Privacy Notice
Version: 2026-10-16
This is a translation. In case of any discrepancy, the Turkish version prevails.
As the data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), [YER TUTUCU: company name, address, registration no] ("we") informs you about the personal data processed when you use Candlestat.
1. Data processed and purposes
| Data | Purpose | Legal basis (KVKK art. 5/2) |
|---|---|---|
| Email address, password (only an irreversible hash, Argon2id), language preference | Creating and managing the account, sign-in, notification emails (verification, password reset, trial and plan expiry, password change) | (c) conclusion and performance of a contract |
| Strategies, backtest and optimization results, watchlists, chart layout, plan and usage information | Providing the Service | (c) performance of a contract |
| IP address, browser information (User-Agent), session and security events (sign-in, failed sign-in, password change, sign-out, acceptance of terms) | Account security, preventing abuse and unauthorized access, evidence in disputes | (f) legitimate interest, (e) establishment and protection of a right, (ç) legal obligation |
| Version and time at which the terms were accepted | Proof of acceptance | (c), (e) |
Personal data is collected by automated means through the registration form, your use of the application and the technical information your browser sends. We do not process special categories of personal data. We do not send marketing emails and do not track you for advertising or analytics.
2. Transfers
Your data is not sold or shared for advertising. It is transferred only to the following service providers, acting as data processors, so that the Service can run:
| Recipient | Location | Purpose |
|---|---|---|
| [YER TUTUCU: Hetzner Online GmbH] | [YER TUTUCU: Germany / Finland] | Servers and data storage |
| [YER TUTUCU: Brevo (Sendinblue SAS)] | [YER TUTUCU: France / EU] | Sending emails (only the email address and the email content) |
These transfers are made abroad. Under KVKK art. 9, they rely on [YER TUTUCU: standard contract announced by the Board, signed and notified to the Authority]. Data may be shared with competent public authorities where required by law.
Market data is obtained from Binance's public endpoints; no data about you is sent to Binance.
3. Retention periods
| Data | Period |
|---|---|
| Account information, strategies, lists, layout | Until the account is deleted |
| Backtest and optimization results | The last 50 jobs per user or 90 days (whichever comes first) |
| Session records | 7 days after closing or 30 days after last use |
| Sent email records | 7 days (content is deleted right after sending) |
| Security records (IP, browser, events) | 2 years |
When you delete your account, your account information, strategies, backtest results, lists and layout are deleted immediately and permanently; emails pending to you are cancelled; the IP address and browser information in your security records are erased. Event records (e.g. "signed in") remain for the period above in a form that cannot be linked to you. Copies in backups are rotated out within [YER TUTUCU: backup retention period].
4. Cookies and browser storage
Only cookies strictly necessary for the Service are used; there are no advertising or analytics cookies, so no cookie consent is requested.
| Name | Purpose | Lifetime |
|---|---|---|
aq_at | Session (access token) | 15 minutes |
aq_rt | Session renewal | 30 days |
aq_csrf | Protection against cross-site request forgery | For the session |
aq_locale | Language preference | 1 year |
Your browser's local storage keeps theme, chart and panel preferences (theme, aq-terminal, aq-indicators, aq-quant, aq-watchlist); these are not sent to the server.
5. Security
Passwords are stored irreversibly (Argon2id). Connections are encrypted (HTTPS). Access is limited to those who need it. You receive an email when your password changes and can sign out of all devices.
6. Your rights (KVKK art. 11)
You have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether data is used accordingly; to know the third parties to whom it is transferred; to request correction if it is incomplete or inaccurate, and deletion or destruction; to request that such operations be notified to recipients; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage due to unlawful processing.
You can view and correct your account information and data in the application and delete your account. For other requests, contact [YER TUTUCU: request email / registered email / postal address] with information that verifies your identity. Requests are answered free of charge within 30 days at the latest.
7. Changes
We may update this notice. For material changes, the updated text is shown in the application. The version is shown at the top of the page.