Privacy Policy
Last updated 2026-10-22 · Version 2026-10-22
Pre-launch draft: these documents require lawyer review before launch.
Legal contact: [email protected]. Service operator: Applixus A.Ş., Turkey.
Controller and data collected
Applixus A.Ş., Turkey is the controller for account, billing, support and service-usage data. Contact [email protected]. We process your name, email, password hash, verification status, workspace membership, consent records, billing references, store connections and data you authorize us to import. We hash IP and user-agent values in legal acceptance records; hashes remain personal data where linkable. Never submit store-user personal data that is unnecessary for your task.
Purposes and legal bases
We process data to create accounts, authenticate users, provide contracted services, prevent abuse, manage payments and comply with legal obligations. Contract necessity, legitimate interests in security and service operation, and legal duties may apply. Optional marketing and nonessential cookies require separate, withdrawable consent where required. Refusing marketing does not affect core service. We do not sell personal information or share it for cross-context behavioral advertising.
Processors and international transfers
Service providers may include DigitalOcean (hosting), OpenRouter (AI routing), fal.ai (creative generation), MailerSend (transactional email), Paddle (payments as independent merchant of record where applicable), PostHog (analytics) and Upstash (rate limiting). Store platforms receive authorized store requests. Data may be processed outside Turkey and the EEA. Transfers require applicable safeguards, including appropriate contractual protections and any required Turkish transfer mechanism; these must be verified before launch. See the DPA for processing of customer-controlled data.
Retention, security and rights
We retain account and workspace data while needed to provide the service, then delete or anonymize it unless billing, dispute or legal duties require retention. Recovery tokens expire after one hour and verification tokens after 24 hours. Passwords are hashed and access is tenant-scoped. No system is risk-free. Request access, correction, deletion, portability, restriction or objection at [email protected]. Withdraw consent without affecting prior lawful processing. EEA users may complain to their supervisory authority. We may verify identity before acting.
KVKK aydınlatma metni
6698 sayılı Kanun kapsamında veri sorumlusu Türkiye'de yerleşik Applixus A.Ş.'dir. Kimlik, iletişim, hesap, işlem güvenliği, müşteri işlem ve finans verileri; hesap açılışı, hizmet sunumu, güvenlik, ödeme ve yasal yükümlülükler için elektronik ortamda toplanır. İşleme şartları sözleşmenin kurulması veya ifası, hukuki yükümlülük ve temel haklara zarar vermeyen meşru menfaat; gerektiğinde ayrı açık rızadır. Veriler yalnızca belirtilen amaçlarla yetkili hizmet sağlayıcılara ve kanunen yetkili makamlara aktarılır. Yurt dışı aktarım için Kanun'un 9. maddesindeki uygun mekanizmalar uygulanmalıdır. Kanun'un 11. maddesindeki bilgi alma, düzeltme, silme, itiraz ve zararın giderilmesi hakları için [email protected] adresine başvurabilirsiniz. Bu aydınlatma, açık rıza metni değildir.
California notice at collection
California residents: categories collected include identifiers, commercial information, internet or network activity and customer-provided content for the purposes described above. We do not sell personal information, share it for cross-context behavioral advertising, or knowingly sell or share information about minors. You may request disclosure, access, correction or deletion and exercise applicable rights without discrimination, including through an authorized agent. Contact [email protected]; identity verification may be required. Retention is based on purpose and legal obligations, not indefinite retention.