Last updated: 21 October 2026
The short answer
Cookies are set only if you consent. On your first visit you see a cookie choice prompt. If you choose "Accept", Google Analytics cookies are set to measure how the site is used. Until you choose, or if you choose "Decline", no cookie is written; the site works just the same. No advertising, remarketing or profiling code is used. The one exception is the product video, which loads only when you press play yourself (see below).
What happens before you consent? Google Analytics runs in Google's "advanced consent mode": the code loads on every page, but with every permission off. Google then receives only cookieless signals with no persistent identifier (such as that a page was opened, and the consent state); they cannot recognise you from one visit to the next and are used only for aggregate statistical modelling. Like any web request, these signals do reach Google with your IP address and browser information.
You can change your choice at any time from the Cookie Preferences link at the bottom of every page. Withdrawing consent deletes the Google Analytics cookies from your browser.
Analytics cookies (consent only)
The provider is Google Ireland Limited (Google Analytics 4). What is collected is statistical: pages visited, time on site, referring site, device and browser type, and approximate location (country / city). Google Analytics 4 does not store your IP address.
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Distinguishes visitors | 2 years |
_ga_<id> | Keeps session state | 2 years |
- Legal basis: your explicit consent for the cookies and the measurement they enable (KVKK Art. 5(1), GDPR Art. 6(1)(a)); for the cookieless signals before consent, our legitimate interest in running and improving the site (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)).
- International transfer: the data may be processed on Google's servers outside Türkiye, including in the United States (KVKK Art. 9).
Performance measurement (cookieless)
The site is served through Cloudflare. Cloudflare Web Analytics runs a small script on every page to measure how fast pages load and how often they are viewed. It sets no cookie, stores nothing in your browser and does not recognise you from one visit to the next; it builds no visitor profile. What it sends is the page address, the referring site, load timings and the browser / device type. As with any web request, Cloudflare also receives your IP address.
- Provider: Cloudflare, Inc.
- Legal basis: our legitimate interest in running and improving the site (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)).
- Transfers: data may be processed on Cloudflare's servers outside the country, including in the United States (KVKK Art. 9).
Product video (only when you play it)
The product video on the home page is hosted on YouTube. Nothing is requested from YouTube when the
page opens: the cover image you see comes from our own server. When you press play, the video loads
in YouTube's privacy-enhanced player (youtube-nocookie.com). From that point YouTube receives
your IP address and browser information to play the video and may store data such as playback
preferences in your browser. The provider is Google Ireland Limited; the data may be processed
outside Türkiye, including in the United States (KVKK Art. 9). See Google's privacy policy for
details. If you do not play the video, none of this happens.
Other data stored in your browser
These are not cookies: they are never attached to HTTP requests and never leave your browser.
current_language(localStorage) — remembers your chosen interface language (Turkish / English) for your next visit. Kept until you clear it.cookie_consent(localStorage) — remembers your cookie choice so the prompt does not reappear on every visit. Kept until you clear it.
Clearing your browser's site data removes both at any time — the site then opens in its default language and asks for your cookie choice again.
Server logs
As with any web server, technical records (IP address, request time, browser information) are kept for each request. These exist for security and debugging, and are not used for profiling. See the Privacy Policy.
The Osvoy Verify SDK
When embedded in a customer's own site, our web SDK uses temporary session data to keep a verification session alive. It serves no marketing purpose and expires when verification completes. The organisation embedding the SDK is responsible for its own cookie disclosure.
Changes
Whenever we add a new cookie or third-party code we will update this policy and ask for your consent again.