Cookie Policy

Cookies are small text files saved to your browser or device while you visit a website. They are used to run the site, remember your preferences and analyse performance.

• Strictly necessary cookies: site functions and security
• Performance/analytics: usage statistics (traffic, errors, interaction)
• Marketing/optional: personalised content and campaigns (with explicit consent)

The table below shows every cookie used on the site by name. The “Consent” column states which preference has to be ticked for the cookie to be written; until you tick it, that cookie is not written to your device.

“First party” means the cookie is held on our own domain. _fbp and _fbc are technically first-party cookies, but their content serves Meta's advertising measurement and is transmitted to Meta. The same applies to _gcl_au and _gcl_aw, written by the Google tag; depending on the channel an advert runs on, the Google tag may also write other cookies prefixed _gcl_ (for example _gcl_dc) — they all serve the same purpose, depend on the same marketing consent, and are deleted together when consent is withdrawn.

To measure how effective our adverts and campaigns are, we store the source information showing which link or campaign brought you to the site (the utm_source, utm_medium, utm_campaign and utm_content parameters in our own links) in a small first-party cookie (vn_src, 90 days); if you make a purchase we associate it with your order. Only your first arrival is recorded; later visits do not overwrite it.

The information in this cookie is used only for our own internal advertising measurement and is not transferred to third parties such as Meta or Google. Legal ground: article 5/2-f of the KVKK (legitimate interest) — which is why it is written regardless of your cookie preference. You can delete or block it from your browser settings.

If you give marketing consent, advertising measurement runs through two channels: the Meta Pixel in your browser and Meta's Conversions API from our servers. Both use the same event identifier, so the same action is not counted twice.

• The Meta Pixel is loaded only if you have given marketing consent. Without consent, Meta's script is never added to the page.
• If you withdraw your consent, the Pixel is silenced and no new data is sent to Meta; pl_am is removed from both browser memory and your device, while pl_gcl, _fbp, _fbc and the Google advertising cookies (_gcl_*) are deleted from your device (see section 9).
• When you sign out, the pl_am and pl_uref cookies are deleted, so on a shared computer the next person's data is not matched with yours.
• The Pixel does not send events on the administration pages (/admin).
• The Google advertising tag (gtag.js) is not downloaded at all until you give marketing consent. Because the script comes from a Google server, downloading it would reveal your IP address and browser information to Google — which is why the download itself is tied to your consent. If you do not consent, your browser sends no request to Google. Once you give marketing consent the tag loads and writes _gcl_au for conversion measurement and, if you arrived by clicking a Google advert, _gcl_aw as well (see section 7).

Legal ground: explicit consent under article 5/1 of the KVKK. Section 6.2 of the Turkish Data Protection Authority's Cookie Guidance requires explicit consent for advertising cookies without exception; we do not rely on legitimate interest for them.

If you have given marketing consent and are signed in, your email address is hashed in your browser with a one-way method called SHA-256 so that you can be matched correctly in advertising measurement. The resulting hash is stored in the pl_am cookie for 180 days and sent to Meta.

• Your raw email address is not sent to Meta; it is written neither to this cookie nor to the advertising network in clear form. Only the hash is transmitted to Meta.
• The same is done server-side: for purchase and sign-up events, your email address, telephone number and name are hashed on our servers before being sent to Meta.
• Under the KVKK this hash is not anonymous data; it is personal data that can be associated with you and is protected as such. Law no. 6698 has no separate intermediate category of “pseudonymous data”, so the full personal data regime applies to it.
• If you withdraw your consent, the hash is deleted from your device and no new data is sent. However, there is no technical way to retrieve data already transmitted to Meta; in that case you can also contact Meta directly.
• If your browser does not support the required security feature, no hash is produced and this matching does not happen — raw data is not used as a fallback.

The advertising measurement described above means your data is transferred to providers outside Türkiye. The recipients and the data transferred are:

• Meta Platforms Ireland Ltd. / Meta Platforms, Inc. — cookie and advertising click identifiers (_fbp, _fbc), the pseudonymous user reference, hashes of your email address, telephone number and name, event information, together with your IP address and browser information. IP and browser information are transmitted without hashing.
• Google (Google Ads / gtag.js) — advertising measurement; the advertising tag is downloaded only if you give marketing consent, and without consent your browser sends no request to Google. If you have consented, the data transferred are the identifiers in the advertising cookies (_gcl_au, _gcl_aw and the gclid/gbraid/wbraid click identifier in pl_gcl), conversion information (event name, time and amount), your order number, SHA-256 hashes of your email address and telephone number produced on our servers (their raw form is not sent to Google; like in section 6, these hashes are protected as personal data), and your IP address and browser information while the tag loads.

The legal framework is article 9 of the KVKK. Information about possible risks: the Turkish Personal Data Protection Board has not to date issued an adequacy decision for any country. For that reason the country your data is transferred to may not provide the same level of protection as Türkiye, there may be no data protection supervisory body there, and the rights in article 11 of the KVKK may not operate there in the same way.

If you do not give marketing consent, no cookie is written for any of these transfers and no data is sent to Meta or Google.

Besides cookies we also use your browser's local storage. These are not cookies, are not sent to the server automatically and are not used for advertising measurement; we list them here because they remain on your device. You can delete them with your browser's clear-site-data feature.

• cookie-consent-v1 — Your cookie preferences and the moment you made the choice. Stays until you delete it.
• vn_had_session — A hint that you have signed in before; prevents unnecessary session requests.
• vn_last_checkout — Your last order draft (product, discount code, title) so you can “try again” if payment is interrupted. Contains no identity or payment details.
• voucherCode / voucherTs — A discount code that arrived with a link. Treated as expired after 7 days.
• vn_last_refresh — Session refresh timestamp; prevents back-to-back refresh requests.
• vn_dismissed_notices — Site notices you dismissed, so the same notice does not reappear.
• aiRenderNav — A page-transition hint. Deleted when you close the tab.

The Meta Pixel also uses a tracking technique called a “pixel” in addition to cookies; it only comes into play when you give marketing consent.

Analytics and marketing cookies are off by default and run only when you tick them. You can withdraw your consent at any time.

• The “Cookie Settings” link at the bottom of the page reopens the panel at any time so you can change your choices; the change takes effect immediately and you do not need to reload the page.
• When you remove a consent, the cookies tied to it are deleted before they expire: for analytics consent pl_vid, pl_session, pl_ab_*, pl_abc_*; for marketing consent pl_am, pl_gcl, _fbp, _fbc and _gcl_*. If you remove both, pl_uref is deleted too. That way, even if you give consent again later, you are not matched with your old identifier.
• You can refuse or delete cookies from your browser settings. Blocking strictly necessary cookies may limit functions such as signing in.
• If you make no choice at all, analytics and marketing cookies do not run; the fact that you made no choice is recorded in the pl_consent cookie as a refusal.

Our general notice about personal data is our Data Protection Notice.