Privacy Policy

1. Scope and controller

This policy covers the unholylabs.com website. The data controller is Unholy Labs (Istanbul, Türkiye). Our products (for example GUZZL) publish their own privacy policies on their app store listings.

2. Data we collect

• Contact form: name, email address, subject and message. We receive these only when you submit the form.
• Launch notification: the email address you enter in the form on the pages of our products in development (BrewX, RelationCRM). We receive it only when you submit the form.
• Technical logs: server logs such as IP address, browser information and timestamps kept by our hosting provider for security and debugging.
• Browser storage: a single flag in sessionStorage so the opening animation plays once per session. It is not a cookie. It is deleted when the tab closes and is not linked to your identity.

3. Purposes and legal basis

We process form data solely to answer your request, prepare a proposal and continue the correspondence (KVKK art. 5/2-c and 5/2-f; GDPR art. 6(1)(b) and 6(1)(f)). Server logs are processed under our legitimate interest in keeping the service secure and available.

We use the address you give for a launch notification only to send news about that product, above all that it has launched (KVKK art. 5/1, explicit consent; GDPR art. 6(1)(a)). You can ask us to delete it at any time by writing to hello@unholylabs.com.

4. Cookies and analytics

This site sets no marketing or analytics cookies and loads no third-party tracking scripts, which is why no cookie banner is shown. If we add analytics later, we will update this policy and put the required consent mechanism in place.

5. Third parties and international transfers

We do not sell your data and do not share it with third parties for advertising.

• Vercel Inc. (hosting and CDN): server logs. Data may be processed in data centres in the European Union and the United States.
• Resend (email delivery): the contents of the contact form are delivered to us by email; a confirmation is sent to the address you give for a launch notification, and the address is passed on to us.
• External sites we link to (Google Play, LinkedIn, Instagram) are governed by their own privacy policies.

6. Retention

Contact form correspondence is kept for at most 24 months after the request is closed. Correspondence that turns into a business relationship is kept for the periods required by contract and law. Server logs are deleted within the provider’s standard retention period.

7. Your rights

Under KVKK art. 11 and GDPR art. 15–21 you have the right to access, rectify and erase your data, to object to processing and to data portability. Write to hello@unholylabs.com. We respond within 30 days at the latest. You may lodge a complaint with the Turkish Personal Data Protection Authority or, in the EU, with your supervisory authority.

8. Security

All traffic is encrypted with TLS and access to data follows the principle of least privilege. Details of our practices: unholylabs.com/en/security

9. Children

The site is not directed at children under 16 and we do not knowingly collect personal data from them.

10. Changes and contact

We update this notice when needed. The current version is always published on this page. Questions: hello@unholylabs.com