Privacy Policy and KVKK Disclosure Notice
Last updated: 12 November 2026
This notice is prepared under Article 10 of the Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, “KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). For users in the European Union and the United Kingdom, it also provides the information required by Articles 13 and 14 of the General Data Protection Regulation (GDPR / UK GDPR). It explains which of your personal data we process, why, on what legal basis, to whom we transfer it and for how long, as well as your rights and how to exercise them.
1. Data controller
Data controller: Ahmet Budak (sole proprietorship; trading under the name “Kosto”)
Tax office: Akşehir · Place of business: Akşehir, Konya, Türkiye · Activity: computer programming (software services)
Email: support@getkosto.com
The data controller is not a company and has no MERSİS number or registered electronic mail (KEP) address. No data controller representative, European Union representative or United Kingdom representative has been appointed; data subjects may contact us on any matter at the email address above or through the form in section 10.
2. Personal data we process
| Data category | Scope | Purpose |
|---|---|---|
| Account data | Email address, name (if you provide it), password hash (not the password itself), account language and preferences, selected plan, registration time and last sign-in time | To open, verify and manage the account |
| Session and security data | Session token hash, coarse device information (browser and operating system name), session times; second-factor verification data for administrators | To keep your session active and protect your account |
| Usage data | Domains you look up, watchlists and ranking projects, data credit transactions, API request counts, API key hash, notification settings | To provide the service, to enforce limits and credits, to send alerts |
| Payment reference | Invoice/transaction number, amount, currency, payment method, transaction hash, wallet address (for crypto payments), date, payment status, record of your consent to withdrawal/immediate start of the service | To match the payment to your account, for refunds, accounting and legal obligations |
| Technical and log data | IP address (only in security and transaction logs), browser and device information, request time, error logs | Security, prevention of abuse and fraud, debugging |
| Abuse prevention data | Irreversible hashes derived from the IP address and network, hash of the device ID cookie, browser fingerprint hash, rate and sequence behavior scores | To prevent the one-time rights of the free plan from being claimed again, automated bulk data extraction, and multiple accounts |
| Measurement (analytics) data | Pages visited, referral source (domain of the referring site, campaign tags, ad click ID), device type, browser, operating system, language, screen size, country where available, visit duration; tools opened in the panel and key button clicks | To understand which sources and pages work, and to improve the product (details: Section 8) |
| Communication data | Support correspondence, your personal data requests and our replies, system emails sent and the variables they contain | To provide support and respond to applications |
| Consent and preference records | Record of acceptance of the Terms of Use and of reading this privacy notice, promotional email consent and its withdrawal (time, text version, where it was given); your measurement preference is stored in your browser | To prove and apply your consent and preferences |
| Telegram connection (optional) | The chat ID and username you connect of your own choice in order to receive notifications on Telegram | To deliver the notifications you select |
- We do not process card data. Card payments are made on the payment provider's secure page, with the provider acting as the seller; Kosto does not see or store your card number. For crypto payments, the wallet address and transaction hash are processed.
- Crypto transactions are recorded on a public blockchain. These records are not under Kosto's control and cannot be deleted or altered by us.
- The domain name data that Kosto queries (score, archive and spam footprint findings) is compiled from publicly available sources and third-party data providers. This data is, in principle, not personal data; however, if a domain name identifies a natural person, that data may be considered personal data and the rights in this text apply to it.
- We do not process special categories of personal data (health, biometric data, etc.) and do not ask you for them. Please do not include such data in your support requests or applications.
- We do not offer the service to persons under 18 and do not knowingly process their data.
