Privacy, kept proportional.

Version 2026.08.3 · Effective 22 August 2026 · Current website notice

What the website processes

In the current website configuration, the contact form first checks whether secure server-side delivery is available without sending form fields. The submit control remains disabled unless the approved endpoint, email provider, controlled From domain, receiving inbox, secrets, abuse controls, and transfer route are configured. If enabled, the visitor's submitted fields are sent to the same-origin endpoint and the approved email provider for delivery to the operator. Hosting and access-control systems may process IP address, device and browser data, timestamps, request paths, authentication events, and security logs.

Enterprise data-use commitment

Current website control

Data minimisation is the default for this website. The operator does not secretly collect access-brief content or collect it for an undisclosed purpose. A submission is accepted only after the visitor chooses to send it and separately acknowledges this notice; the optional marketing choice remains off by default. The application does not add marketing tracking. Necessary hosting, access-control, abuse-prevention, and security systems may still process the limited technical data described above.

Future product privacy design principle — Concept / roadmap

ORQANTA is designed so that LANTU does not collect enterprise, personal, creator, or other user content secretly, without authority, or beyond a stated purpose. Operator-controlled processing must be limited to what is relevant and proportionate for a disclosed purpose and supported by an applicable lawful basis—for example, providing a service the user requests, performing a contract, meeting a legal obligation, or acting on a specific, informed, freely given, and withdrawable choice where consent is the proper basis.

Customer or creator content will not be used for model training or cross-customer improvement unless the relevant party gives a clear, separate, demonstrable opt-in or a separate signed contract expressly authorises that use, and the processing is otherwise lawful. Any meeting, call, voice, or recording workflow must first satisfy applicable notice, consent or other lawful-basis requirements, organisational authority, and geographic restrictions. Consent and notice must remain separate. Retention should be minimised, and applicable rights requests must remain supportable. These are product design requirements, not a claim that such product workflows are currently available.

Purposes and legal basis

Essential technical data is processed to deliver the site, restrict access, prevent abuse, diagnose failures, and protect legal rights. When the contact endpoint is enabled, contact fields and consent records are processed to respond to a request and, where applicable, take steps requested before a contract. Optional marketing consent is a separate, freely chosen basis and is not required to submit an inquiry. No decision is made solely by automated profiling on this website.

A product-needs submission is used privately to evaluate problems and possible product direction. Contact details are requested only when the visitor asks for a reply. The operator may not reply to every suggestion. Suggestion content is not published, added to marketing lists, used for model training, or shared as a public community post. The visitor must not submit third-party confidential information or sensitive personal data.

Meeting, voice, and recording design boundary

The current website does not accept recording uploads and does not run a live meeting bot or continuous call listener. The product roadmap describes a future flow in which a permitted uploaded recording, voice note, or transcript can produce a reviewable transcript, summary, decisions, tasks, risks, and follow-up before a person authorises any bounded agent action. Before such a flow is enabled, applicable notice, recording consent or other lawful basis, external-participant notice, organisational authority, sensitive-mode controls, access restrictions, retention, deletion, and geographic-transfer requirements must be implemented and documented.

Cookies, analytics, and advertising

ORQANTA does not install advertising, behavioural analytics, heatmap, retargeting, or social-tracking code on this site. Only cookies or equivalent storage strictly necessary for hosting, security, and owner-only access may be set by the platform. See the Cookie Policy.

Recipients and international transfers

Technical data may be received or handled by OpenAI and its hosting, edge delivery, authentication, security, and support providers used for ChatGPT Sites. OpenAI's ChatGPT Sites Data Processing Addendum is incorporated into the applicable Sites terms and applies when a published Site collects personal data. OpenAI's published subprocessor list describes possible processing locations; this deployment does not provide a verified single-region or Singapore-only commitment.

These providers may process data in countries outside Türkiye, as described in the linked provider materials. The OpenAI Sites DPA does not, by itself, evidence execution of a Türkiye-specific KVKK standard contract or completion of a KVKK notification. Private or invite-only access is not, by itself, an exemption from cross-border transfer rules. Before any Türkiye-origin personal data is made available through, submitted to, or generated by use of this Site, the operator must document a valid KVKK transfer route or a qualified legal determination that another lawful route applies. If the parties use a KVKK standard contract, both parties must execute it and the required notification must be made within five business days after signature. No unexecuted transfer instrument is represented as signed.

