Privacy Policy

The data controller is Han Yazılım Bilişim Hizmetleri, of Çınar Mh, Yeşiltepe Sk, No 3, Maltepe, İstanbul, Türkiye. What's Live (whatslive.today) is a service of that company.

For anything about your data — including any request to exercise the rights described below, wherever you live — write to hello@whatslive.today. That address reaches us directly rather than an agent or a web form, and it is the right route from the United States, from Europe and from anywhere else.

Most creators using What's Live are in the United States or Europe, and this policy is written to serve all three of the regimes that follow from that:

• United States — the California Consumer Privacy Act as amended by the CPRA, and comparable state laws such as those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana. Where an applicable US state privacy law gives you additional rights, we provide those rights as described below; we also extend the same core rights more broadly as a matter of practice. See Your rights in the United States.
• Europe and the UK — the GDPR and UK GDPR, for anyone in the European Economic Area, Switzerland or the United Kingdom. See Your rights in Europe, the UK and Türkiye.
• Türkiye — the Personal Data Protection Law No. 6698 (KVKK), which applies to us because that is where the company is established.

Where practical we apply consistent privacy protections regardless of where you live, rather than sorting people by passport. Where an applicable law gives you additional rights, those rights also apply.

Browsing the directory needs no account and we do not ask you for anything. There is no advertising network, no ad pixel and no advertising cookie.

We do measure how the product is used, on the public directory as well as in the dashboard, against a pseudonymous identifier stored in your browser rather than a cookie. That is described in full under Product analytics, and it applies whether or not you have an account. In the EEA, the UK and Switzerland nothing is measured unless you agree to it first.

What is recorded when a listing is shown or clicked

Creators are told how their placement performed, so two counters exist:

Lawful basis: our legitimate interest in telling creators how their listings performed, and in preventing artificial inflation of those counts (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Product analytics. So that the product is shaped by what people actually do, we measure how the site is used — which pages and controls, which filters, which listings get clicked — against a pseudonymous identifier held in your browser's local storage. We also record the domain that referred you, and any campaign tag on the link you followed, so we know where our audience comes from; never the full address of the page you came from. Our processor is Mixpanel. It is not used for advertising, it does not follow you to other sites, and no personal data is sold or shared.

In the EEA, the UK and Switzerland we ask first. Nothing is measured until you agree, and declining is one click in the same banner with no penalty — the site works identically either way. Elsewhere it runs on our legitimate interest in improving the service, and you can opt out at any time by writing to us.

Our analytics processor resolves an approximate location — country, region and city — from your IP address, so we can see which parts of the world the audience is in. It is never more precise than a city, we never ask your browser for its GPS position, and we do not record the pages you visit as full URLs. There is no session recording, on any page.

We do not require your legal name, postal address, date of birth or phone number. You choose a username, and you may upload an avatar; neither has to be your legal name or your photograph. There is nothing to pay for, so we never ask for a billing address or payment details of any kind.

Before a listing, username or avatar is published, it is sent to OpenAI's moderation service to be classified. The text or the image is transmitted to that service for the check, and what we keep is the outcome — a verdict recorded against the listing — rather than a second copy of the content. OpenAI's handling of what it receives is governed by the service arrangement we have with them and by their own terms for that endpoint.

The outcome can be that something is published, refused, or held for review by a person. This is automated processing that affects whether your content appears, so:

• a refusal is not final — write to hello@whatslive.today and a person will look at it;
• it does not produce a decision with legal effect about you, and it is not profiling.

We also use Cloudflare Turnstile on sign-up, sign-in and submission to tell people from bots. Turnstile receives technical signals from your browser for that purpose.

Lawful basis: our legitimate interest in keeping unlawful and harmful material off a public directory, and in preventing automated abuse.

We use a small number of outside providers, each for one job. Every one of them is named — with its purpose, location and the data it sees — on the service providers and sub-processors page, which we keep current.

They do not all stand in the same relationship to your data:

• Processors acting on our instructions. Most of them: our hosting, database, storage, email, analytics, moderation and error-monitoring providers process personal data on our behalf and for our purposes, under written terms.
• Independent controllers. One: Paddle.com, which processes payments for the optional Creator+ subscription. Paddle is the merchant of record, so it is the seller for that transaction and decides its own purposes for the data it handles — it is not acting on our instructions. Everyone else listed here processes personal data on our instructions and for our purposes.

Some of those providers are outside Türkiye and outside the EEA, including in the United States.

Under the GDPR and UK GDPR, a transfer outside the EEA or the UK is made on whichever lawful basis applies to that provider: an adequacy decision covering the country or the certification the provider holds, or, where none applies, Standard Contractual Clauses — the UK International Data Transfer Agreement or Addendum where the UK regime governs — or another safeguard recognised by law. Which one applies depends on the provider and can change, so rather than list them here and let the list go stale: write to us and we will tell you what a particular transfer rests on.

Under the KVKK, transfers abroad are made on the bases in Article 9 as amended — a decision of the Personal Data Protection Board that the destination provides adequate protection where one exists, or one of the appropriate safeguards that Article 9 permits, including standard contracts of the kind the Board has published. Explicit consent is not our default route, and we do not rely on it where a safeguard is available.

