1. Cookies and similar technologies
Convenience translation: this English version is provided for information only. The Turkish version is the binding text and prevails in case of any discrepancy.
Cookies are small text files that a website you visit stores in your browser. Similar technologies, such as the browser's local storage (localStorage) and session storage (sessionStorage), also store information on your device. This policy covers both.
This policy explains the cookies and browser storage used on the İzin360 website and app operated by [LEGAL_TRADE_NAME] ("İzin360").
2. Our approach: essential cookies, analytics only with your consent
We use cookies that are strictly necessary to provide the service you explicitly request: signing in, keeping your session secure, the language and appearance preferences you choose and your cookie choice. In addition, only if you explicitly allow it in the cookie panel, we use Google Analytics cookies on the public marketing pages (see "Analytics cookies" below). We do not use advertising, retargeting, social media or other tracking cookies.
Under the Personal Data Protection Authority's Guide on Cookie Practices, cookies that are strictly necessary to provide a service explicitly requested by the user do not require explicit consent; the data processed through them relies on the performance of a contract (KVKK Art. 5(2)(c)) and legitimate interest (Art. 5(2)(f)). Preference keys are written only when you make a choice, are not sent to our servers and are not used to track you. Analytics cookies are not essential, so they rely solely on your explicit consent (KVKK Art. 5(1)): the cookie panel is shown on your first visit to the marketing pages, and unless you allow it no analytics cookie is set and the Google Analytics script is not loaded.
3. Cookies used on the website and in the app
| Name | Purpose | Duration | Attributes | Legal ground |
|---|---|---|---|---|
| iz_at | Session access token: confirms that you are signed in to the app. Carries your user and company account identifiers, name, e-mail address and roles in signed form. | 30 minutes (at most 4 hours in a support session); deleted on sign-out | httpOnly (scripts cannot read it) · Secure over HTTPS · SameSite=Lax | Strictly necessary; performance of a contract (Art. 5(2)(c)) |
| iz_rt | Session refresh token (random value): keeps your session going without signing in again. Renewed on every use; the session is ended if reuse is detected. | 14 days (restarts on each refresh); deleted on sign-out | httpOnly · Secure over HTTPS · SameSite=Lax | Strictly necessary; performance of a contract and security (Art. 5(2)(c), (f)) |
| iz_rr | One-time flag that prevents a redirect loop when the session is refreshed concurrently; contains no personal data. | 15 seconds | httpOnly · Secure over HTTPS · SameSite=Lax | Strictly necessary; operation of the service (Art. 5(2)(f)) |
| iz_mfa | One-time key that links the password step and the code step of your sign-in when two-factor authentication is on. | 5 minutes; deleted when verification completes | httpOnly · Secure over HTTPS · SameSite=Strict | Strictly necessary; security (Art. 5(2)(c), (f)) |
| NEXT_LOCALE | Remembers the language you chose (Turkish/English). Set when you change the language or when the language you are viewing differs from your browser's language preference. | Session cookie: deleted when the browser closes | Not httpOnly, so the language switcher can read it · SameSite=Lax | Strictly necessary; interface preference you requested (Art. 5(2)(f)) |
| iz_consent | Stores your choice in the cookie panel (whether analytics cookies are allowed), the date of the choice and the panel version, so you are not asked again on every page and the analytics script is not loaded unless you allowed it. | 180 days; you are asked again when it expires | Readable by scripts so the choice can be applied (not httpOnly) · Secure over HTTPS · SameSite=Lax | Strictly necessary; applying and evidencing your consent choice (Art. 5(2)(ç), (f)) |
Fonts and other site resources are served from our own servers. Only if you allow analytics cookies are requests sent to Google Analytics servers on the marketing pages; otherwise viewing our pages does not trigger requests to third-party servers.
4. Browser storage (localStorage and sessionStorage)
The keys below are written only when you make a choice, stay on your device and are not sent to our servers. Signing out does not delete preferences in local storage; you can delete them in your browser settings.
