Cookie Policy
Last updated: 6 October 2026
1. About this policy
This Cookie Policy explains the cookies and similar technologies that store information in your browser (local storage, session storage, pixels and tags) used on the creativesdata.com website (the "Site"). It is prepared under the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK") and, for visitors from the European Union, the General Data Protection Regulation ("GDPR"). For general information on how we process personal data, see our KVKK and GDPR texts.
2. Data controller
Data controller: Creatives Data
Address: Fikirtepe Mah. Rüzgar Sok. No:29/1K Dükkan:10, Kadıköy, İstanbul, 34720, Türkiye
You can submit requests about your rights through the channels described in the "Exercise of the Rights of the Relevant Person" section of our GDPR text.
3. What is a cookie?
A cookie is a small text file that a website stores in your browser. Local storage and session storage also keep information in the browser; session storage is deleted when the tab is closed. In this policy we call all of them "cookies". First-party cookies are stored under the Site's own domain, third-party cookies under another provider's domain.
4. Cookie categories
- Necessary: needed for the Site to work, to keep it secure and to remember your cookie choice. Always on; they do not depend on your consent.
- Analytics: help us measure and improve how the Site is used. Only with your consent.
- Marketing: help us measure our advertising and show relevant ads. Only with your consent.
- Notifications: let us send browser notifications. Only with your consent and your browser's own permission.
The cookie banner asks only about the categories that have a tool on the Site at the time. Today the Site has tools in the Analytics category; when tools in the Marketing and Notifications categories are switched on, the banner will ask about them too and this policy will be updated. Until you turn a category on, its tools are not loaded and write no cookies.
5. How to change your choice
- The "Cookie preferences" button at the bottom of the Site (footer) opens the cookie banner again with its settings. You can turn categories on or off, or choose "Reject all" or "Accept all".
- When you withdraw consent for a category, its tools are stopped, their cookies and records under the Site's domain are deleted and the page reloads once.
- Your choice is kept for 180 days; after that the banner asks again.
- You can also delete or block cookies in your browser settings. If you block necessary cookies, your choice cannot be remembered and the banner may appear on every page.
6. The Site's own cookies
| Name | Type | Category | Purpose | Duration |
|---|---|---|---|---|
| cd_consent | First-party cookie | Necessary | Your cookie choice: consent ID, the categories asked, your choices and the time of the decision | 180 days |
| cd-consent | Local storage | Necessary | A copy of the same choice; keeps open tabs in step | 180 days, with the decision |
| cd-first-touch | Session storage | Analytics | The first page you landed on, the referring site and campaign tags (UTM); added to the contact form if you send it | Until the tab is closed |
7. Tools we use
The tables below show the tools used on the Site today and the tools planned to be switched on. Planned tools load only after you consent to their category; this policy will be updated when they are switched on. Durations are those stated in each provider's own documentation.
7.1 Tools used today
| Tool | Provider and country | Category and purpose | Cookies / storage and duration |
|---|---|---|---|
| PostHog | PostHog Inc., USA. Data hosted in PostHog Cloud EU, Frankfurt (Germany). | Analytics: page views, clicks and performance (Web Vitals). | ph_[project key]_posthog cookie: 365 days. Local storage under the same name: until consent is withdrawn or it is deleted. ph_[project key]_* session storage keys: until the tab is closed. |
| Sentry | Functional Software, Inc. (Sentry), USA. Data hosted in Sentry's EU region, Frankfurt (Germany). | Necessary: detecting and fixing errors on the Site and keeping it secure. | In the Site's configuration it writes no cookies and no persistent storage (session replay is off). |
| Vercel | Vercel Inc., USA. The Site's server functions run in Frankfurt (fra1); account data in the USA. | Necessary: hosting and serving the Site (processor). | Writes no cookies on the live Site. |
| Supabase | Supabase Pte. Ltd., Singapore. The database and files are stored in the eu-central-1 region, Frankfurt (Germany). | Necessary: storing contact form submissions and the Site's images (processor). | No cookies in the browser; used on the server only. |
| Resend | Plus Five Five, Inc. (Resend), USA. Account and email records in the USA. | Necessary: sending the form notification and auto-reply emails (processor). | No cookies in the browser; used on the server only. |
