Privacy Policy and Data Protection Notice

Last updated: September 30, 2026

This notice explains which personal data we process when you use runelab.ai and our services, why, and who we share it with. It also sets out your rights under Turkey's Personal Data Protection Law No. 6698 (KVKK). If the two versions differ, the Turkish version prevails.

In short

• We process your data only for the purposes described here, and we do not sell it.
• We use what you enter in our forms to answer your request and to handle your course and event registrations.
• Analytics and ad-measurement cookies only run if you consent. You can change your choice at any time.
• Some of the providers we work with may process data outside Turkey.
• For questions and requests, write to info@runelab.ai.

1. Data controller

Your personal data is processed by Easy And Done Eğitim Danışmanlık Hizmetleri Sanayi ve Ticaret Limited Şirketi ("RuneLab", "we") as the data controller.

Address: Istanbul, Turkey
Email: info@runelab.ai
Phone: +90 532 594 62 24

2. What we process and why

We collect data partly or fully by automated means through the forms on the site, your account and your browser. We receive some details from Google when you sign in with Google, and from your company for corporate trainings. When you contact us by email or phone, we also process what reaches us that way. Each activity below lists the data, the purpose and the legal basis separately.

2.1 Contact, quote and demo forms

• Data: first and last name, email, phone, company, job title, your message, the course or product you are interested in, and the page you sent the form from. Along with the form, we receive the first page you landed on, the referring site and campaign information. If you consented to ad measurement, we also receive the ad click ID.
• Purpose: to answer your request, prepare a quote and talk to you; to see which page and campaign a request came from so we can evaluate our marketing.
• Legal basis: necessary for entering into a contract (KVKK art. 5/2-c). Where you write on behalf of a company, and for campaign information, our legitimate interest (art. 5/2-f).
• Who sees it: your request is forwarded to our team as a notification.

2.2 Account, course enrollment and learning records

• Data: name, email, a one-way hash of your password; your Google account name, email and account ID if you sign in with Google; phone, address, LinkedIn and website if you give them at enrollment or in your profile; the courses you enroll in, any discount or enrollment code you use, completed lessons, video progress, quiz answers and scores, notes you add to videos, attendance and end-of-course feedback; the date and IP address when you checked that you had read this notice and when you opted in to the newsletter.
• Purpose: to create your account and let you sign in securely, manage your access and progress, issue certificates, send course-related emails and keep enrolled people in our customer list. For courses run with Boğaziçi University BÜYEM, to send you to BÜYEM's enrollment page and record that referral.
• Legal basis: performance of a contract (art. 5/2-c). Our legitimate interest for the customer list, the referral record and the checkbox records (art. 5/2-f).

2.3 Payments

• Data: name on the card, amount, any discount code, order number and the bank's transaction reply. For shop orders, phone, delivery and billing address.
• Purpose: to take payment, complete your enrollment or order, and meet our accounting and tax obligations.
• Legal basis: performance of a contract (art. 5/2-c) and our legal obligation (art. 5/2-ç).
• Card details: the card number, expiration date and security code pass through our server to our partner bank's 3D Secure page, where you confirm the payment. We do not store them.

2.4 Expert Talks and event registrations

• Data: first and last name, email, organization or school, job title or major, experience level, your expectations, topics you would like in the future and your answers to the form's questions; the date and IP address when you submitted the form.
• Purpose: to register you, send the event link and reminders, shape the content for the audience and keep your registration in our customer list.
• Legal basis: entering into and performing a contract for the registration, link and reminders (art. 5/2-c). Our legitimate interest for expectations and survey answers, the customer list and the checkbox record (art. 5/2-f).

2.5 Certificates

A certificate issued when you complete a course shows your name, the course and the date. So that it can be verified, we show this information on a page that anyone with the certificate's unique link can open. We block search engines from crawling these pages; you decide who gets the link. Legal basis: performance of a contract (art. 5/2-c).

2.6 Newsletter

• Data: your email address and the date you subscribed.
• Purpose: to email you announcements about courses, events and products.
• Legal basis: your explicit consent (art. 5/1) and your consent under Law No. 6563. Receiving the newsletter is never a condition for any service.
• To unsubscribe: just write to info@runelab.ai. We act on it within 3 business days.

2.7 When you visit the site

When you connect to the site, we process your IP address, browser details and the page you request on our infrastructure providers' systems, to run the site, protect it against attacks and produce cookieless, aggregate visit statistics. Legal basis: our legitimate interest (art. 5/2-f).

2.8 Corporate training participants

• Data: your name and email as provided by your company; the name and attendance you give in the roll-call form, your feedback answers, the certificate issued in your name.
• Source: the company that bought the training, and the roll-call form you fill in.
• Purpose: to deliver the training to your company, record attendance, issue certificates and evaluate the training.
• Legal basis: our legitimate interest in performing our training contract with your company (art. 5/2-f).

3. Who we share data with

We share your data only with the following groups of recipients, and only as far as the purposes in this notice require:

• Providers of hosting, infrastructure, security and content delivery services
• Providers of email and communication services
• A provider of customer relationship management services
• Our partner bank, for card payments
• Only with your consent: Google and OpenAI, for analytics and ad measurement
• Providers of embedded content that show videos and documents on some pages
• Authorized public authorities, when the law requires it

Some of the providers we work with may process data outside Turkey, which counts as a transfer abroad under KVKK art. 9.

4. Cookies and similar technologies

This section is our cookie notice. The data controller is RuneLab, named in section 1. Your rights and how to make a request are in section 7.

Cookies are small files saved in your browser when you visit the site; we treat similar records the browser keeps for the same purpose as cookies too. In the "Cookie preferences" box shown on your first visit you can choose "Accept", "Only necessary" or "Manage preferences".

You can change your cookie preferences here. When you withdraw consent, analytics and ad-measurement cookies are deleted and the code for these services is not loaded again. Without your consent this code is never loaded; the data is not used to show our ads to you again.

Videos and documents on some pages are shown through third-party services. When you open them, these services may receive your IP address and browser details and set their own cookies. You can also delete or block cookies in your browser settings; some features, such as signing in, may then stop working.

5. Security

• We store your password as a one-way hash; no one, including our team, can see it.
• We do not store card details.
• Only authorized team members can access the admin panel.

6. How long we keep data

When a period ends, we delete, destroy or anonymize the data.

7. Your rights and how to make a request

Under KVKK art. 11 you have the right to:

• learn whether your personal data is processed
• request information about it if it is
• learn the purpose of processing and whether it is used for that purpose
• learn which third parties in Turkey or abroad receive it
• ask for incomplete or incorrect data to be corrected
• ask for it to be deleted or destroyed when the conditions of KVKK art. 7 are met
• ask us to tell the third parties who received your data about any correction, deletion or destruction
• object to a result against you that comes solely from automated analysis of your data
• claim compensation if you suffer damage from unlawful processing

You can make your request in Turkish in two ways. Email info@runelab.ai from the email address you have already given us and that we have on file, or send a written request to our company address.

Please include your name, Turkish ID number, postal address, contact details and your request. If you are not a Turkish citizen, give your nationality and passport number instead of the ID number. We reply free of charge within 30 days.

If your request is refused, you find the answer inadequate, or you get no answer within 30 days, you can complain to the Personal Data Protection Board. The deadline is 30 days from learning the answer, and in any case 60 days from your request (KVKK art. 14).

8. Children

Our services are not intended for people under 18.

9. Changes to this notice

When we change this notice, we update the date at the top. If we add a new cookie or service that relies on your consent, we ask for your choice again.