| Key | Purpose | Duration | Storage | Legal ground |
|---|---|---|---|---|
| theme | Remembers the light, dark or system appearance you chose; written only when you change the appearance. | Until you delete it | localStorage | Preference you explicitly requested; strictly necessary |
| iz_sidebar_collapsed | Remembers whether you collapsed or expanded the side menu in the app. | Until you delete it | localStorage | Preference you explicitly requested; strictly necessary |
| iz_onboarding_dismissed:<company account ID> | Remembers that the account owner or an HR user closed the setup checklist. The key contains the company account's identifier; the value is just "1". | Until you delete it | localStorage | Preference you explicitly requested; strictly necessary |
| iz_notice_postponed | When you close your employer's privacy notice dialog with "Later", stores the notice's version number so that it does not reopen during the same session. | Deleted when the browser session ends | sessionStorage | Preference you explicitly requested; strictly necessary |
5. Analytics cookies (Google Analytics)
Only if you allow analytics cookies in the cookie panel, we use Google Analytics 4 to keep visit statistics on our public marketing and information pages (such as the home page, features, solutions, pricing, guides, contact and legal pages). The purpose is to measure, in aggregate, how our pages are found and used so we can improve the content. The app (the signed-in area), the sign-in, sign-up, password reset, e-mail verification and invitation pages, the payment pages and the administration console are not measured; the Google Analytics script is not loaded on them.
| Name | Purpose | Duration | Attributes | Legal ground |
|---|---|---|---|---|
| _ga | A random visitor identifier created by Google Analytics to recognise your later visits (not linked to your name, e-mail address or account). | 24 months; deleted when you withdraw consent | Set on the İzin360 domain by the Google Analytics script · Secure · SameSite=Lax | Explicit consent (Art. 5(1)) |
| _ga_ZSHYC4YE1F | Keeps the state of the visit session (session count and time). | 24 months; deleted when you withdraw consent | Set on the İzin360 domain by the Google Analytics script · Secure · SameSite=Lax | Explicit consent (Art. 5(1)) |
Data processed: the address and title of the page viewed, the page you came from, interactions on the page (scrolling, outbound link clicks, file downloads), browser, operating system, device type, screen resolution and language, time of the visit, approximate location (country, city) derived from your IP address and the random identifier above. According to Google, Google Analytics 4 does not log or store IP addresses; the IP address is used only to determine the approximate location. What you type into forms and your account details are not sent to Google Analytics.
Our settings: Google signals and ad personalisation are turned off; the data is not used for advertising, retargeting or profiling. Event-level data is deleted in Google Analytics after 2 months; reports contain aggregate statistics only.
Service provider and transfer abroad: Google Analytics is provided by Google LLC (United States); the data is processed on Google's servers outside Türkiye. The legal basis and safeguard for the transfer are explained in the KVKK Privacy Notice. How Google uses this data: Google's explanation for partner sites.
Withdrawing consent: You can turn analytics cookies off at any time via the “Cookie preferences” link in the footer; the Google Analytics cookies are then deleted from your browser and measurement stops. Withdrawal does not affect processing carried out on the basis of your consent before it.
6. Administration console (İzin360 staff only)
The administration console at the /super-admin path of the same domain is used only by authorised İzin360 staff. It sets the following cookies: iz_adm — the console session token (administrator identifier, name, e-mail address and role in signed form; about 60 minutes; httpOnly, Secure over HTTPS, SameSite=Strict, only on the /super-admin path) and NEXT_LOCALE — the console's language preference (session cookie, only on the /super-admin path). The console uses the theme key above for its appearance preference.
7. Third-party cookies during payment
When you pay for a subscription, your card details are sent directly to PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. through the PayTR payment frame (paytr.com) embedded in our page. This frame is loaded only at the payment step, when you start the payment, and may set its own cookies for payment security, fraud prevention and completing the transaction.
These cookies are not under İzin360's control; they are used under PayTR's own responsibility and policies. For details, see the privacy and cookie policies on PayTR's website.
8. Technologies we do not use
- Advertising, retargeting or behavioural profiling cookies,
- Social media plug-ins and third-party content such as embedded videos or maps,
- Cookieless tracking methods such as fingerprinting.
9. How to manage cookies
You can turn analytics cookies on and off via the “Cookie preferences” link in the footer. You can also view, delete or block cookies and storage in your browser settings. If you block essential cookies you may not be able to sign in to the app, or your language and appearance preferences may not be remembered; blocking analytics cookies does not affect how the site works. Deleting session cookies signs you out; deleting the iz_consent cookie makes the cookie panel appear again.
10. The cookie panel and your consent
We obtain your explicit consent for non-essential cookies through the cookie panel:
- The first layer offers “Reject”, “Preferences” and “Accept” with equal prominence; the panel does not block the page and you can use the site without consenting,
- Analytics cookies are off by default; continuing to use the site does not count as consent,
- Your choice is kept in the iz_consent cookie for 180 days; you are asked again when it expires or when we add a new cookie category,
- You can withdraw your consent at any time via the “Cookie preferences” link in the footer.
11. Your rights
You can exercise your rights under Article 11 of the KVKK regarding personal data processed through cookies in the ways described in the data subject requests section. Questions: [LEGAL_PRIVACY_EMAIL].