Privacy Policy

Last updated: February 15, 2026  ·  GDPR KVKK

1. Introduction

Welcome to Masaüstüm ("masaustum.com", "we", "us", "our"). We are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and services.

This policy is prepared in compliance with the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

2. Data Controller

3. What Data We Collect

We collect the following categories of personal data:

3.1 Data You Provide Directly

• Account information: Name, email address, and profile picture (via Google social login)
• Feedback data: Subject and message content when you submit feedback
• Widget configurations: Your personalized widget settings, layouts, and preferences

3.2 Data Collected Automatically

• Usage data: Pages visited, features used, timestamps
• Technical data: Browser type, operating system, screen resolution, IP address
• Cookie data: See our Cookie Policy for details

3.3 Data from Third Parties

• Google OAuth: When you sign in with Google, we receive your name, email, and profile picture as authorized by you

4. Legal Bases for Processing

We process your personal data based on the following legal grounds:

Purpose	Legal Basis (GDPR)	Legal Basis (KVKK)
Providing the service	Art. 6(1)(b) – Contract performance	Art. 5(2)(c) – Contractual necessity
Saving your preferences	Art. 6(1)(a) – Consent	Art. 5(1) – Explicit consent
Analytics & improvement	Art. 6(1)(f) – Legitimate interest	Art. 5(2)(f) – Legitimate interest
Security & fraud prevention	Art. 6(1)(f) – Legitimate interest	Art. 5(2)(f) – Legitimate interest
Legal obligations	Art. 6(1)(c) – Legal obligation	Art. 5(2)(ç) – Legal obligation

5. How We Use Your Data

• To provide and operate the Masaüstüm dashboard service
• To save and sync your widget configurations across devices
• To remember your language and theme preferences
• To authenticate you via social login
• To respond to your feedback and support requests
• To improve our service through analytics
• To ensure security and prevent fraud

6. Data Storage & Transfers

Your data is stored on:

• AWS (Amazon Web Services) servers located in the EU (Frankfurt, eu-central-1)
• DynamoDB for user profiles and widget configurations
• Redis (ElastiCache) for temporary caching

We do not transfer your data outside the European Economic Area (EEA) unless adequate protection measures are in place (e.g., Standard Contractual Clauses).

7. Data Retention

Data Type	Retention Period
Account data	Until account deletion or 2 years of inactivity
Widget configurations	Until account deletion
Cookie consent preferences	12 months, then re-consent required
Analytics data	26 months (anonymized)
Feedback messages	Until resolved + 6 months
Server logs	90 days

8. Your Rights

Under GDPR (Articles 15–22) and KVKK (Article 11), you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at info@masaustum.com. We will respond within 30 days.

9. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage your cookie preferences at any time through the cookie settings on our website.

10. Third-Party Services

We use the following third-party services that may process your data:

Service	Purpose	Privacy Policy
Google Analytics	Website analytics	Link
Google OAuth	User authentication	Link
OpenWeatherMap	Weather widget data	Link
AWS	Cloud infrastructure	Link

11. Children's Privacy

Masaüstüm is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Security

We implement appropriate technical and organizational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit
• Encrypted storage at rest (AWS DynamoDB, S3)
• Access controls and principle of least privilege
• Regular security updates and monitoring

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated "Last updated" date. Continued use of the service after changes constitutes acceptance.

14. Contact & Complaints