Privacy Notice for Platform Users

1. Controller and Contact

For personal data relating to Intsell platform users, the controller is Yılmaz Kok, the provider of Intsell ("Intsell"). Questions and data-subject requests may be sent to info@intsell.app.

For an optional customer name or note entered by a store into a selection, the relevant store is the controller and Intsell processes that data on the store's documented instructions as processor.

2. Scope and Data Subjects

This notice applies to store-account owners, invited store staff, people who contact Intsell for support or security matters, and people who start the account-creation process.

Customers do not create an Intsell account and there is no required field for a customer's email address or telephone number. Processing of optional customer names or notes is addressed separately under the store's controller responsibility.

3. Personal Data We Process

Identity and contact data: name, business email address, store name, and store WhatsApp number. Account and authorization data: user identifier, staff role, verification state, session and access records. Transaction data: store settings, uploaded product images, selection content, publication and service events. Legal records: terms version and document-integrity hash, acceptance time, language preference, and evidence that this notice was delivered.

Passwords are not retained by Intsell in plain text; they are protected using one-way hashing by the authentication provider. Special-category data, card data, identity numbers, and unnecessary contact details must not be entered into free-text fields.

4. Purposes and Legal Bases

Personal data is processed to create and verify accounts, manage store and staff permissions, provide the selection service, respond to requests, secure the platform, prevent abuse, monitor service continuity, and retain evidence of the service contract.

Depending on the processing activity, the legal bases are steps requested before entering into a contract or performance of a contract, compliance with legal obligations, establishment or exercise of legal claims, and legitimate interests that do not override the rights and freedoms of the data subject. Intsell does not seek marketing consent and does not send promotional communications.

5. Collection Methods

Data is collected electronically through account-creation and store-setup forms, user and store settings, platform transactions, support correspondence, security records, and technical records generated by service providers. Delivery of this notice is separate from acceptance of the Terms.

6. Recipients and International Transfers

Where necessary to provide the service, data may be disclosed to Vercel for hosting and server functions, Supabase for authentication, database and storage, and Resend for verification and operational email. Data is disclosed to public authorities only where required by law or a valid binding request.

These providers may operate infrastructure or support services outside Turkey. International transfers are limited to what is necessary to provide the service and are managed with regard to KVKK Article 9 and, where applicable, GDPR Chapter V. Current providers are listed on the Subprocessors page.

7. Retention

Unverified account records are retained for 30 days; security and abuse records for up to 90 days; and evidence of terms acceptance and notice delivery for ten years after the legal relationship ends. Active-account data is retained for the service relationship, and account content is normally processed for deletion within 30 days after a verified deletion request.

When a retention period ends, data is deleted, destroyed, or anonymized subject to applicable technical and legal obligations. Further details appear in the Retention and Account Deletion Policy.

8. Rights and Requests

Subject to applicable KVKK and GDPR provisions, you may request confirmation and access, correction, deletion, restriction, information about recipients, objection to certain processing, data portability where applicable, and review of a decision based solely on automated processing. You may also seek compensation where unlawful processing causes damage.

A request should state your name, account email, the scope of the request, and sufficient information to verify identity. Requests may be sent to info@intsell.app. Intsell responds within the period required by applicable law, normally no later than 30 days under KVKK or one month under GDPR.

9. Updates

This notice may be updated when processing activities or applicable law change. Material changes are communicated through an appropriate channel before taking effect; the current version and effective date are published on this page.