3. Purposes of processing and legal grounds
| Purpose | Legal basis (Art. 5 KVKK; Art. 6 GDPR) |
|---|---|
| To open an account, provide the plan and data credits, match the payment, provide support | Necessary for the conclusion or performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR) |
| Tax, accounting and commercial record-keeping obligations; responding to requests from competent authorities | Compliance with a legal obligation (Art. 5(2)(ç) KVKK; Art. 6(1)(c) GDPR) |
| Establishment, exercise or protection of a right (disputes, refunds, objections, request records) | Necessary for the establishment, exercise or protection of a right (Art. 5(2)(e) KVKK; Art. 6(1)(f) GDPR) |
| Security of the service, prevention of abuse and multiple accounts, debugging, improving the service | Legitimate interests, provided that they do not harm your fundamental rights and freedoms (Art. 5(2)(f) KVKK; Art. 6(1)(f) GDPR) |
| Anonymous, aggregate visit counting (counters by day, page and source) | Legitimate interest, provided that it does not harm your fundamental rights and freedoms (Art. 5/2-f). No data identifying a person is kept in this counting. |
| Detailed measurement (linking visits through a random visitor ID stored in your browser) | Explicit consent (Art. 5(1) KVKK; Art. 6(1)(a) GDPR). It starts if you select “Accept” in the notice at the bottom of the page; it does not start if you select “Decline” or make no choice. You can withdraw it at any time. |
| Promotional emails (announcements of new features and campaigns) | Explicit consent (Art. 5(1) KVKK; Art. 6(1)(a) GDPR; Art. 6 of Law No. 6563 on the Regulation of Electronic Commerce (Elektronik Ticaretin Düzenlenmesi Hakkında Kanun)). It is requested with a separate, unchecked box on the sign-up form and you can turn it off at any time in your account settings; using the service does not depend on it. We are not currently sending promotional emails; if we do, we will send them only to those who have given this consent. |
| Record of acceptance of the Terms of Use and of this notice | Conclusion of a contract and protection of a right (Art. 5(2)(c) and 5(2)(e) KVKK). This is not explicit consent; it is necessary for the service. |
Your data is not used in any assessment that produces legal effects concerning you through automated decision-making. Systems such as limit-exceeded and abuse detection rely on technical rules; if a block is unjustified, you can object through the route in section 10 and your request will be reviewed by a human.
4. Transfer of data
Your personal data may be transferred to the following groups of recipients, limited to the purposes above and to the extent necessary:
| Recipient group | Data transferred and purpose | Country |
|---|---|---|
| Hosting provider | The application and database run on a rented server; all account and usage data is stored there. | Germany |
| Gateway, security and email forwarding provider | Traffic to our site passes through this provider (caching, attack protection, bot verification, inbound email forwarding). Request information (IP address, browser information) is processed. | European Union, USA and other countries where the provider has processing centers |
| Card payment intermediary | The entity that handles the sale, tax and payment for card payments; your email address, payment and billing information. It is a data controller in its own right and its own privacy policy applies. | United Kingdom |
| Crypto payment gateway | Invoice number, amount and payment status for crypto payments. | Country where the provider is located |
| Email delivery provider | Recipient address and email content, for delivering account, payment and notification emails. | Countries where the provider has processing centers |
| Messaging service | Used for operational notifications and encrypted database backups; the decryption key for the backups is held only by the data controller. If you enable Telegram notifications, the notification texts you select are also delivered this way. | Countries where the service provider has processing centers |
| Third-party data providers | The domains you look up; no information that identifies you (email, IP, account number) is sent. | Varies by provider |
| Professional service providers such as legal, accounting and financial advisory services | To the extent necessary to fulfil our obligations. | Türkiye |
| Competent public authorities and judicial authorities | Where required by law, upon request. | Türkiye |
Some of our service providers are located outside Türkiye. Transfers abroad rely on one of the methods set out in Article 9 KVKK (adequacy decision; signing of the standard contract announced by the Board (Kurul) and notifying the Authority (Kurum); other appropriate safeguards; exceptions only for incidental transfers). We will tell you on request which method is used for which recipient. For users in the European Union and the United Kingdom, the transfer of data to the data controller in Türkiye and to the recipients above relies on appropriate safeguards under Chapter V of the GDPR. We do not sell your data to third parties for marketing purposes.
5. Method of collection
Your data is collected by automated or partially automated means, electronically through the website and API when you create an account and use the service, through cookies and browser storage, through payment status notifications from the payment provider, and through your forms and support correspondence.
