This notice explains what the contact form collects, why, and how long it is kept.
What is collected: name or contact name, email, optional phone, optional website or domain, request details, selected service, preferred contact method, IP address, user agent, timestamp, language and the consent record.
Why: to review your request, understand its scope and any provider need, and reply through the details you gave. IP address and user agent are kept for security, abuse prevention and record-keeping.
How long: the request is delivered to Grau by email and kept there as the working record. On the server, only a short-lived copy is kept, and it is deleted automatically after about a week.
Sharing: data is not sold. Where an agreed scope needs infrastructure, only what is necessary is shared with the relevant external provider, which acts under its own terms. A copy of the request is emailed to Grau’s own mailbox for handling.
Payment: the site does not collect card numbers, banking passwords, identity scans or sensitive payment credentials.
Your rights: you can ask what is held about your request, ask for corrections, or ask for it to be removed, using the address below.
Contact: contact@grau.agency
These terms describe how requests, scope and delivery work.
This site uses essential storage only: a session for form security (including the CSRF token), a rate-limit record to prevent form abuse, and a language preference (a small cookie) together with the cookie-banner choice kept in your browser.
No analytics or advertising cookies are used. If analytics is ever added, this notice and the consent handling will be updated first.
The contact form is the main function of this site. What you enter is stored so the request can be reviewed and answered.
The request is delivered to Grau by email — that mailbox is the record. It covers the form fields plus IP address, user agent, timestamp, language and the consent record. On the server only a short-lived copy is kept and it is deleted automatically after about a week. The site does not email the visitor unless a separate confirmation is set up.
The site does not send automated marketing and does not collect payment data.
Payment details are shared only after the requested scope is reviewed. Depending on the confirmed scope, payment may be made through IBAN/bank transfer, CepBank, easy address transfer or payment link. The website does not collect card numbers, banking passwords or sensitive payment credentials.
Rules, delays, fees or interruptions from a bank or payment provider are outside Grau’s control.
Domain, hosting, SSL and server resources may be arranged through external providers where needed. This is not simple reselling; it covers selection, configuration, alignment with the agreed scope and handover.
A VPS or VDS is provided through a partner chain and is self-run after purchase unless a separate managed scope is agreed. Provider rules, pricing, account limits, delays and outages are set by the provider and are outside Grau’s control.
Once handover is complete, the agreed scope is considered met. Changes made afterwards — by you or a third party, to the code, DNS, hosting panel or content, or through unauthorised edits — fall outside the original scope.
Problems that result from such changes are not covered by the original scope. Further work, maintenance or support needs a separate written scope.
For the data held from a contact form submission, you can ask what is held about your request, ask for inaccurate data to be corrected, or ask for it to be removed.
Send requests to the address below. Because submissions are stored to be read by a person, a request is handled after it is reviewed.
Contact: contact@grau.agency
This notice covers Website Insight, member accounts and the direct messaging feature.
These features are provided for good-faith, lawful use — reviewing your own or your client's website, and communicating about work with other members. Any other use, including unlawful, abusive, deceptive or harmful use, is outside what is offered here and is the sole responsibility of the user who engages in it.
A file or link received from another user comes from that user, not from Grau. Opening, downloading or acting on it is at the receiving user's own risk and discretion; Grau recommends normal caution, such as not opening files from people you do not know or trust.
Where a competent authority makes a lawful request for data in accordance with applicable law — including the Turkish Penal Code (TCK), the Personal Data Protection Law (KVKK) and, where relevant, the GDPR — Grau cooperates within the boundaries and procedures that law sets out. Outside such a lawful request, member communications and account data are not disclosed to third parties.
In line with KVKK and, where applicable, GDPR obligations, Grau keeps a security log of key account and messaging events (for example: sign-in, message sent, file uploaded) with the acting account and a hashed, non-reversible form of the IP address — never the plain IP address, and never message content. This log exists to detect abuse, secure accounts and respond to lawful requests, and is kept only as long as that purpose requires.
Website Insight results are an automated overview, not a guarantee of security, performance or compliance. Direct messaging is provided on an as-available basis. Grau makes no warranty that these features will be uninterrupted or error-free.
This notice may be updated as the features change; the version in effect at the time of use applies.