Our database is hosted in the United States. So if you are in Europe your account and listing data is stored outside the EEA, and the safeguards above are what that rests on. We say so plainly because it is the kind of fact a policy is tempted to leave vague.

Beyond those providers we share personal data only:

• when the law requires it, or a valid legal request compels it;
• to establish, exercise or defend legal claims, including investigating abuse of the marketplace;
• if the business is reorganised or sold, in which case this policy continues to apply to the data transferred.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

There are three, and none of them is for advertising or analytics:

Not cookies, but worth naming

Analytics uses your browser's local storage rather than a cookie: it holds a random identifier so a funnel can span two visits, and your consent choice so you are not asked twice. Local storage is not sent to our servers on every request the way a cookie is, which is why it is here rather than in the table above — and clearing site data removes both.

All three are strictly necessary for functions you have asked for, so they do not require consent. Cloudflare may set its own cookie as part of the bot check on the pages that use it.

California and several other states require this to be set out in their own vocabulary. In the twelve months to the effective date above, the categories of personal information we collect are:

We do not use or disclose sensitive personal information for purposes that would give you a right to limit under the CPRA.

Depending on your state, you can ask us to:

• Know what personal information we hold about you, the categories, where it came from, why we have it and who we disclose it to;
• Get a copy of it, in a portable form;
• Correct anything inaccurate;
• Delete it — subject to records we have to keep for another reason, such as tax and accounting, a live dispute, or preventing fraud and repeated abuse;
• Opt out of sale, of sharing for targeted advertising, and of profiling with significant effects — none of which we do, so there is nothing to opt out of;
• Limit the use of sensitive personal information — we do not use it for any purpose that this right applies to.

We will not discriminate against you for exercising any of these. No price changes, no reduced service, no worse placement on the board.

How to make a request

Email hello@whatslive.today. Much of it is faster to do yourself: your profile and defaults are editable in Settings, and closing your account is a button.

We verify a request by matching it to the email on the account, and we respond within 45 days — extendable once by a further 45 where the law allows, which we would tell you about. An authorised agent may act for you with your written permission and proof of their identity.

Appeals

If we refuse a request and you are in a state that gives you a right of appeal — Virginia, Colorado, Connecticut, Texas, Oregon, Montana and others — reply to our decision with the subject “Appeal”. We review it afresh — against the original request rather than against our first answer — and reply within 60 days with our reasons. If the appeal is refused you may contact your state Attorney General.

Opt-out signals

Browser signals such as the Global Privacy Control exist to exercise opt-out rights: out of the sale of personal information, out of sharing it for targeted or cross-context behavioural advertising, and in some states out of profiling with significant effects.

We do none of those things, so there is currently no activity of that kind for such a signal to switch off, and we do not treat one as consent to anything. If that ever changes — it is not planned — we will honour these signals for the activity they cover and say so here before we start.

Product analytics is a separate matter and is not governed by these signals. It is controlled by the consent banner in the EEA, the UK and Switzerland, and everywhere else by writing to us — see Product analytics.

California “Shine the Light”

Under California Civil Code § 1798.83, California residents may ask about disclosures of personal information to third parties for their direct marketing purposes. We make none.

Under KVKK Art. 11 and, where it applies, the GDPR, you can:

• ask whether we hold data about you, and get a copy of it;
• have inaccurate data corrected;
• have data erased where we have no continuing basis to keep it;
• ask us to restrict how we use it, or object to that use;
• receive it in a portable form, or have it sent to another provider;
• withdraw consent where consent was the basis, without affecting what we did before;
• ask that the consequences of an automated decision be reviewed by a person.

Much of this is available without asking: your profile and defaults are editable in Settings, and account closure is a button.

For anything else, write to hello@whatslive.today. We reply within thirty days. If you are not satisfied, you can complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EEA or UK, to your local supervisory authority.

Data is encrypted in transit and at rest by our hosting and database providers. Access is enforced at the data layer rather than only in the application, so a creator's own credentials reach their own records — their profile, their listings, their analytics — and not anybody else's, whatever the application asks for.

Passwords are handled by our authentication provider: they are stored only as a hash, never in plaintext, and are never visible to us. Account recovery and password changes are designed so that an emailed link proves control of the mailbox rather than granting access to the account itself. The commitments we make about how sign-in works are in the Terms of Use, which is where they belong.

We never receive your card number. It is entered into Paddle's own payment form and goes to Paddle, not to us. What reaches us is the record of a subscription — an email address, the name on the card and its last four digits — held where no signed-in account can read it through the public interface, including your own, and erased when you delete your account.

Error monitoring

When something breaks we receive a diagnostic report through Sentry — the error, its stack trace, and the page it happened on. It is configured not to send IP addresses, no account identifier is attached to a report, and the request headers that carry your session are stripped before anything leaves. There is no session recording: we do not replay what you did on the site, on any page.

No system is perfectly secure. If we discover a breach that puts your rights at risk, we will notify you and the relevant authority as the law requires.

What's Live is not for children. Creator accounts require you to be at least 18. We do not knowingly collect data from children; if you believe a child has given us data, write to hello@whatslive.today and we will delete it.

When this policy changes we post the new version here with a new effective date. If a change materially affects how we use data about you, we will tell creators by email before it takes effect where we reasonably can, and seek consent where the law requires it.