6. Retention periods
| Data | Period |
|---|---|
| Account data | For as long as the account is open; deleted or anonymized within 30 days at most after the account is closed. Records that never verify their email are deleted after 30 days. |
| Query history, watchlists, ranking projects, notifications | Until the account is closed; deleted together with the account data after closure. |
| Payment and invoice records, withdrawal consent record | For the statutory retention period under the relevant tax and commercial legislation (generally 10 years). |
| Security and access logs | At most 12 months: at the end of this period the IP address is deleted from the record; the transaction record without an address remains as an accounting and security trail. Abuse event and export records are also kept for 12 months. |
| Abuse prevention hashes (device, network, fingerprint) | Kept while the account is open to show that the one-time right has been used; destroyed within 24 months at most after the account is deleted. |
| Measurement (analytics) data | Visit and event records for 13 months at most; anonymous daily counters for 26 months at most. If you close your account, the link between the records and your account is severed. |
| Support correspondence | 3 years at most from the closing of the request. |
| Personal data requests and replies | 3 years after the request is concluded (to prove how we handled the request). |
| Record of emails sent (recipient and variables) | 90 days after sending. |
| Consent and acceptance records | For as long as the account is open; deleted together with the account. The measurement preference is kept only in your browser. |
At the end of the period, your data is deleted, destroyed or anonymized. Data subject to a legal retention obligation is kept with restricted access until the end of that period. Encrypted backups are kept on a rolling basis for a limited time, and it may take as long as that cycle for deleted data to disappear from backups as well.
7. Cookies and browser storage
Kosto uses the following cookies and browser storage. We do not use advertising or profiling cookies.
| Name | Type | Purpose | Period | Permission |
|---|---|---|---|---|
__Host-kosto_session | Cookie, first-party | Keeps your session signed in | Up to 60 days (expires after 14 days of non-use) | Required |
__Host-kosto_csrf | Cookie, first-party | Forgery protection | Up to 60 days | Required |
kosto_pv | Cookie, first-party | To count the daily free limit for the sign-up-free mini report and prevent abuse; contains only a random ID | Up to 2 days | Required |
kosto_did | Cookie, first-party | Written after you sign in to your account; prevents the one-time rights of the free plan from being claimed again with a second account opened in the same browser; contains only a random ID, and only its irreversible hash is kept on the server | Up to 2 years | Required (security) |
kosto_lang, kosto.lang | Cookie and local storage | Remembers the language you chose | 1 year | Required (preference) |
kosto.theme | Local storage | Your light/dark theme choice | Until you delete it | Required (preference) |
kosto.consent | Local storage | Stores your measurement preference, its time and the text version | Until you change it | Required (preference record) |
Interface preferences (kosto.pending_domain, kosto.signup_cycle, etc.) and session storage (kosto.src, kosto.verified, etc.) | Local and session storage | Holds the domain you typed in a form, the plan cycle you chose and small states needed for the interface to work; session storage is deleted when the tab is closed. kosto.src is added to the sign-up request only if you have allowed measurement. | Until the session ends or you delete it | Required |
kosto.vid, kosto.visit | Local storage | Random visitor ID and visit ID (detailed measurement) | Up to 13 months; deleted when you decline or withdraw | Explicit consent |
- Bot verification (on the sign-in, sign-up and free preview pages) loads the gateway provider's script from
challenges.cloudflare.com; the provider may use its own technical data and, if needed, its own cookie for this verification. This script is loaded only on the relevant pages. - When you choose card payment, the checkout page loads the payment provider's checkout overlay script (
cdn.paddle.com); the information you enter in this overlay is the responsibility of the payment provider. - No separate consent is requested for required items; if you block them in your browser settings, you may not be able to sign in.
- No third-party measurement, advertising or social network script is loaded on our pages.
8. Measurement and analytics
We carry out our own measurement to understand which pages of Kosto and which promotion channels work. Measurement is entirely first-party: the data is kept only on Kosto's own server and is not sent to or sold to any analytics or advertising company and is not used for ad targeting.
| Your choice | What is collected |
|---|---|
| Decline, making no choice, or your browser's “do not track” signal (Global Privacy Control / Do Not Track) | Only anonymous daily counters: totals such as “how many times this page was opened today, how many visits came from a search engine, how many from a phone”. No record is kept per visitor, no measurement ID is written to your browser, and no person can be traced from these counters. |
| Accept | With a random visitor ID stored in your browser: the first page you opened, the domain name of the site you came from, the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the ad click ID, the pages you viewed, the duration of the visit, device type, browser, operating system, language, screen size and (if our infrastructure reports it) the country. When signing up, which page and which button you came from, and the domain name you were querying at that time. If you have an account, the tools you opened in the panel, your viewing of a locked feature or an upgrade suggestion, credit spending and payment steps. |
- Your IP address is not stored in measurement records; its hash is not kept either. The address is used only in memory at the time of the request, to limit excessive sign-ups from a single address (preventing abuse), and is never written to disk.
