Privacy Policy

Last updated 8 October 2026

Who we are

unexpectedd ("we", "us") is an early-stage startup based in Türkiye building an automated API testing product. We run unexpectedd.com and decide how the personal data described here is used. You can reach us at bora@unexpectedd.com.

This policy covers this website, the waitlist and emails you send us. The unexpectedd product will have its own privacy terms, which we'll share before you get access.

What we collect

When you join the waitlist, we store:

• your email address
• which form you used (top or bottom of the page)
• the country your request came from, which our hosting provider derives from your IP address (we don't store the IP address itself)
• the date and time you joined

When you email us, we receive your email address and whatever you include in your message.

When you visit the site, our hosting provider Cloudflare processes technical data such as your IP address, browser type and the pages you request, so it can deliver the site and protect it from abuse. We don't use this data to identify or profile you.

What we don't do

• We don't use cookies or similar tracking technologies.
• We don't use analytics, advertising or social media trackers.
• We don't load fonts, scripts or other files from third parties. Everything is served from unexpectedd.com.
• We don't sell, rent or share your data for marketing.

Why we use it and on what legal basis

• Waitlist: to email you about early access and updates about unexpectedd. The legal basis is your consent (GDPR Article 6(1)(a); explicit consent under Türkiye's Personal Data Protection Law No. 6698, "KVKK"). You can withdraw consent at any time by emailing us or replying to any email we send.
• Emails you send us: to reply to you. The legal basis is our legitimate interest in answering your request (GDPR Article 6(1)(f)).
• Technical data: to run the site and keep it secure. The legal basis is our legitimate interest in operating a secure website (GDPR Article 6(1)(f)).

How long we keep it

We keep your waitlist entry until you ask us to remove it or we stop running the waitlist, whichever comes first. We keep email correspondence only as long as we need it to handle your request. Technical data is kept by Cloudflare for a short period, under its own retention policies.

Who processes your data

We use these service providers, who process data on our behalf:

• Cloudflare, Inc. hosts the website, stores the waitlist database (in its Eastern Europe region), forwards our email and protects the site.
• Google LLC (Gmail) is the inbox that email sent to bora@unexpectedd.com is forwarded to.

Before we start emailing the waitlist through a dedicated email service, we'll update this policy to name it.

International transfers

Cloudflare and Google operate worldwide, so your data may be processed outside your country, including outside the European Economic Area and Türkiye. These providers protect such transfers with safeguards such as the European Commission's Standard Contractual Clauses.

Your rights

Depending on where you live, you can ask us to:

• tell you what data we hold about you and give you a copy
• correct it
• delete it
• stop or restrict using it, or object to how we use it
• send it to you or another service in a portable format

Email bora@unexpectedd.com and we'll reply within 30 days. You can also complain to your local data protection authority, or in Türkiye to the Personal Data Protection Authority (KVKK).

Security

The site is served only over HTTPS. Only the founding team can access the waitlist.

Children

This site is meant for professionals and isn't directed at children under 16. We don't knowingly collect their data. If you think a child has joined the waitlist, contact us and we'll delete the entry.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use your waitlist data, we'll email you before it takes effect.