Login Register

Privacy Policy

Last updated: July 8, 2026

This policy explains what personal data Hairloss Authority ("we", "us", "the site") collects when you visit or register on this site, why we collect it, and what rights you have over it. It is written to address both the EU General Data Protection Regulation ("GDPR") and Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), since our visitors and members come from both regions.

1. Who is responsible for your data

Hairloss Authority is operated by an individual (not a registered company) from Türkiye. For all data protection matters, questions, or requests, contact us at info@hairlossauthority.com — this inbox is monitored by the site operator directly. We are not currently registered with Turkey's Data Controllers' Registry (VERBİS); we are reviewing with counsel whether registration is required at our current scale, and will update this notice if that changes.

2. What we collect

When you create an account, we collect your email address and a nickname you choose — we do not ask for your real name. If you use community features, we also process:

  • Your IP address, temporarily, to prevent abuse (e.g. rate-limiting login attempts and form submissions).
  • A session cookie, needed to keep you signed in — this is strictly necessary and does not require consent.
  • Content you choose to submit: forum questions, replies, and any images you upload with them.
  • An avatar image, only if you choose to upload one.
  • If you choose "Continue with Google": Google tells us only your email address (which Google has verified) and an opaque Google account identifier, so we can recognise you next time. We do not request or store your Google name or profile picture, and your Google name and email are never displayed publicly — other members only see the username you choose. Signing in with Google is optional; Google is used only to sign you in, and your account, posts and profile belong to Hairloss Authority, not to Google.
  • A record of your consent choices at registration (whether you agreed to the Terms/Privacy Policy and whether you opted in to marketing emails), each logged with a timestamp, the version of the text you saw, and your IP address — this record exists to prove, if ever needed, that consent was properly obtained.
  • Aggregate analytics (page views, approximate session counts) via Google Analytics 4, but only after you accept the cookie banner shown on your first visit — see Section 5.

3. Why we collect it, and our legal basis

  • Operating your account (sign-in, password reset, email verification, displaying your forum activity) — necessary to perform our contract with you as a registered member (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
  • Security and abuse prevention (rate-limiting, IP logging) — our legitimate interest in keeping the service available and safe (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
  • Marketing emails — only if you separately opt in at registration; based on your explicit, freely-given consent, which you can withdraw at any time (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
  • Analytics cookies — only after you actively accept the cookie banner; based on your explicit consent (GDPR Art. 6(1)(a) and the ePrivacy rules on cookies; KVKK Art. 5(1)).
  • Responding to legal requests — where we are required to by law (GDPR Art. 6(1)(c)).

We do not sell your data to anyone, and we do not use your data for third-party advertising.

4. Cookies

We use one strictly-necessary session cookie to keep you signed in — this doesn't require consent under GDPR/ePrivacy rules and can't be disabled without breaking login. If you accept the cookie banner shown on your first visit, we also load Google Analytics 4, which sets its own cookies to measure aggregate traffic (page views, approximate visitor counts) — no individual profiling, and it is not used for advertising. If you reject or ignore the banner, analytics scripts are never loaded. Google Analytics processes data on Google's servers, including in the United States; Google's Standard Contractual Clauses apply as a transfer safeguard. See Google's Privacy Policy for details. You can change your mind at any time by clearing your cookies for this site, which will show the banner again on your next visit.

5. How long we keep it

We keep your account data for as long as your account exists. If you delete your account from your Account page, your email, nickname, password, uploaded images, and consent records are permanently and immediately removed. Rate-limiting records used for abuse prevention are short-lived (deleted after about an hour); general system logs are retained briefly for security troubleshooting and then deleted. Contact form messages are kept only as long as needed to respond to your inquiry.

6. Your rights

Under GDPR and KVKK, you have the right to: know whether we process your data, request access to it, request correction of inaccurate data, request erasure ("right to be forgotten"), object to or request restriction of processing, request portability of your data, and withdraw consent at any time (without affecting processing already carried out). You can exercise most of these instantly and without contacting us, from your Account page, including a one-click "Delete My Account" option. For anything else, email info@hairlossauthority.com.

If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority: in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurumu); if you are in the EU/EEA, your local data protection authority.

7. Who else processes your data

We use SiteGround for hosting and outbound email delivery; Google LLC (Google Sign-In), only if you choose to sign in with Google; and — only with your consent — Google LLC (Google Analytics 4) for aggregate traffic statistics. These providers process data on our behalf under their own data processing terms; we do not share your personal data with advertisers or data brokers.

8. Security

Passwords are never stored in plain text (bcrypt hashing), all traffic is served over HTTPS, and access to community features requires email verification. No system is perfectly secure, but we take reasonable technical measures appropriate to the data we hold.

9. Children

This site is not directed at children under 16, and registration requires you to confirm you are at least 16. We do not knowingly collect data from children under this age.

10. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above. If you have an account, continued use after a change means you accept the updated policy.

Questions or requests? Contact us at info@hairlossauthority.com.