Privacy Policy

1. Who we are

ZETRAXUS is the data controller for the personal data processed on this Platform. This policy explains what we collect, why, and the rights you have — including under Türkiye's Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU GDPR.

2. Data we collect

Depending on how you use the Platform, we process:

• Account data: email address, display name, username, password (stored only as a secure hash by our authentication provider), and — if you sign in with Google — your Google name, email and profile picture.
• Profile data: biography and avatar image.
• Content: forum topics, replies, uploaded images, likes, saved topics and reports you submit.
• Technical data: IP address, browser/device information, and request logs kept by our hosting providers for security and reliability. To stop reward farming (fake likes for ZETAX) we store a salted, one-way hash of your IP address with a timestamp; the raw address is not kept in our database and the hash is used only to detect accounts acting from the same network.
• Shop and wallet data: orders, ZETAX and USD balances and transactions, boosts, reviews you write, and the payout details you enter; the coupon codes you use, the daily rewards you collect, and who invited whom (the inviter sees the username of the people they invited and whether the invitation counted).
• Local preferences: language, sound on/off and similar settings stored in cookies or your browser's local storage.
• Visit statistics: we count visits ourselves, without cookies and without any outside analytics service. We keep daily totals only — the number of visitors and page views, which sections were opened, the site or campaign a visit came from, the language and whether it was a phone or a computer. So that the same visitor is not counted twice on one day, a one-way hash of the network address, the browser type and the date switches on a single bit in a daily table; the hash itself is not stored and there is no list of visitors. For a new account we note the source (for example “google” or the name of a campaign) of the visit in which it was created.

3. Why we use it (purpose and legal basis)

We process your data to create and run your account, publish your content, show notifications, keep the community safe (moderation, spam prevention, abuse reports), secure the Platform, and comply with legal obligations. The legal bases are the performance of our contract with you, our legitimate interest in operating a safe community, compliance with legal obligations, and — where required — your explicit consent (KVKK Art. 5).

4. Automated image moderation

Images you upload are sent to an AI moderation service (OpenAI) solely to check them for prohibited content before publication. The result (approved/rejected and category scores) is stored with the upload. Rejected images are not stored by us.

5. Who we share it with

We do not sell your personal data. We share it only with service providers that process it on our behalf:

• Supabase — database, authentication and file storage.
• Vercel — website hosting and delivery.
• Google — only if you choose “Continue with Google”.
• OpenAI — automatic checks of uploaded images, of video cover images and of the text of posts and profiles.
• Google (Gemini API) — when a reader presses “Translate” or the founder edits The Vision (that text is sent to Google to be translated), and when a member writes to ZETRAXIST AI (the conversation is sent to Google to produce the answer; ZETRAXUS does not store it — it stays in the member’s browser — and only counts how many messages each member sends per day). Google may use content sent through its free tier to improve its products.
• Cloudflare — delivery of the website (it serves every page and keeps short-lived copies of public pages for visitors who are not signed in) and the forwarding of e-mails sent to our addresses.
• Resend — sending our e-mails (sign-up confirmation, password reset).
• Whop — to take card payments for official books, ZETAX and boosts. You pay in Whop's checkout form, shown inside our pages, where Whop collects your card and billing details directly; we don't see or store them. We pass Whop your account e-mail address (to prefill the form) and an internal payment reference, and we store the amount, currency, Whop's payment reference and the fraud signals it reports (a risk score and whether 3-D Secure was completed), which it confirms to us server-to-server. Cryptomus — to take USDT payments once that option is opened; we store the amount, the network and Cryptomus's invoice reference.
• Payout channels (banks, Wise, crypto networks) — only for payout requests made before 29 September 2026, when money payouts ended: the payout details entered then.
• TikTok, Instagram (Meta) and YouTube (Google) — only when you press play on a video in Nexus: the video is then loaded from that platform, which receives your IP address and may set its own cookies under its own privacy policy. Nothing is loaded from them before you press play (the cover images shown in lists are copies kept on our own storage).
• Public authorities, when legally required.

6. International transfers

Our providers may store and process data on servers outside Türkiye (for example in Asia, the EU or the United States). Where KVKK Art. 9 applies, such transfers are carried out on the basis of appropriate safeguards or your explicit consent, which you give when you create an account.

7. What is public

Your display name, username, avatar, bio and the content you post in the forum and in Projects (including team membership) are visible to everyone. Your email address is never shown publicly.

8. Retention

We keep your data while your account is active. When you delete content or your account, we delete or anonymise the related data within a reasonable period, except where we must keep it longer to comply with the law or to resolve disputes and abuse reports.

9. Your rights

Under KVKK Art. 11 (and GDPR where applicable) you may:

• Learn whether your personal data is processed and request information about it.
• Learn the purpose of processing and whether it is used accordingly.
• Know the third parties to whom it is transferred, in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction of your data.
• Object to results arising exclusively from automated processing that are to your detriment.
• Claim compensation for damages caused by unlawful processing.

10. Cookies and local storage

We use strictly necessary cookies to keep you signed in and to remember your language. Your browser's local/session storage remembers preferences such as sound and whether you've seen the intro animation. If you arrive through a member's invitation link, the inviter's username is kept in local storage for up to 30 days so the invitation can be counted when you create an account. The source of your visit (a word such as “google”, or the campaign name in the link you followed — never an identifier) is kept in session storage until you close the tab. We do not use advertising cookies.

11. Security

We use encrypted connections (HTTPS), row-level access rules in our database, server-side rate limits and restricted administrative access. No system is perfectly secure, so please use a strong, unique password.

12. Children

The Platform is not intended for children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Contact and changes

To exercise your rights or ask a question, write to privacy@zetraxus.com. We will respond within 30 days as required by KVKK. We may update this policy; the date at the top shows the latest version.