Privacy policy · Bekadan

1. Who we are

bekadan.com is run by Burak Emre Kadan, based in İzmir, Türkiye, who is the data controller for the personal data described here.

Legal name: Burak Emre Kadan
Brand: Burak Emre Kadan – bekadan.com
Address: İzmir, Türkiye
Email: hello@bekadan.com
Website: bekadan.com

2. What we collect and why

Your email address and where you signed up. When you use a form on this site, we store your email address in our own database, with a note of which form you used and when: the course waitlist, the newsletter, the blog, or a source code download. We also record when you confirm a subscription or unsubscribe. We use your address to send what you asked for: the launch announcement, the source code, or the newsletter. The forms ask for your email address and nothing else.
Whether you agreed to marketing emails. If you tick the box on the waitlist, source code or account sign-up forms, or sign up through a newsletter form, we add you to the newsletter list and record when and where you agreed. You then get an email to confirm (for an account, setting your password from the emailed link confirms it). The weekly newsletter goes only to confirmed members of that list. Without it, we only email you about the thing you signed up for. You get the source code whether or not you tick the box.
Your account. If you create an account, we store your email address, your full name, your password (only as a salted hash, never the password itself) and when you verified your email and last changed your password. We use this to let you sign in and, later, to give you access to courses.
Orders and invoices. When you buy a course we keep your name, email, invoice address and, when an invoice requires it, your Turkish ID or tax number, plus the order amount, date and payment status. We use this to perform the sale, issue invoices and meet tax and commercial law.
Payments. Payments are processed by iyzico, a licensed payment institution. Your card number, expiry date and security code (CVV) are never sent to, processed on or stored by bekadan.com; we only receive whether the payment succeeded.
Password check. When you choose a password, we check it against Have I Been Pwned's list of breached passwords. Only the first 5 characters of a hash of the password are sent; the password itself never leaves our server.
Analytics, only if you agree. With your consent, we use Google Analytics 4 to see how the site is used (pages visited, how you arrived, your device and approximate location). It sets cookies to tell visits apart. It is not loaded at all until you accept in the cookie banner, and we have not added any custom events or identifiers of our own.
YouTube videos. Some source code pages embed a YouTube video. We use YouTube's privacy-enhanced mode (youtube-nocookie.com), but when the player loads, your browser connects to YouTube, and YouTube may set cookies, particularly once you play the video.
Logs and abuse protection. Like any website, our host Vercel processes technical request data such as your IP address to deliver the site and keep it secure, and keeps its logs for a limited time. If a signup or sign-in fails, our server logs what failed and why, never your email address or password. To stop password guessing and email abuse, we record attempts against a hash of the email address and of your IP address, and delete those records after a day.

3. Cookies and similar storage

Needed for the site to work: when you sign in, a cookie (bk_session) keeps you signed in for 90 days, and a second one (bk_signed_in) only says that you are signed in. While you use an emailed account link, a short-lived cookie (bk_auth_link) holds it. These are not used for tracking and don't need consent.
Analytics: Google Analytics cookies (_ga, _ga_*), set only after you accept.
Payment page: at checkout, iyzico may use its own cookies to secure the transaction.
Your choice: we remember whether you accepted or rejected analytics in your browser's local storage. You can change it at any time with "Cookie settings" at the bottom of every page; withdrawing consent removes the analytics cookies.

4. Legal bases

Consent for the newsletter and other marketing emails, and for analytics cookies. You can withdraw it at any time.
Your request for waitlist emails, for the source code you asked for, and for providing the account you asked us to create.
Performing the contract when you buy a course, and our legal obligations for invoices and tax records.
Legitimate interests in keeping the site and accounts secure (the logs and rate limits described above).

5. Who else handles your data

iyzico (Türkiye): payments. Payment and card details are processed directly by iyzico.
Supabase: hosts the database that stores your email address, subscriptions and account, in the EU (Frankfurt).
Resend (United States): sends our emails.
Vercel (United States): hosts the website.
Google (United States): website analytics, only with your consent, and video embeds (YouTube).
Have I Been Pwned: breached-password check. It receives only part of a password hash, which can't identify you.

We are based in Türkiye, and some of these providers are in the United States, so your data may be processed outside your own country. Where data leaves the EU, the UK or Türkiye, we rely on the safeguards in these providers' data processing terms, such as standard contractual clauses, or on the EU-US Data Privacy Framework where a provider is certified under it.

6. How long we keep it

We keep your email address and signup details until you unsubscribe or ask us to delete them. Your account stays until you delete it (you can do that yourself from your account settings) or ask us to. Sessions end after 90 days or when you sign out, and rate-limiting records are deleted after a day. Order and invoice records are kept for the periods set by tax and commercial law (up to 10 years).

7. Your rights

Depending on where you live, you are protected by the EU GDPR, the UK GDPR or Türkiye's personal data protection law (KVKK). Under all three, you can ask us to:

show you the personal data we hold about you (access)
correct it if it is wrong
delete it
stop using it for marketing or analytics, by withdrawing your consent
stop using it where we rely on legitimate interests (objection)
give it to you in a portable format

Every newsletter and course update has an unsubscribe link, so you can stop them at any time without contacting us. For your rights under Türkiye's KVKK and how to apply, see the personal data notice.

If you are unhappy with how we handle your data, you can complain to a supervisory authority: the Personal Data Protection Authority (KVKK) in Türkiye, the data protection authority in your EU country, or the Information Commissioner's Office (ICO) in the UK.

8. Children

The site and accounts are for people aged 16 and over. We don't knowingly collect data from anyone younger; if you think we have, contact us and we will delete it.

9. Contact us

To exercise any of these rights or ask a question, email hello@bekadan.com.

10. Changes to this policy

If we change this policy, we will update this page and the date below.

Last updated: 13 October 2026