Cookie Policy

This Cookie Policy explains the cookies and similar technologies used on the fonify.co website and its subdomains, operated by Defsoft Bilişim Teknolojileri Anonim Şirketi ("Fonify", the "Company").

It is prepared under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Turkish Electronic Communications Law No. 5809, and explains what data cookies collect, why we process it, and how you can manage your preferences. Where the General Data Protection Regulation (GDPR) applies to you, this Policy also serves as our cookie disclosure under Article 13 GDPR.

For general information about how we process personal data, see our KVKK Privacy Notice and Privacy Policy.

A cookie is a small text file stored on your device through your browser when you visit a website. Cookies let a site recognise you on a return visit, remember your preferences, and function correctly.

Cookies are classified in several ways:

• By duration: session cookies are deleted when you close your browser; persistent cookies remain on your device for a set period.
• By owner: first-party cookies are set by fonify.co directly; third-party cookies are set by the service providers we use.
• By purpose: strictly necessary cookies are required for the site to work; others serve analytics and improvement purposes.

Alongside cookies, we also use your browser's local storage. Local storage is technically different from a cookie, but it is subject to the same principles under this Policy.

On your first visit you will see a notice bar at the bottom of the screen. It tells you that we use cookies and links to this Policy.

The bar offers two options:

• Accept: confirms you have read the notice and closes the bar. Cookie use continues as described here.
• Reject: records that you decline non-essential cookies. When you choose this, the Google Analytics and Microsoft Clarity measurement scripts will no longer load in that browser.

Your choice is stored in your device's local storage and remembered on later visits from the same browser. If you clear your browser data, the notice bar appears again.

Strictly necessary cookies are not affected by this choice; without them, core functions such as session security and language preference cannot work.

4.1 Strictly necessary cookies

Required for the site to operate securely and correctly. They cannot be switched off and are never used to measure visitor behaviour or serve advertising.

• csrf-token: carries the security token that prevents cross-site request forgery (CSRF) on form submissions. Lifetime: 1 hour.
• partnership-session: set only for users who sign in to the partner portal at partnership.fonify.co, carrying the signed session. Lifetime: 14 days, not readable by scripts (HttpOnly).
• NEXT_LOCALE: remembers the site language you selected.

4.2 Functionality and local storage

Records kept in your browser's local storage; they are not sent to the server automatically.

• fonify:visit: stores visit count and last visit time so the same visitor is not counted repeatedly.
• fonify:plan-draft: temporarily stores the answers you give in the plan wizard so they are not lost if you navigate away and return. Your contact details are not included in this draft.
• Theme preference: remembers your light or dark theme choice.

4.3 Analytics and performance cookies

Used to understand how the site is used, detect errors, and improve the experience.

• Google Analytics 4 (Google Ireland Limited): collects statistics such as page views, time on site, device type, and approximate geographic region. Direct identifiers such as name, email, or phone number are not sent to this measurement.
• Microsoft Clarity (Microsoft Corporation): produces heatmaps and records session replays. A session replay turns your mouse movements, clicks, and in-page navigation into an anonymised playback recording. These recordings are masked so that text you type into forms is not captured.

The names and lifetimes of these cookies are determined by the providers and may be changed by them. Google Analytics typically uses cookies named `_ga` and those starting with `_ga_`; Microsoft Clarity typically uses `_clck` and `_clsk`.

4.4 Attribution cookie

• fonify_attr: used to understand which channel brought you to our site. It holds up to 10 visit records; each record contains campaign parameters from the address bar (such as utm_source and utm_medium), the external site that referred you, the page you landed on, and a timestamp. Lifetime: 90 days.

When you submit a form, this record is sent along with your form data so we can see which channel the enquiry came from. The cookie itself contains no name, email, or phone number.

You can manage cookies in several ways.

Through the notice bar: the Reject option stops the analytics measurement scripts from running in that browser.

Through browser settings: every browser offers options to delete and block cookies and to allow them per site. These settings sit under the Privacy and Security section of your browser's settings. If you block strictly necessary cookies, functions such as form submission and partner portal sign-in will not work.

Through the provider: you can disable Google Analytics measurement across all websites using the browser add-on published by Google.

The list below summarises the cookies set on this site.

csrf-token

• Type: Strictly necessary, first party
• Purpose: Form security (CSRF protection)
• Lifetime: 1 hour

partnership-session

• Type: Strictly necessary, first party
• Purpose: Partner portal session
• Lifetime: 14 days

NEXT_LOCALE

• Type: Strictly necessary, first party
• Purpose: Language preference
• Lifetime: Browser session

fonify_attr

• Type: Attribution, first party
• Purpose: Recording which channel a visit came from
• Lifetime: 90 days

Google Analytics cookies

• Type: Analytics, third party (Google)
• Purpose: Site usage statistics
• Lifetime: Set by Google, typically up to 2 years

Microsoft Clarity cookies

• Type: Analytics, third party (Microsoft)
• Purpose: Heatmaps and session replay
• Lifetime: Set by Microsoft, typically up to 1 year

Google Analytics and Microsoft Clarity are services whose servers are located outside Türkiye. Data collected through their cookies is processed and stored on those providers' systems abroad. Under the KVKK this constitutes a transfer of personal data abroad.

You can prevent this transfer by rejecting non-essential cookies. Strictly necessary cookies and local storage records are not transferred to third parties.

Data obtained through cookies is kept only for as long as necessary for the purpose it was collected for, and is then deleted or anonymised. To protect it against unauthorised access we apply technical and organisational measures including access authorisation, encrypted transport (HTTPS), and security headers.

Cookie data is not used for purposes other than those stated in this Policy, is not sold, and is not shared with third parties for advertising.

Under Article 11 of the KVKK you have the right to request information about your personal data, learn the purpose of processing, request correction or deletion, and object to processing. Where the GDPR applies, you also hold the corresponding rights of access, rectification, erasure, restriction, portability, and objection.

To exercise these rights, contact us at [email protected]. Your request will be concluded free of charge within 30 days at the latest, depending on its nature.

This Cookie Policy is updated when the technologies used on the site or the applicable legislation change. The current version is always published on this page; the last updated date at the top of the page shows when it took effect.

Data controller: Defsoft Bilişim Teknolojileri Anonim Şirketi

Address: Üniversiteler Mah. İhsan Doğramacı Bul. No: 31 İç Kapı No: 24 Çankaya/Ankara, Türkiye

MERSIS: 0272118846700001

Email: [email protected]