Privacy Policy
GetSmartPromo is a low-tracking editorial site. We collect only what is necessary to operate the service and comply with the law. This page explains what we collect, why, and your rights under GDPR and Turkish KVKK.
1. Controller
Data controller: GetSmartPromo (operating from Türkiye). Contact: hello@getsmartpromo.com.
2. What we collect
Analytics: We use Plausible Analytics (cookieless, GDPR-safe). Plausible records aggregate page views, referrer domains, browser and country — never IP addresses in identifiable form, never personal profiles.
Affiliate click log: When you click an outbound affiliate link, we log the matrix cell ID, referring page, timestamp, and a one-way SHA-256 hash of your IP (salted with a server secret). We do not store the raw IP. This lets us measure conversion without identifying you.
Contact form: If you email us, we retain the message and your email address for as long as needed to respond, up to 24 months.
Cookies: None from us. Third-party ads (if enabled — see banner) may set their own cookies subject to consent.
3. Legal basis (GDPR Article 6)
Legitimate interest (Art. 6(1)(f)) for analytics and click logging: we need aggregate usage data to improve the site.
Consent (Art. 6(1)(a)) for third-party ad cookies if applicable.
Contract / pre-contract (Art. 6(1)(b)) for email correspondence you initiate.
4. Sharing
We do not sell personal data. Aggregate analytics may be shared publicly (e.g., "we hit 10k visitors this month"). Affiliate platforms receive the affiliate ID tag from the redirect URL — not your personal data.
5. Retention
Analytics: 24 months. Click logs: 12 months for conversion attribution. Contact emails: 24 months from the last message.
6. Your rights
Under GDPR (if you are in the EEA/UK) and Turkish KVKK (if you are in Türkiye), you have the right to access, rectify, erase, restrict, and object to processing, and to data portability. To exercise any of these, email hello@getsmartpromo.com. We respond within 30 days.
You may also lodge a complaint with your supervisory authority (KVKK in Türkiye, your local DPA in the EEA).
7. Data transfers
Servers are located in the EU (Hetzner Frankfurt). No transfers outside the EEA are made for personal data. If you are in the US or elsewhere, standard contractual clauses apply.