your account once you sign in), the date and time of acceptance, the agreement version, your IP address, your browser details (user-agent) and the page language.
  • Technical data: IP address, request path and time, error type (with personal data masked), short-lived attempt counters per IP address and e-mail to prevent abuse; the Cloudflare Turnstile verification result when bot protection is enabled on the registration page.

Special categories of personal data (health, religion, biometric data, etc.) are neither requested nor processed.

4. Purposes and legal grounds

  • Opening accounts, signing in and role-based authorisation — KVKK art. 5/2 (c): establishing or performing a contract.
  • WhatsApp sign-in: verifying that the phone number is yours, opening and recognising the account, and showing the masked number in the browser so that nobody else is signed in by mistake — art. 5/2 (c) and (f). Optional company e-mail: declaring that the account belongs to an organisation and the usage limits tied to it (e.g. the length of voice assistant calls) — art. 5/2 (c) and (f).
  • Running the seller application, limit, hold, delivery and refund flows in the demo environment — art. 5/2 (c) and (f): the data controller's legitimate interest.
  • Site security, abuse prevention and error tracking — art. 5/2 (f): legitimate interest.
  • Answering assistant questions — art. 5/2 (f) and, for spoken use, your explicit consent (art. 5/1).
  • Confidentiality Agreement acceptance record: proof that the agreement was made and which version was accepted, and opening the confidential content only to those who accepted — art. 5/2 (c) and (e): establishing, exercising or protecting a right.
  • Fulfilling legal obligations and answering requests — art. 5/2 (ç) and (e).

5. Transfers

The site is hosted on Cloudflare infrastructure (Workers, D1 database, KV, Workers AI / AI Gateway); data may therefore be processed on servers abroad. The conditions of KVKK art. 9 for transfers abroad (adequacy decision, appropriate safeguards or explicit consent) will be settled by legal review. In a partner institution's sandbox, seller and order data are visible to that institution's operations accounts. Data is not transferred to third parties for advertising or marketing purposes and is not sold.

WhatsApp: ÖnGar's WhatsApp number is operated on the WhatsApp Business Platform by OrderInChat, an intermediary service provider (data processor) acting for ÖnGar. Messages you send to this number pass through the systems of Meta (the provider of the WhatsApp service) and OrderInChat; OrderInChat forwards the code in a sign-in message, your phone number, your WhatsApp profile name and the message id to ÖnGar and sends you a short reply. OrderInChat's AI assistant may answer your other messages on ÖnGar's behalf. Meta's and OrderInChat's servers may be located abroad; this is a transfer abroad under KVKK art. 9, whose conditions (adequacy decision, appropriate safeguards or explicit consent) will be settled by legal review. Meta's own processing of WhatsApp data is governed by WhatsApp's privacy policy. Signing in to the site is only possible with WhatsApp; if you do not want to use WhatsApp, you can use the listings, the simulation and the demo accounts without signing in.

6. Retention periods

  • Session record: at most 30 days or until you sign out.
  • Account and transaction records: until the account is deleted or the demo environment is shut down; demo data is cleared when the service goes live.
  • Attempt counters: 15 minutes.
  • WhatsApp sign-in attempt record: 24 hours; the phone number and WhatsApp name are removed from it as soon as you confirm or cancel the sign-in. Phone number, name and company e-mail: until your account is deleted (you can remove the company e-mail from your profile at any time). Message records at Meta and OrderInChat: according to those services' retention policies.
  • Confidentiality Agreement acceptance record (including IP address and browser details): for the duration of our relationship and 10 years after it ends (the general limitation period); during that time the record is neither changed nor deleted, and at the end it is deleted or anonymised.
  • Technical logs and assistant logs: according to the infrastructure provider's short retention policy.

7. Cookies

Only the essential session cookie and, when you pick a language, a language preference cookie are used; there are no analytics or advertising cookies. Details are in the cookie policy.

8. Your rights (KVKK art. 11)

You have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of the processing and whether it is used in line with that purpose, to know the third parties to whom it is transferred, to request its correction if it is incomplete or inaccurate, to request its deletion or destruction, to request that these actions be notified to the third parties it was transferred to, to object to a result against you that arises solely from analysis by automated systems, and to claim compensation if you suffer damage from unlawful processing.

Requests are sent to ismail@preorderone.com in line with the Communiqué on the Procedures and Principles of Applications to the Data Controller and are answered within 30 days at the latest.

9. Changes

When this notice is updated, the new version is published on this page together with the date of the update.