Privacy Policy

Last updated: March 2026

Cloud Atelier ("we", "our", "the platform") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your information when you visit cloudatelier.art. Cloud Atelier is operated from Ankara, Turkey, and is subject to Turkish data protection law (KVKK, Law No. 6698) as well as applicable international frameworks including the EU General Data Protection Regulation (GDPR) where relevant.

1. Data Controller

The data controller responsible for processing your personal data is Cloud Atelier, based in Ankara, Turkey. For all data protection inquiries, contact: art@cloudatelier.art.

2. Information We Collect

We collect the following information only when you voluntarily provide it:

Email address — when you create a member account or send a contact message.
Name and message — when you use the contact form.
Password — stored securely via Firebase Authentication using industry-standard encryption. We never store or have access to plain-text passwords.

We do not collect browsing history, device fingerprints, IP addresses for profiling purposes, or personal data through tracking cookies. We do not engage in automated decision-making or profiling.

3. Legal Basis for Processing

We process your personal data on the following legal bases:

Consent — when you voluntarily create an account or submit a contact form.
Legitimate interest — to maintain platform security, prevent abuse, and improve our services.
Legal obligation — to comply with applicable laws including KVKK and, where applicable, GDPR.

4. How We Use Your Information

To provide and maintain your member account.
To respond to your contact messages.
To send account-related emails (verification, password reset). We do not send unsolicited marketing emails.
To maintain platform security and prevent unauthorized access.

5. Third-Party Services

We use the following trusted third-party services. Your data may be transferred to servers outside Turkey as part of these services:

Firebase (Google LLC) — authentication and database. Data may be processed in the US/EU. Governed by Google's Privacy Policy and standard contractual clauses.
Firebase Hosting (Google LLC) — website hosting. Data may be processed in the US/EU. Governed by Google's Privacy Policy.
Google Fonts (Google LLC) — typography delivery. Font files are loaded from Google servers. Governed by Google's Privacy Policy.
Radio streams — streamed directly from public broadcasters in their respective countries. We do not collect or process any data from radio playback.
Content APIs — we aggregate publicly available, open-access content from: arXiv, Europe PMC, The Guardian, Metropolitan Museum of Art (CC0), Art Institute of Chicago (CC0), Cleveland Museum of Art (CC0), Victoria and Albert Museum, Rijksmuseum (CC0), Semantic Scholar, Wikidata (CC0), Europeana. No user data is shared with these services.

6. International Data Transfers

Some of our third-party service providers process data outside Turkey and the European Economic Area. In such cases, we ensure that appropriate safeguards are in place, including standard contractual clauses and adequacy decisions where available, in accordance with KVKK and GDPR requirements.

7. Affiliate Relationships & Commercial Disclosures

Cloud Atelier may participate in affiliate and partnership programs with select retailers, cultural institutions, and services relevant to arts, culture, and education. When you click a partnership link on our platform and make a purchase, we may earn a commission at no additional cost to you.

Affiliate relationships do not influence our editorial content or recommendations.
Affiliate links are disclosed in accordance with FTC (US), ASA/CAP Code (UK), and EU consumer protection regulations.
For full details, see our Affiliate Disclosure page.

8. Cookies

Essential cookies: Firebase Authentication uses a session token stored in your browser's local storage to keep you signed in. This token is strictly functional and essential for platform operation.

Affiliate tracking cookies: If you click an affiliate link, the affiliate network may set a third-party cookie on your device to track the referral. These cookies are NOT strictly necessary and require your explicit consent under GDPR/ePrivacy regulations. You may accept or reject these cookies via our cookie consent banner.

Partnership cookies: When we establish partnerships, the specific cookie details (duration, purpose) will be listed here. Typical affiliate cookies track referral purchases and expire within 24–90 days.

You can manage or withdraw your cookie consent at any time through the cookie settings accessible from any page on our site.

9. Sale or Sharing of Personal Information (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the use of affiliate tracking cookies may constitute a "sale" or "sharing" of personal information. California residents have the right to opt out of the sale or sharing of their personal information.

To exercise this right, visit our Do Not Sell or Share My Personal Information page, or email us at art@cloudatelier.art.

10. Data Retention

Account data — retained for as long as your account is active. Upon account deletion, data is removed within 30 days.
Contact messages — retained for up to 12 months, then permanently deleted.
Newsletter subscriptions — retained until you unsubscribe or request removal.

You may request deletion of your data at any time by emailing art@cloudatelier.art.

11. Your Rights

Under KVKK (Turkey, Law No. 6698):

Right to know whether your personal data is being processed.
Right to request information about your data processing.
Right to know the purpose of processing and whether data is used in accordance with that purpose.
Right to know third parties to whom your data is transferred.
Right to request correction of incomplete or inaccurate data.
Right to request deletion or destruction of your personal data.
Right to object to processing that produces results against you through automated systems.
Right to claim compensation for damages arising from unlawful processing.

Under EU GDPR (2016/679) and UK GDPR (UK Data Protection Act 2018):

Right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7(3)).

Under CCPA/CPRA (California, USA): Right to know, delete, opt-out of sale (we do not sell personal data), and non-discrimination.

To exercise any of these rights, contact us at art@cloudatelier.art or submit a request at cloudatelier.art/dsar.html. We will respond within 30 days. You may also complain to: KVKK Kurumu (Turkey), ICO (UK — ico.org.uk), your local EU DPA, or California AG.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encrypted data transmission (HTTPS/TLS).
Secure authentication via Firebase with industry-standard hashing.
Restricted admin access with brute-force protection and session timeouts.
Regular security reviews of third-party integrations.
Content Security Policy (CSP) headers to prevent injection attacks.

13. Children

Cloud Atelier is not directed at children under 13 (or under 16 in jurisdictions where GDPR applies). We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us immediately.

14. Changes to This Policy

We may update this policy periodically. We will post the updated date at the top of this page and, for material changes, notify registered members by email. Continued use of the platform after changes constitutes acceptance.

15. Accessibility

We are committed to WCAG 2.1 Level AA compliance and the European Accessibility Act (Directive 2019/882).

16. Contact

For privacy-related questions or data protection requests:
Email: art@cloudatelier.art
Location: Ankara, Turkey