| Upstash | Upstash, Inc., USA. Database in the selected region. | Necessary: rate limiting form submissions to prevent abuse (processor). Only a hash of the IP address is used. | No cookies in the browser; used on the server only. |
| Tool | Legal basis | Retention at the provider | International transfer (planned basis) |
|---|---|---|---|
| PostHog | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | 7 years. | KVKK art. 9: the Board's standard contract. GDPR: EU-U.S. Data Privacy Framework (DPF) certification and standard contractual clauses (SCCs). |
| Sentry | Legitimate interest (KVKK art. 5(2)(f); GDPR art. 6(1)(f)). | Error events 30 or 90 days, by plan. | KVKK art. 9: the Board's standard contract. GDPR: DPF and SCCs. |
| Vercel | Entering into and performing a contract, legitimate interest (KVKK art. 5(2)(c), (f); GDPR art. 6(1)(b), (f)). | For the term of the contract; deleted within a reasonable time after it ends. | KVKK art. 9: the Board's standard contract. GDPR: DPF and SCCs. |
| Supabase | Steps before entering into a contract, legitimate interest (KVKK art. 5(2)(c), (f); GDPR art. 6(1)(b), (f)). | Form data for the periods in our privacy texts; deleted within 30 days after the contract ends. | KVKK art. 9: the Board's standard contract. GDPR: SCCs. |
| Resend | Steps before entering into a contract, legitimate interest (KVKK art. 5(2)(c), (f); GDPR art. 6(1)(b), (f)). | Email records 30 days. | KVKK art. 9: the Board's standard contract. GDPR: DPF and SCCs. |
| Upstash | Legitimate interest (KVKK art. 5(2)(f); GDPR art. 6(1)(f)). | The rate limit key expires with its 10-minute window. | KVKK art. 9: the Board's standard contract. GDPR: DPF and SCCs. |
7.2 Tools planned
| Tool | Provider and country | Category and purpose | Cookies / storage and duration |
|---|---|---|---|
| Google Tag Manager | Google Ireland Limited (Ireland) and Google LLC (USA). | Loaded with Analytics or Marketing consent; runs the measurement and advertising tools below according to consent. Collects no visitor data itself. | _dc_gtm_[id] cookie (in some configurations): 1 minute. |
| Google Analytics 4 | Google Ireland Limited (Ireland) and Google LLC (USA). | Analytics: measuring visits and form conversions. | _ga and _ga_[id] cookies: 2 years (browser limits may be shorter). |
| Microsoft Clarity | Microsoft Ireland Operations Limited (Ireland) and Microsoft Corporation (USA); data in Microsoft Azure. | Analytics: understanding page use through heatmaps and session recordings. Form fields are masked; what you type is not recorded. | _clck (1 year) and _clsk (1 day) first-party cookies. Third-party cookies of clarity.ms and bing.com: CLID, MUID, ANONCHK, SM, MR (Microsoft's official page states no duration). |
| Google Ads | Google Ireland Limited (Ireland) and Google LLC (USA). | Marketing: measuring form conversions from ads; SHA-256 hashes of email and phone for Enhanced Conversions. | _gcl_au, _gcl_aw, _gcl_gs and similar first-party cookies: 90 days. IDE (doubleclick.net, third party): 13 months. |
| Meta Pixel + Conversions API | Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA). | Marketing: measuring page views and form conversions, ad targeting. The Conversions API reports the conversion from the server (section 8). | _fbp and _fbc first-party cookies: 90 days. The Conversions API writes nothing in the browser. |
| TikTok Pixel + Events API | TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited (United Kingdom). | Marketing: measuring page views and form conversions, ad targeting. The Events API reports the conversion from the server (section 8). | _ttp, ttcsid, ttcsid_[pixel code] and ttclid first-party cookies and the tiktok.com _ttp third-party cookie: 13 months from last use. The Events API writes nothing in the browser. |
| LinkedIn Insight | LinkedIn Ireland Unlimited Company (Ireland) and LinkedIn Corporation (USA). | Marketing: measuring page views and form conversions, ad targeting. | li_fat_id (30 days) and li_giant (7 days) first-party cookies. linkedin.com third-party cookies: bcookie (1 year), lidc (24 hours), li_gc (6 months), UserMatchHistory and AnalyticsSyncHistory (30 days). |
| OneSignal | OneSignal, Inc., USA. | Notifications: browser push notifications. Only with your consent and your browser's own permission. | Its documentation lists no cookies. IndexedDB: ONE_SIGNAL_SDK_DB; local storage: os_pageViews, isOptedOut, isPushNotificationsEnabled; session storage: onesignal-pageview-count, ONESIGNAL_HTTP_PROMPT_SHOWN; service worker: OneSignalSDKWorker.js. Until you revoke the notification permission or delete them. |
| Tool | Legal basis | Retention at the provider | International transfer (planned basis) |
|---|---|---|---|
| Google Tag Manager | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | Standard request logs deleted within 14 days. | KVKK art. 9: the Board's standard contract (planned). GDPR: DPF and SCCs. |
