Privacy Policy

1. Controller

Metoraz AI & Consultancy
İzmir, Türkiye
Privacy requests: info@metoraz.com

No EU representative and no data protection officer have been appointed. A full street address is not shown on this page.

2. Data we process and where it comes from

Most data comes from you (forms and cookie choices) or your device (logs and security checks).

• Contact form: name, email, company, service, message, consent, IP, Turnstile token
• Booking form: name, email, company, topic, duration, meeting type, phone if needed, notes, slot
• Training registration: name, email, company, note, session, language, consent
• BS Field Metoraz AI: text you send for chat and analysis (Groq, Google Gemini; we do not use OpenAI or Cerebras)
• Admin login: email and session cookies on /admin only
• Technical: IP for rate limits, language cookie, local storage, consented analytics

3. Purposes and legal bases (GDPR Art. 6)

• Art. 6(1)(b): handling the enquiry, meeting or training you requested.
• Art. 6(1)(a): extra consent on the contact and training forms; Google Analytics 4, Vercel Web Analytics and embeds (LinkedIn, YouTube, Vimeo, Loom).
• Art. 6(1)(f): security, bot protection, rate limits, remembering language and cookie choice, content administration. Analytics is not placed on this basis.
• Art. 6(1)(c): retention where a legal duty applies.

4. Recipients and processors

• Vercel Inc. (hosting fra1, Frankfurt EU; Web Analytics only with consent)
• Supabase (AWS eu-central-1, Frankfurt EU): database, storage, authentication
• Resend: email
• Groq and Google (Gemini): Metoraz AI in BS Field products
• Google: Calendar, Meet; Analytics after consent; YouTube if a video embed is shown
• Cloudflare: Turnstile
• LinkedIn, Vimeo, Loom: only after the relevant embed is allowed

The @vercel/speed-insights package is not installed. We do not use Vercel Speed Insights. Fonts are self-hosted at build time via Next.js next/font. The browser does not fetch fonts live from fonts.googleapis.com.

5. International transfers

Primary hosting and the database are kept in Frankfurt in the European Union (Vercel fra1; Supabase on AWS eu-central-1). Email (Resend), calendar / measurement / video (Google), security (Cloudflare), BS Field Metoraz AI (Groq, Google Gemini) and (if you consent) embeds may involve processing in the United States or other third countries. Under GDPR Chapter V, those transfers rely on the standard contractual clauses or equivalent safeguards published by the providers and, for analytics and embeds, on your consent. This policy does not claim that Metoraz has signed those contracts or relies on an adequacy decision; the owner should confirm that with counsel.

6. Retention

No automatic deletion schedule is coded. Request records are kept for a reasonable time to fulfil the request and handle related claims. Consent is asked again after 12 months. Analytics cookie lifetimes are in the Cookie Policy.

7. Your rights (GDPR Arts. 15-22)

Where the GDPR applies you may request access, rectification, erasure, restriction, portability and objection. The site does not use profiling or automated decision-making that produces legal or similarly significant effects. You may withdraw consent at any time; withdrawal does not affect processing that was lawful before. Use “Cookie preferences” in the footer to change cookie consent.

8. Right to complain

Please write first to info@metoraz.com. You may also complain to a supervisory authority in the EEA country where you live, work or where the alleged infringement occurred. In Türkiye the competent body is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu). No EU representative has been appointed.

9. Cookies and non-essential tools

Google Analytics 4, Vercel Web Analytics and third-party embeds are not strictly necessary. They do not load before you opt in. Refusing them does not block the rest of the site. See the Cookie Policy.

10. Contact and updates

Privacy requests: Metoraz AI & Consultancy, İzmir, Türkiye, info@metoraz.com. We update this policy when processing changes. This version is dated 15 October 2026.