Privacy Policy

Karobyte Teknoloji Çözümleri, Cumhuriyet Mah. Kaynak Sok., 34290 Küçükçekmece/İstanbul, Türkiye.

Data protection requests: info@karobyte.com

ACCOUNT: username, e-mail address, display name, an irreversible hash of your password, two-step verification status.

PROFILE (optional, if you enter it): biography, profile and cover image, location, website, phone, date of birth, digital business card fields.

CONTENT: the messages you send, the files you upload, the spreadsheets and documents you create, polls, support tickets.

SESSION AND DEVICE: IP address, browser user agent, a device identifier stored in your browser, sign-in times. These exist for session security and the "my devices" screen.

ACTIVITY RECORDS: security-relevant actions on your account and in workspaces you administer (sign-in, permission change, subscription change).

PAYMENT: your card details NEVER REACH US. Payment is taken by Paddle.com Market Ltd. as Merchant of Record; we keep only the subscription status, the amount and the record that payment occurred.

PERFORMANCE OF A CONTRACT (art.6(1)(b)): creating the account, providing the service, running the subscription, giving support.

LEGAL OBLIGATION (art.6(1)(c)): keeping invoicing and accounting records.

LEGITIMATE INTERESTS (art.6(1)(f)): security, preventing abuse, keeping the service running, activity records. We balanced that interest against your rights and you may object.

CONSENT (art.6(1)(a)): only for optional notifications and marketing messages. You can withdraw it at any time.

WE SHOW ADVERTS in the social area, and on the free plan sponsored messages may be delivered to your inbox. This section explains what that means and what it does NOT involve.

NO TARGETING. Which advert you see is decided by its placement, budget and priority — not by who you are. We do not infer interests, build segments, or profile your behaviour.

NO THIRD-PARTY AD NETWORK. Adverts are served from our own infrastructure; the site carries no third-party analytics, ad pixel, heat map or social media tracker. We do not sell your personal data to anyone.

WHAT WE KEEP: a counter of how many times you were shown a given campaign on a given day, so the same advert is not repeated endlessly. That record is deleted automatically after 2 days. Impressions and clicks are reported to the advertiser in aggregate; who clicked is not disclosed.

SPONSORED MESSAGES: when one is delivered, a delivery record is kept so the same message is not sent to you twice. You can TURN THESE OFF under Settings → Privacy; once off, you receive no further sponsored messages.

LEGAL BASIS: legitimate interests (art.6(1)(f)) for the frequency cap and the delivery record — both serve to limit what is shown. You may object to sponsored messages at any time under art.21; switching them off is how that objection is exercised.

Whether a plan is advert-free is stated on that plan's card. This policy describes what we process; what is shown on which plan belongs to the pricing page.

The cookies and browser storage we use are functional only: keeping you signed in, your language and theme preference, the device identifier. The service does not work without them.

No decision producing legal effects concerning you is taken by automated means or profiling.

Paddle.com Market Ltd. — payment and invoicing. As Merchant of Record it is also a controller in its own right; its privacy policy: https://www.paddle.com/legal/privacy

Our hosting provider — servers and file storage are in Almanya (AB). The provider does not access your data; it supplies the infrastructure.

Competent authorities where the law requires it. When such a request arrives we tell you, unless the law forbids it.

Nobody else. E-mail is sent from our own server, so no data is passed to a third-party mail service.

Your core data is processed and stored in Almanya (AB).

Paddle.com Market Ltd. may process payment data outside the EU, under its own standard contractual clauses and supplementary safeguards.

ACCOUNT AND CONTENT: while your account is open. When you close it, content is deleted within 30 days — a window that exists so an accidental closure can be undone.

ACTIVITY RECORDS: kept for a period after closure for security investigations.

INVOICING AND ACCOUNTING RECORDS: for the period the law requires (typically 10 years). A deletion request cannot cover these, because a legal obligation applies.

Content you added to a workspace stays there after you leave: the organisational record belongs to that workspace's owner.

You have the rights of ACCESS (art.15), RECTIFICATION (art.16), ERASURE (art.17), RESTRICTION (art.18), PORTABILITY (art.20) and OBJECTION (art.21).

Where processing rests on consent you may withdraw it at any time; withdrawal does not affect processing before it.

Send requests to info@karobyte.com. We answer within one month at the latest.

If our answer does not satisfy you, you have the right to complain to the data protection supervisory authority in your country.

Data is protected with TLS in transit and mutual TLS between services. Passwords are hashed irreversibly. Access rights are kept minimal and administrative actions are recorded.

In the event of a personal data breach we notify you and the supervisory authority in line with GDPR arts.33–34 where the risk requires it.

The service is not designed for anyone under 16. If we learn we are processing the data of someone under 16, we delete it.