| Google Analytics 4 | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | User and event level data: 14 months (our setting). | KVKK art. 9: the Board's standard contract (planned). GDPR: DPF and SCCs. |
| Microsoft Clarity | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | Recordings are available for up to 30 days. | KVKK art. 9: the Board's standard contract (planned). GDPR: SCCs. |
| Google Ads | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | The periods in Google's advertising terms. | KVKK art. 9: the Board's standard contract (planned). GDPR: DPF and SCCs. |
| Meta Pixel + Conversions API | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | Hashed contact data deleted after matching; event data up to 2 years. | KVKK art. 9: the Board's standard contract (planned). GDPR: DPF and SCCs. |
| TikTok Pixel + Events API | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | TikTok's documentation states no period for pixel event data. | KVKK art. 9: the Board's standard contract (planned). GDPR: SCCs. |
| LinkedIn Insight | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | Directly identifying data removed within 7 days; pseudonymised data deleted within 180 days. | KVKK art. 9: the Board's standard contract (planned). GDPR: DPF (LinkedIn Corporation) and SCCs. |
| OneSignal | Explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)). | On the free plan, subscribers inactive for 18 months are deleted; on paid plans, until deleted. Messages sent through the API about 30 days. | KVKK art. 9: the Board's standard contract (planned). GDPR: DPF and SCCs. |
8. Server-side events (Meta Conversions API, TikTok Events API)
When the marketing tools are switched on and you successfully send the contact form, this conversion is reported directly from our server to Meta (Conversions API) and TikTok (Events API), in addition to the pixel in your browser. This report:
- is made only if you consented to the Marketing category; without consent nothing is sent;
- contains your email address and phone number only as SHA-256 hashes; never in plain form;
- also contains an event ID, the event time, the address of the form page, your IP address, browser information and, if present, these platforms' cookie values on the Site (
_fbp/_fbcfor Meta,_ttpfor TikTok) and the ad click ID; - carries the same event ID as the browser pixel, so the platform does not count the same conversion twice.
"Advanced matching" is off in the Meta and TikTok pixels in the browser; the browser sends no personal data to these platforms.
Under Meta's and TikTok's own terms, for visitors whose data is subject to the GDPR or the UK GDPR, we are joint controllers with Meta and with TikTok for the collection of pixel and server event data and its transmission to these platforms.
9. Consent record
Every decision you make in the cookie banner is recorded as proof of consent: a random consent ID, the policy version, your choices per category, the type of decision (granted, updated, withdrawn), its time, the page where you made it, a hash of your IP address and browser information. Your IP address is not stored in plain form. The record is kept for 3 years and then deleted or anonymised.
10. Retention periods
- Your cookie choice (cd_consent): 180 days.
- Consent record: 3 years.
- Event data in Google Analytics 4 (once switched on): 14 months.
- Tools' cookies: the durations in the tables above.
- Contact form and other personal data: the periods in our GDPR text.
11. International transfers
Most of the tools we use process data on servers outside Türkiye, which is a cross-border transfer under the KVKK.
- Basis: under Article 9 of the KVKK as amended by Law No. 7499, a cross-border transfer is made to a country with an adequacy decision of the Personal Data Protection Board or with one of the appropriate safeguards. As the safeguard, the standard contract announced by the Board is signed with the providers and notified to the Personal Data Protection Authority within 5 business days of signature. For occasional, non-regular transfers, the exceptions listed in the Law (such as explicit consent) may be relied on.
- Under the GDPR: for transfers outside the European Economic Area, the provider's certification under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses (SCCs) are used.
- The basis planned for each tool is in the tables in section 7.
12. Your rights
Under Article 11 of the KVKK and the GDPR you have the right to learn whether your personal data are processed, to request information, rectification and erasure, to object to processing and to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. How to apply is described in our GDPR text. Visitors in the European Union also have the right to lodge a complaint with the data protection authority of their country.
13. Changes
We update this policy when the tools we use or the law change. The current version is always on this page; when the cookie categories change, the cookie banner asks for your choice again.
This policy in Turkish: Çerez Politikası.