1. Data controller
This is Masufy's ("Masufy", "we") privacy notice under Turkish Personal Data Protection Law No. 6698 ("KVKK") art. 10. Masufy is the data controller for the services offered on masufy.com and app.masufy.com. Contact: destek@masufy.com.
2. Scope
This notice covers visitors of masufy.com and businesses that open a store or site on Masufy ("Merchants"). For the data of a Merchant's own visitors and customers the Merchant is the data controller; Masufy processes that data on the Merchant's behalf as a data processor (see the Terms of Service, data processing annex). Those people should refer to the store's own privacy notice.
3. Personal data we process
- Identity and contact: name, e-mail, phone; with "Sign in with Google", the name, e-mail and profile photo of your Google account.
- Business details: store name, trade name, tax/MERSİS number, address, KEP and ETBİS details.
- Customer transactions: subscription, plan and payment records, support correspondence.
- Transaction security: IP address, session data, panel operation logs (which account changed which content and when), error logs.
- Legal transactions: acceptance record of the Terms of Service (version, time, IP), İYS declaration.
4. Purposes and legal grounds
- Opening your account, running your store, subscription and billing, support: formation and performance of the contract (KVKK art. 5/2-c).
- Tax and accounting records, traffic records under Law No. 5651, requests of competent authorities: legal obligation (art. 5/2-ç).
- Security of the Service, preventing abuse, detecting errors and improving the Service: legitimate interest (art. 5/2-f).
- Establishing, exercising or defending legal claims: art. 5/2-e.
Masufy does not send marketing messages to Merchants; if it does in future, it will ask for your consent separately.
5. How data is collected
Electronically, through the sign-up and setup forms, your use of the panel, Sign in with Google, support correspondence and server logs.
6. Transfers
Within Türkiye: competent public authorities, and our financial and legal advisers, as required by law.
Abroad (KVKK art. 9): the Service runs on the following providers; their servers are outside Türkiye, so data is transferred abroad:
- Supabase — database, authentication and file storage (EU, Frankfurt)
- Vercel — application hosting
- Cloudflare — content delivery and security
- Resend — e-mail delivery
- Sentry — error monitoring
- Upstash — rate limiting against abuse
- Google — authentication, only if you choose Sign in with Google
7. Cookies
masufy.com and the admin panel use only cookies strictly necessary for the Service: session (whether you are signed in), language preference and the selected store in the panel. No analytics or advertising cookies are used. Cookies on Merchants' stores are governed by each store's cookie policy.
8. Retention
- Account and business details: while your account is open; after closure, for the statutory limitation periods.
- Invoices and accounting records: 10 years (Tax Procedure Law, Turkish Commercial Code).
- Operation and traffic logs: 2 years (Law No. 5651), then deleted automatically.
- Terms of Service acceptance records: for the term of the agreement and the limitation period afterwards.
Expired data is deleted, destroyed or anonymised; copies in backups are removed within the backup cycle.
9. Your rights (KVKK art. 11)
You may learn whether your data is processed; request information if so; learn the purpose and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; request correction if incomplete or wrong; request deletion or destruction under KVKK art. 7; request that corrections and deletions be notified to those third parties; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
10. How to apply
Send your request, in line with the Communiqué on the Procedures for Applications to the Data Controller, from the e-mail address registered with Masufy to destek@masufy.com, or by registered e-mail (KEP), secure e-signature or mobile signature. We answer free of charge within 30 days at the latest. If your request is refused or the answer is insufficient, you may complain to the Personal Data Protection Board (KVKK art. 14).
11. Changes
This notice may be updated; the current version is always published on this page.
This English text is a translation for convenience; the Turkish version prevails.