1. Who we are

The data controller is Mine Ocak ("MiNeLYuS", "we"), address: Yeni İzmir Caddesi No:14C Yazıcıoğlu Apt. Zemin Kat Altıeylül/Balıkesir, email: minelyus10@gmail.com.

2. Data we collect

• Story / custom song form: your name or the name of the authorised person, email, phone (optional), project type, your story, the purpose of the song, language and style preferences, references, type of use, timing, budget range, interest in a DJ performance, and files you upload (up to 5 images or PDFs).
• Management / contact form: your name or company name, email and message.
• During a project: correspondence, brief notes, quotes and invoicing details (including the identity or tax details required for an invoice).
• Automatically when you browse: IP address, browser and device information, pages visited and time of visit. We use this to run and secure the site and for cookieless visit statistics.
• Personal details inside stories: Your story may include other people's names and memories, or sensitive details such as health, beliefs or family life. Please share only what the song needs, and make sure the people you mention are aware of it.

3. Why we use your data and our legal basis

• Reviewing your request, contacting you, preparing a quote — Steps prior to a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b))
• Composing the song, designing and delivering the DJ or event performance — Performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b))
• Processing sensitive details in your story (e.g. health, beliefs) — Your explicit consent (KVKK Art. 6/2; GDPR Art. 9(2)(a))
• Invoicing, accounting and tax records — Legal obligation (KVKK Art. 5/2-a and ç; GDPR Art. 6(1)(c))
• Running and securing the site, preventing abuse — Legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f))
• Showing the work in our portfolio, on social media or on YouTube — Only with your explicit, written permission
• Establishing or defending legal claims — KVKK Art. 5/2-e; GDPR Art. 6(1)(f)

We collect data directly from you through our forms and email. Automatic data is collected through the site's infrastructure.

4. Confidentiality of your story

• Your story and files are treated as private creative material, used only to create your song.
• We never publish your story, your files or the resulting work, show it in our portfolio, or share it with third parties without your written permission.
• Only MiNeLYuS and collaborators working directly on your project (for example a recording or mixing engineer), bound by confidentiality, can access it.
• We do not sell your story or use it for advertising, marketing lists or training AI models.
• If the project does not go ahead, your story and files are deleted within 6 months at the latest. You can ask us to delete them sooner.

5. Who we share data with

We do not sell personal data. We share it only as needed with:

• Service providers: hosting [HOSTING PROVIDER], email / notifications [EMAIL SERVICE], content delivery and statistics (Cloudflare), fonts and interface files (Google Fonts, Tailwind CDN, unpkg).
• Project collaborators: musicians, engineers or event crew working on your project, under confidentiality.
• Authorities and advisers: public authorities where the law requires, and our accountant and legal advisers.

6. International transfers

Cloudflare, Google and some interface providers run servers outside Türkiye, so your IP address and browser details may be transferred abroad. We make these transfers under appropriate safeguards, such as standard contractual clauses, in line with KVKK Art. 9 and GDPR Chapter V.

7. Cookies and browser storage

We do not use advertising or tracking cookies. We store only minelyus_lang in your browser's local storage to remember your language. Cloudflare Web Analytics, which we use for visit statistics, does not use cookies. Cloudflare may set strictly necessary security cookies.

8. How long we keep data

• Project requests that did not go ahead, and their files — up to 6 months
• Contact form messages — up to 2 years
• Completed project correspondence and briefs — 2 years after delivery
• Invoices and accounting records — as required by law (usually 10 years)
• Server and security logs — up to 1 year

After that, data is deleted, destroyed or anonymised.

9. Our YouTube channel and YouTube API Services

MiNeLYuS uses a tool called "officialminelyus" to upload videos to its own YouTube channel (youtube.com/@officialminelyus). This tool uses YouTube API Services.

• The tool works only with MiNeLYuS's own Google account, under permission granted on Google's consent screen. It does not access the Google or YouTube accounts of site visitors or clients.
• Data accessed: the channel data needed to upload videos and manage their title, description and status. Access tokens (OAuth) are stored only in MiNeLYuS's secure environment.
• Data received from the YouTube API is not used for advertising or profiling and is not shared with third parties. Stored API data is refreshed or deleted at least every 30 days. If authorisation is revoked, related data is deleted within 7 days.
• "officialminelyus" use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• By using YouTube you agree to the YouTube Terms of Service. For how Google handles data, see the Google Privacy Policy.
• You can revoke this tool's access at any time from the Google security settings page.
• A work that belongs to you (such as your custom song) is published on YouTube only with your written permission. If you withdraw permission, the video is removed or made private.
• Our site links to YouTube, Spotify, Instagram and Apple Music. Their own privacy policies apply once you visit them.

10. Security

Site traffic is encrypted with HTTPS. Only authorised people can access form data and the admin panel. Uploads are limited to images and PDFs of up to 5 MB each.

11. Children

Our services are not aimed at people under 18. Requests for anyone under 18 should be sent by a parent or guardian.

12. Your rights

You can ask us to: confirm whether we process your data and give you a copy; tell you the purpose of processing and who we share or transfer your data to; correct inaccurate or incomplete data; delete your data, or restrict how we use it; give you your data in a portable format (GDPR); stop processing based on our legitimate interests (objection); withdraw your consent at any time, without affecting earlier processing; compensate you for damage caused by unlawful processing (KVKK Art. 11).

13. Contact and complaints

Send requests to minelyus10@gmail.com or by post to Yeni İzmir Caddesi No:14C Yazıcıoğlu Apt. Zemin Kat Altıeylül/Balıkesir. We reply free of charge within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, if you are in the EU/EEA or UK, to your local data protection authority.

14. Changes

We update this policy when needed. The current version is always on this page, and the date at the top shows when it last changed.