Privacy policy

Controller and contact

Data controller: Laplace Apps. Service brand: ReArch Labs.

Data and privacy requests: hello@rearchlabs.com.

This notice covers the calculator, report and project enquiry forms, direct email correspondence and aggregate usage measurement on rearchlabs.com. Information is collected electronically through the forms and emails you submit; security and usage information is collected automatically through the connection between your browser and the server.

Calculator and report

• Calculator inputs are first processed in your browser. Selecting the report button submits the inputs and consent choices to the server to prepare a PDF; they are not put in the URL.
• Your theme preference is stored in browser localStorage and can be removed by clearing site data. Simulation case, task and tab selections appear in the URL. Your last SMB, enterprise or partner section is kept in sessionStorage as report context for that session; email addresses and cost inputs are not stored there.
• No analytics or advertising cookies are used. There is no account registration or live AI query. The contact form is a separate flow for sending a service enquiry to the studio.
• A report request records your email, language, currency, inputs/results, scenario, optional segment context and versioned consent choices. The PDF is sent to you; the studio owner receives a request summary and the report.

Contact and service enquiries

The live contact form requires your name, email address and message; the company field is optional. Your consent to forward the enquiry and the notice version are sent with these details to the studio owner’s email address. Your address is used as the reply-to address so we can respond. The form accepts no attachments, sends no automatic reply to you and collects no marketing permission. Your contact details and message are not stored in the application database; a keyed digest and short-lived delivery status are kept to prevent duplicate sending.

Your enquiry is used to assess your needs, explain the relevant service and respond to you. Do not send passwords, access keys, client data or sensitive personal information. If you are writing on behalf of a company, provide only your business contact details.

Purposes and legal bases

• Contact and enquiry details necessary for quotations and contract discussions you request on your own behalf are processed under Article 5(2)(c) of Türkiye’s KVKK for entering into or performing a contract. Responding to enquiries you make as a company representative and to general service questions relies on our legitimate interests under Article 5(2)(f).
• Your email and calculation inputs are used to prepare and deliver the free PDF report you request. This relies on our legitimate interest in fulfilling the requested calculation service under Article 5(2)(f). Receiving a report does not require permission for promotional emails.
• Preventing abusive submissions, operating a secure service and understanding content use without creating personal profiles rely on legitimate interests under Article 5(2)(f). Processing is limited to information needed for those purposes; the measurement controls below apply.
• Responding to data subject requests relies on the legal obligation in Article 5(2)(ç). Keeping request and preference records where necessary to establish or defend a right relies on Article 5(2)(e). Optional promotional email permission relies on your explicit consent under Article 5(1).

KVKK — conditions for processing personal data ↗

Aggregate site usage measurement

Page views and selected button actions are counted as daily totals to understand which content is used. Measurement does not create cookies, persistent visitor or session IDs, fingerprints, personal profiles or cross-page journeys. Statistics do not contain URL queries or fragments, form fields, cost inputs, email addresses, messages, raw IP addresses or full referring URLs. Sources and device classes are counted in limited categories.

A temporary ID for one page opening exists only in that document’s memory; server state preventing duplicate counts expires after 23 hours and is deleted by hourly cleanup, within 24 hours when the scheduler runs normally. No raw event history is retained. Daily totals have a 90-day retention threshold and expired records are deleted by hourly cleanup. Measurement is disabled when your browser sends Global Privacy Control or Do Not Track. You can also turn it off using the measurement preference in the footer; that preference stores only an on/off choice in the browser.

Hosting, providers and transfers

• Cloudflare Workers runs the site and form endpoints. D1 stores report records, short-lived delivery/security records and aggregate usage statistics.
• Cloudflare Turnstile on live forms processes IP, browser and connection signals to detect abuse. The application rate limit uses a daily keyed digest instead of storing raw IP; this does not remove Cloudflare’s own technical processing. Turnstile privacy notice ↗
• Resend is the selected provider for application emails. Project enquiry emails carry the name, email, optional company, message and acknowledgement details to the studio owner. Report emails carry the email address, calculation information and PDF to the requester and the studio owner. Google Workspace/Gmail hosts the business mailbox, these messages and our replies.

These services also use infrastructure outside Türkiye; hosting, security and email delivery can involve processing abroad. Resend states that stored email data is held in the United States; choosing another sending region does not change that storage location. The links below describe the providers’ services and subprocessors.

Cloudflare · Google Workspace · Resend

Selecting an email link opens your own email application. Email providers’ privacy terms also apply; the link does not load an embedded tracking component on this page.

Retention and deletion

• Report requests and consent records are deleted by hourly cleanup after 24 calendar months from their record date. Temporary PDF and email copies are removed by the next hourly cleanup once the job is complete and at least 10 minutes have passed since its creation. Unfinished temporary jobs are also removed by the next cleanup after 23 hours from creation.
• Contact delivery records contain no message text and are deleted by hourly cleanup after 48 hours. Retrying uncertain delivery is limited to 23 hours. Form security counters are removed by the next hourly cleanup once two hours have passed from the start of their window.
• The 23-hour and 90-day thresholds above apply to temporary measurement state and daily totals. Measurement security counters are deleted by hourly cleanup after their one-hour window.

Retention of direct emails and replies is assessed against the continuing enquiry or business relationship, necessity to protect a right and applicable legal obligations. Data no longer needed for those purposes is deleted. Mailbox correspondence does not follow the application database’s automatic deletion schedule; an erasure request is also assessed for relevant correspondence and provider records.

Resend publishes a 30-day email and log retention period for its Free, Pro and Scale plans. That provider period does not mean copies in the studio mailbox are also deleted after 30 days. Resend retention information ↗

Your rights and requests

Under Türkiye’s data protection law, you may ask whether data is processed, why it is used and who receives it; request correction and, where applicable, deletion; ask for recipients to be notified of corrections or deletion; object to an adverse outcome based solely on automated analysis; and seek a remedy for damage caused by unlawful processing.

Turkish Data Protection Authority: data subject rights ↗

Send your request from the email address you previously supplied to us and that is held in our records to hello@rearchlabs.com with the subject of your request and the relevant transaction or correspondence. Only information necessary to verify your request is sought; identity documents are not uploaded through the general project form. See the Authority’s guidance below for other application methods and required information.

KVKK request procedure ↗

Your request is answered as soon as its nature permits and within 30 days. If it requires an additional cost, the fee schedule set by the Authority may apply.

Request acknowledgement and optional emails

The required checkbox in the report and contact forms records your request for the selected action and the current notice version; it is not promotional permission. The contact form does not create a report or marketing subscription. The optional email checkbox in the report form is unchecked by default; leaving it unchecked does not prevent your report from being prepared.

The optional email preference concerns information about ReArch Labs modernization services and published guides. No campaigns are currently sent; only the preference is recorded. You can withdraw it by writing to our privacy contact address. Withdrawal does not affect the lawfulness of earlier processing or delivery of the report you requested.

Contact page →