- Query parameters in page addresses and form contents are not recorded; only the domain name of the site you came from is kept.
- Service records of actions you take with your account (e.g. payments, credit transactions, support requests, counts of steps such as account creation and first report) are processed as described in section 2, regardless of your measurement preference, because they are the service itself.
- Purpose: to measure the effect of promotional channels and pages, to find problems in the sign-up and payment steps, and to improve the most-used tools.
- Period: visit and event records are kept for up to 13 months and anonymous daily counters for up to 26 months; they are deleted automatically at the end of the period.
- Access: only Kosto's authorized administrators can see this data.
Objection and changing your preference. You can change your choice at any time; “Accept” and “Decline” are equally easy:
When you withdraw your consent, the measurement IDs in your browser are deleted immediately and from then on only anonymous counting is done. If you want the detailed records collected earlier to be deleted, or want to object to measurement altogether, apply through the route in section 10; when you close your account, the records are also disconnected from your account.
9. Your rights (Art. 11 KVKK; Arts. 15-22 GDPR)
By applying to the data controller, you may request the following:
- To learn whether your personal data is processed,
- To request information if your data has been processed (with the “Download my data” tool in your account, you can also obtain a machine-readable copy of your data),
- To learn the purpose of processing and whether it is used in accordance with that purpose,
- To know the third parties to whom it is transferred, domestically or abroad,
- To request correction if it has been processed incompletely or inaccurately,
- To request deletion or destruction under Article 7 KVKK (you can also close your account yourself from the “Data and account” section),
- To request that the correction and deletion/destruction operations be notified to the third parties to whom the data has been transferred,
- To object to a result against you arising from the analysis of the processed data exclusively by automated systems,
- To request compensation for damage if you suffer harm due to unlawful processing,
- To withdraw, at any time and without retroactive effect, consent-based processing (measurement, promotional email).
If you are in the European Union or the United Kingdom, you also have the right to request restriction of processing, data portability, and to object to processing based on legitimate interests; you may lodge a complaint with the competent data protection supervisory authority (e.g. the Information Commissioner's Office in the United Kingdom). This right to complain does not affect your right to complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under the KVKK.
10. Application method
You can submit your request through the following routes:
- If you have an account: from the Data and account section of your account (your session verifies your identity; this is the fastest route),
- If you do not have an account or cannot sign in: through the form below,
- By writing to support@getkosto.com from the email address registered to your account,
- For a written (wet-signature) application, by requesting our postal address at support@getkosto.com.
In your request, state clearly which right you wish to exercise and what you are asking for. For requests made through the form, to verify your identity we reply to the email address you entered before sending any data, and ask for additional information if needed; making sure you are not requesting someone else's data is in both our interests. Depending on its nature, we conclude requests free of charge within 30 days at most; if the action requires an additional cost, the fee in the tariff set by the Board may be charged. If your request is rejected, the response is found insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and in any case within 60 days of the date of your request.
11. Objection to domain name flagging
If you wish to object to the flagging of a domain name in Kosto (e.g. spam footprint risk), write to support@getkosto.com. Objections are reviewed within a reasonable time.
12. Security and data breach
We take reasonable technical and organizational measures to protect your data. Passwords are stored only as one-way hashes, and API keys only as hashes and are not shown except at the moment they are created. Access depends on authorization; administrator accounts require a second factor; connections use an encrypted channel; database backups are encrypted. If your data is obtained by unlawful means, we will notify the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) (and, for users under the GDPR where required, the competent supervisory authority) and the affected data subjects as soon as possible and within 72 hours at the latest of becoming aware of the breach.
13. Changes
We may update this notice. We will announce significant changes by email or within the service. The current version is indicated by the “Last updated” date at the top of the page; your consent and acceptance records are kept with this version date.