Privacy Policy and KVKK Disclosure Notice

Last updated: 10 Ekim 2026

This is a courtesy translation. The original of this page is in Turkish; if the translation and the original text differ, the Turkish text governs.

This text is prepared to inform you about personal data processed through Watch Your WP ("the Service") under Law No. 6698 on the Protection of Personal Data ("KVKK"), Turkey's data protection law. Watch Your WP is currently in beta and is completely free: there are no paid plans, subscriptions, or payments, so no payment or billing information is collected.

1. Data Controller

Watch Your WP is currently not operated under a separate legal entity (company), but individually by Erdinç Bulat. The data controller under KVKK is Erdinç Bulat. Once a company is formed for the Service, this text will be updated and the data controller information changed accordingly.

2. What Data We Collect

The following categories of data are processed while you use the Service:

  • Account data: full name, email address, password (stored irreversibly hashed).
  • Organization/workspace data: the workspace name you create, brand settings (logo, color).
  • Data about the WordPress sites you manage: site address, WordPress/PHP version, plugin/theme list, WordPress user list, media library metadata, backup files (including site files and database content), PHP error logs, security scan findings, uptime, SSL/domain expiration information. This data is pulled through the Watch Your WP Connector plugin installed on your site, with your authorization.
  • Backup files: backups are created and stored on your site's own server. Watch Your WP does not keep a copy of backup files on its own servers or in any other storage service; the panel only stores record details such as the backup's name, size, and status. When you download a backup from the panel, the file is fetched from your site and passed directly to you without being stored.
  • Usage/transaction logs: a record of the actions you take in the panel, login time, IP address.
  • Technical data: browser/session information, cookies (see Section 7).

If a WordPress site you connect contains data belonging to other people (e.g. site users, media, commenter information), you are the data controller for that data with respect to those individuals; Watch Your WP acts on your behalf as a data processor in that respect.

Traffic statistics: If you turn this feature on for a site, visitor records are kept in that site's own database; no cookies are used, and IP addresses and browser details are not stored in raw form (a daily-rotating, irreversible hash is used instead). Watch Your WP does not store these visitor-level records on its own servers; the panel only fetches aggregate counts (views, sources, countries, devices) live from your site to display and report them. You remain responsible for informing your own site's visitors, and we recommend mentioning this feature in your privacy notice. Tracking is off by default, and you can turn it off and delete the data from the panel at any time.

3. Purposes of Processing

  • Providing the Service: viewing/managing sites from the panel, backup, updates, monitoring.
  • Security: preventing unauthorized access, detecting misuse, rate limiting.
  • Notifications and email delivery: downtime/SSL/security alerts, the daily summary email, monthly reports, password resets.
  • Improving the Service and fixing bugs.
  • Fulfilling legal obligations.

4. Legal Basis

Your personal data is processed primarily on the grounds, under KVKK Art. 5/2, of being directly related to the establishment or performance of a contract (being necessary for us to provide the Service) and legitimate interest. Where explicit consent is required (e.g. your acceptance of this text), consent is obtained separately.

5. Parties Data Is Transferred To

Data is shared with a limited number of subcontractors/infrastructure providers to deliver the Service:

  • Resend: sending notification and transactional emails (password reset, alerts, monthly report).
  • Railway: the server infrastructure hosting the application and database.
  • Sentry: recording and fixing application errors. Sensitive values such as passwords, API keys, and session data are removed before they reach the error logs.
  • Cloudflare: hosting the public website (watchyourwp.com) and bot protection (Turnstile) on some forms.
  • Google PageSpeed Insights and Safe Browsing APIs: speed measurement and blacklist checks for your site; only the site address is sent.
  • Google Analytics: visit statistics for the public website (watchyourwp.com) only; not used in the panel (see Section 7).
  • WordPress.org's official checksum APIs: for core/plugin file integrity checks; contains no personal data.

These providers' servers may be located abroad; in that case, the data transfer is carried out in accordance with KVKK's provisions on cross-border data transfer. Data is not shared with or sold to any third party beyond the ones listed above for marketing purposes.

6. Retention Period

Your data is retained for as long as your account is active. When you delete your account or request its deletion, data is deleted or anonymized within a reasonable period, except for data subject to a legal retention obligation.

Backup files on your site's own server are not deleted when you remove the site from the panel; they are deleted together with all of the plugin's data when you delete the Watch Your WP Connector plugin from your site.

7. Cookies

The Watch Your WP panel (app.watchyourwp.com) does not use advertising or tracking cookies. Cookies in the panel are limited to keeping your session open (login session) and remembering your preferences (interface preferences such as theme, sidebar state). The public website (watchyourwp.com) uses Google Analytics for visit statistics, which places analytics cookies in your browser. You can block or delete these cookies in your browser settings; this does not affect how the panel works.

8. Data Security

Passwords are hashed irreversibly, and the API keys used to connect to WordPress sites are protected the same way. All actions requiring authentication go through an authorization check, and critical actions (removing a site, core updates, deleting a user, etc.) are subject to an additional authorization check. That said, no data transmission or storage over the internet can be guaranteed to be 100% secure.

9. Your Rights (KVKK Art. 11)

Under Article 11 of KVKK, you may apply to us to:

  • Learn whether your personal data is being processed,
  • Request information about it if it has been processed,
  • Learn the purpose of processing and whether it is used in accordance with that purpose,
  • Request correction if it has been processed incompletely or incorrectly,
  • Request its deletion or destruction,
  • Object to a result arising against you through analysis exclusively via automated systems,
  • Request compensation for damages you suffer due to unlawful processing

and you hold these rights.

10. How to Apply

To exercise the rights above, or for questions about this policy, you can reach us at [email protected].

11. Changes

This policy may be updated as the Service develops (e.g. adding a new infrastructure provider, moving under a company). You will be notified of material changes via your registered email address.