Wellum

Privacy Notice

Last updated: July 18, 2026. This page is also the aydınlatma metni required by Article 10 of the Turkish Personal Data Protection Law (KVKK) and the privacy notice required by Articles 13–14 of the EU GDPR.

Who we are

Wellum (wellum.link) is a service for creating and sharing a 3D business card, operated independently from Türkiye. Wellum is the data controller (veri sorumlusu) for the data described here. For anything in this notice — including requests about your data — contact saas.dev.mailer@gmail.com.

What we collect

  • Account data — your email address and a password (stored only as a secure hash), or your Google account identity if you sign in with Google; plus your chosen username.
  • Card content — whatever you choose to put on your card: name, title, company, contact details, social handles, and an optional portrait photo. You control all of it and can edit or remove it at any time.
  • Billing data — your plan and a subscription reference. Payments are processed entirely by Lemon Squeezy (our merchant of record); your card number never reaches us.
  • Visitor statistics — when someone views a published card we record only the country (derived from the network route) and a device class (phone/desktop). We do not store visitor IP addresses and we use no tracking cookies.
  • Technical logs — short-lived server logs for security and debugging.

Why, and on what legal basis

  • Providing the service (accounts, hosting your card, billing): performance of our contract with you — GDPR Art. 6(1)(b); KVKK m.5/2-c.
  • Security, abuse prevention, and aggregate view statistics: our legitimate interest in running a safe, functioning service — GDPR Art. 6(1)(f); KVKK m.5/2-f.
  • Legal obligations (e.g. tax records via our payment provider): GDPR Art. 6(1)(c); KVKK m.5/2-ç.

We collect all data directly from you (through the forms and editor) or automatically when the service is used (statistics, logs). We do not buy, sell, or enrich personal data, and we show no ads.

Your card is public when you publish it

The whole point of Wellum is a shareable card. When you switch your card to “published”, its content — including any photo and contact details you added — is visible to anyone who has the link, and may appear in link previews and search engines. Unpublish it at any time to take it offline.

Who processes your data for us

We use a small set of infrastructure providers (processors):

  • Supabase — database, authentication, and file storage, hosted in Frankfurt, Germany (EU).
  • Railway — application hosting, in Amsterdam, Netherlands (EU).
  • Resend — sends account emails (confirmation, password reset); a US company.
  • Lemon Squeezy — merchant of record for payments; a US company. It is an independent controller for the payment itself.
  • Google — only if you choose “Continue with Google” for sign-in.

International transfers. Your data is stored in the EU. For users in Türkiye this means your data is held outside Türkiye (KVKK m.9); by design we keep it in the EU, which applies GDPR-level protection. Transfers to US-based providers (email delivery, payments) are covered by those providers’ EU standard contractual clauses.

Cookies

We set only the strictly necessary cookies that keep you signed in. No advertising, analytics, or cross-site tracking cookies — which is why you don’t see a cookie banner here.

How long we keep data

Account and card data: until you delete them. Deleting your account (Dashboard → Account → Danger zone) immediately and permanently removes your profile, card, uploaded photo, and view statistics. Billing records are kept by Lemon Squeezy as required by tax law. Server logs rotate automatically within days.

Your rights

Under KVKK m.11 and GDPR Arts. 15–21 you can ask us: what we hold about you, to correct it, to delete it, to give you a copy, to restrict or object to processing, and you can complain to a supervisory authority (in Türkiye: the Kişisel Verileri Koruma Kurumu; in the EU: your local data protection authority).

Most of this is self-service: edit everything in the dashboard, delete your account in the Account panel. For anything else, email saas.dev.mailer@gmail.com — we respond within 30 days.

Children

Wellum is not directed at children under 16.

Changes

If we change what we collect or who processes it, we’ll update this page and its date. Significant changes will be announced in the dashboard.