Privacy notice — GDPR and KVKK
5 November 2026
Operator and roles
Operator: Mücahit Güneş, Çitliköy, Maden, Elazığ, Türkiye; gunesmucahid@gmail.com. Controller for accounts and service security; processor on customer instructions for personal data in customer product and supplier content. This notice does not certify an EU representative appointment or completed DPAs and transfer safeguards.
Data and sources
You or the inviting organisation provide names, email and business contacts. We process password hashes, encrypted MFA secrets, sessions, invitations, audits and rights requests. Uploaded documents may contain employee/supplier details. Infrastructure can process IP addresses and access logs. Rate limiting uses a short-lived HMAC pseudonym instead of sending raw IPs; this is not anonymous data. Do not upload sensitive data, identity documents or consumer personal data.
Purposes and legal bases
Accounts and service: GDPR 6(1)(b), KVKK 5(2)(c) where applicable. Business-user accounts, security and abuse prevention: balanced legitimate interests, GDPR 6(1)(f), KVKK 5(2)(f). Specific legal duties: GDPR 6(1)(c), KVKK 5(2)(ç). Customers determine the basis for their content. Required account data is needed for service; telephone and AI are optional. No marketing processing or solely automated decisions with legal or similarly significant effects.
Public passports and cookies
Product and required manufacturer contacts may be public; use business contacts. No consumer profiles or advertising trackers; aggregate scan counts and infrastructure access logs may be processed. Essential origopass_session cookies last 7 days; pending-MFA cookies 5 minutes. Adding consumer personal data to passports is outside the service scope.
Retention
Account data remains during active use. Following verified closure, the deletion target for unnecessary data is 30 days; shared records, legal duties and holds require review. Daily cleanup removes expired sessions, used/revoked/expired links after a 24-hour grace period, and import copies after 30 days, subject to the next daily run. Destruction records remain at least 3 years. DPPs follow product law and lifecycle requirements, not a blanket indefinite term. Application backups target 30 days; provider periods differ. Automation in this revision is not active until production enablement.
Recipients and transfers
Recipients include authorised organisation users, visitors for public fields, authorities where necessary, and DigitalOcean application hosting (Frankfurt, Germany), Vercel Blob document storage and Vercel fallback deployments, Neon database, Resend transactional mail and GitHub Actions encrypted backups. SMTP/S3, Upstash, Sentry and Anthropic require configuration and provider review. The operator’s Gmail contact mailbox is a separate recipient. Vercel operates internationally; Resend stores customer data in the US. The Neon database is in Ohio, USA (account checked 21 October 2026). Support/backup access countries and valid transfer safeguards remain unverified. EU SCCs/DPAs do not automatically satisfy KVKK Article 9; blanket consent does not justify routine cloud transfers. Contact us for safeguard details and copies.
Rights and requests
Contact gunesmucahid@gmail.com for access, correction, erasure, restriction, objection and portability under KVKK 11 and GDPR 15–22 where applicable; consent may be withdrawn prospectively where used. Account security provides account download and erasure requests; email us for complete requests. Identity checks are proportionate; never send passwords or MFA codes. KVKK replies within 30 days; GDPR within one month, with lawful extensions explained. You may complain to the KVKK Board or competent EU authority. We assist the relevant controller for customer-controlled data.