Legal

Privacy Notice (KVKK & GDPR)

Which personal data this website (accounts included), Pengumi Studio's update check and its license and trial system process, why, on what legal basis, and how to exercise your rights.

This notice is given under Article 10 of Turkey's Personal Data Protection Law No. 6698 ("KVKK") and, for visitors in the European Economic Area, Articles 13–14 of the General Data Protection Regulation ("GDPR"). The Turkish version prevails in case of conflict.

1. Data controller

  • Controller: Pengumi Studio
  • Email: pengumibilisim@gmail.com

2. What we collect and how

  • Access logs: When you visit the site, the servers of our hosting and security provider Cloudflare automatically record your IP address, browser and device information, the time of the request and the page requested.
  • Contact data: If you email us at pengumibilisim@gmail.com, we process your name, email address and the content of your message.
  • Update check: When the Pengumi Studio panel opens, it asks our update server (Cloudflare) for the signed release record. Only standard connection data (IP address, time, client information) is sent; audio, transcripts, project files and usage data are never sent. The check can be turned off in the panel's Settings.
  • License, trial and free tier: The app sends our license server, which stores: your computer's machine code (a salted SHA-256 hash of the Windows MachineGuid or Mac IOPlatformUUID; the raw value is never sent), a hash of your license key, plan and period, activation times, the trial start time and time-zone offset, your IP address when a trial starts, daily active use during the trial, and the monthly number of analyses on the free tier. If you buy a license we may note your name and email to send you the key. Audio, transcripts and project content are never sent.
  • Account and downloads: When you create an account we process your username, name, email address, (if you write one) what you will use the app for, when you accepted this notice, your account status (pending/approved/rejected/suspended), when it was decided and the admin's note. Your password is stored only as a one-way hash (bcrypt); we cannot see it. To prevent abuse during sign-up, sign-in and download, your IP address is kept in short-lived counters, and the date and platform of each installer you fetch is recorded. Your session lives only in your browser (localStorage); no cookie is used.
  • The site uses no advertising, analytics or tracking cookies or tools; only technologies strictly necessary for running it securely. See the Cookie Policy.

3. Purposes and legal bases

  • Running and securing the site and the update service, preventing abuse and attacks (access logs, update requests): our legitimate interest — KVKK Art. 5/2-(f), GDPR Art. 6(1)(f).
  • Checking licenses, enforcing trial and free-tier limits, keeping a license to one computer and preventing abuse such as repeated trials from one IP (license data): performance of a contract — KVKK Art. 5/2-(c), GDPR Art. 6(1)(b); legitimate interest — KVKK Art. 5/2-(f), GDPR Art. 6(1)(f).
  • Creating, reviewing and approving your account, signing you in, giving installers only to approved accounts and answering account requests (account and download data): performance of a contract — KVKK Art. 5/2-(c), GDPR Art. 6(1)(b); preventing abuse (IP counters, download log): legitimate interest — KVKK Art. 5/2-(f), GDPR Art. 6(1)(f).
  • Answering your requests and questions (contact data): steps taken at your request / legitimate interest — KVKK Art. 5/2-(c) and (f), GDPR Art. 6(1)(b) and (f).
  • Complying with legal obligations and establishing or defending legal claims — KVKK Art. 5/2-(ç) and (e), GDPR Art. 6(1)(c) and (f).

4. Recipients and international transfers

  • Access logs and update requests are processed on the infrastructure of our hosting provider Cloudflare, Inc. (United States). This is an international transfer, made on the appropriate safeguards provided by KVKK Art. 9 and, for EEA visitors, GDPR Chapter V (standard contractual clauses / EU–US Data Privacy Framework).
  • License, account and download data are kept on the infrastructure of Supabase Inc. (United States), in its Frankfurt, Germany data centre; the transfer relies on KVKK Art. 9.
  • Email correspondence is stored by our email provider (Google LLC, United States) on the same basis.
  • We do not sell your data, use it for marketing, or share it with anyone except authorities entitled by law.

5. Retention

  • Access logs: as long as set out in Cloudflare's terms; we keep no separate copy.
  • License data: for the license period and at most 2 years after it ends; trial and free-tier records (machine code, IP, usage counters) at most 2 years after last use. Then deleted or anonymised.
  • Account data: while your account exists. You can delete it at any time from My account; deleting removes the account, the password hash and the download log at once. Rejected accounts are deleted at most 1 year after the decision. IP counters are kept at most 2 days.
  • Contact data: at most 2 years after your request is closed, or longer if a dispute or legal obligation requires it; then deleted or anonymised.

6. Your rights You may ask whether your data is processed, obtain information and a copy, learn the purpose and recipients, have inaccurate data corrected, have data erased, object to processing based on legitimate interest, object to a decision made solely by automated means, and claim compensation for unlawful processing (KVKK Art. 11; GDPR Arts. 15–22, including restriction and portability where applicable).

7. How to apply

  • Write to us at our postal or KEP address (if listed above), or from an email address you have previously given us to pengumibilisim@gmail.com. We answer free of charge within 30 days.
  • You may complain to Turkey's Personal Data Protection Authority (KVKK) or, in the EEA, to the supervisory authority where you live.

Last updated: 2026-11-01