A transactional-email provider has not yet been selected or enabled. Before enablement, its contracting entity, DPA, subprocessors, processing and support locations, message-retention controls, deletion path, security terms, and Türkiye/KVKK transfer route must be approved and added to the current subprocessor register. Before enablement, the private receiving inbox must be configured only as a server-side secret; it is not published in browser code.

OpenAI — ChatGPT Sites Data Processing Addendum · OpenAI subprocessor list

KVKK standard-contract notification guidance

Retention

When server-side delivery is enabled, the website does not retain the raw inquiry or suggestion body in its rate-limit database. It assigns a 30-day logical expiry to a keyed, non-reversible request hash and, when an address is provided, an email hash; submission category, high-level user type, reply choice, delivery status, notice version, acknowledgement time, separate marketing choice, and a non-identifying reference are used solely for rate limiting, duplicate prevention, delivery support, and consent evidence. The current endpoint deletes expired metadata during request maintenance. Before production collection is enabled, a scheduled or equivalent deletion process must also be configured and verified so physical retention cannot silently exceed the stated period during inactivity. Operator-controlled inquiry correspondence is reviewed at least annually and deleted or anonymised within 24 months after the last substantive contact, unless it becomes part of a contract record, a dispute, a legal claim, or a record that law requires the operator to keep for longer. When an inquiry is declined and no legal need remains, it is deleted at the next annual review. Provider-controlled message, access, authentication, and security data follow the approved provider settings and terms; the operator does not represent an exact provider-controlled period it cannot set.

Your rights

Subject to applicable law, you may ask whether personal data is processed, request information and access, seek correction or deletion, object or request restriction where available, and complain to the competent authority. The published candidate channel is info@lantu.global with the subject “ORQANTA privacy request”; reliable receipt and routing must be verified before production collection is enabled. A KVKK application must be resolved as soon as possible and no later than 30 days, generally without charge unless the legally permitted tariff applies because the response creates an additional cost. If an application is rejected, the response is insufficient, or no timely response is given, the applicant may complain to the Turkish Personal Data Protection Authority within the statutory periods. The operator will first use information already associated with the correspondence to verify the requester. If that is insufficient, it may request the minimum additional information reasonably necessary to prevent disclosure to the wrong person. Do not send identity-document copies unless specifically requested through a proportionate, approved process. See the KVKK Authority guidance on responding to data-subject applications.

Data minimisation

Do not send passwords, identity documents, customer records, contracts, health information, financial account data, or other confidential material in the first message. A separate approved channel and agreement are required before sensitive business data is exchanged.

KVKK kapsamında Türkçe bilgilendirme

Veri sorumlusu LANTU TEKNOLOJİ LİMİTED ŞİRKETİ'dir. Mevcut web sitesi yapılandırmasında güvenli sunucu tarafı teslim yolu etkin değilse form alanları gönderilmez. Bu yol etkinleştirilirse, ziyaretçinin açık gönderme işlemi ve ayrı gizlilik bildirimi onayı sonrasında alanlar aynı kaynaklı uç noktaya ve onaylanmış e-posta sağlayıcısına iletilir; isteğe bağlı pazarlama seçimi varsayılan olarak kapalıdır. Ham talep veya öneri metni oran sınırlama veritabanında saklanmaz; anahtarlı özetler, başvuru kategorisi ve onay metaverilerine 30 günlük mantıksal sona erme süresi atanır. Üretim veri toplaması etkinleştirilmeden önce, fiziksel silmenin bu süreyi aşmamasını sağlayan zamanlanmış veya eşdeğer bir silme süreci yapılandırılmalı ve doğrulanmalıdır. Barındırma ve güvenlik sistemleri teknik erişim kayıtlarını işleyebilir. Hak talepleri için yayımlanan aday kanal, “ORQANTA privacy request” konusu ile info@lantu.global adresidir; üretim veri toplama başlamadan önce teslim ve yönlendirme güvenilirliği doğrulanmalıdır. KVKK kapsamındaki başvurular en kısa sürede ve en geç 30 gün içinde, ek maliyet doğuran yasal tarife istisnası dışında ücretsiz olarak sonuçlandırılır. Türkiye kaynaklı kişisel verilerin yurt dışına aktarılması için geçerli hukuki mekanizma belgelenmeden kamuya açık veri toplama etkinleştirilmeyecektir.