Kumpix Privacy Policy and KVKK Privacy Notice
Effective date: October 16, 2026
This English version is provided for convenience; in case of any discrepancy, the Turkish version prevails.
This notice has been prepared under Turkish Personal Data Protection Law No. 6698 ("KVKK") and the European Union General Data Protection Regulation ("GDPR") to explain for which purposes and on which legal grounds your personal data is processed in connection with the Kumpix desktop application, the kumpix.com website, the account portal and the related cloud services (the "Service"), to whom it is transferred, and your rights regarding this data.
1. Data controller
- Data controller: Oğuzhan ÇART (Kumpix), sole proprietorship
- Address: Cebeci Mahallesi, 2516. Sokak, Sultangazi / İstanbul, Türkiye
- Phone: +90 537 250 38 18
- Email: info@kumpix.com
2. Personal data processed, purposes and legal grounds
Data category | Purpose of processing | Legal ground (KVKK Art. 5(2)) |
Identity and contact: email address | Account creation, sign-in, verification and password reset, service notifications | Formation and performance of a contract (c) |
Security: one-way hash of the password (scrypt), session records, IP address | Account security, prevention of abuse and unauthorized access | Legitimate interest of the data controller (f), legal obligation (ç) |
Customer transactions: plan, trial and subscription status, subscription ID at the payment provider | Running subscription, license and payment processes | Performance of a contract (c), legal obligation (ç) |
Device: computer ID (a one-way hash derived from hardware information) and computer name | Enforcing the 3-computer license per account | Performance of a contract (c) |
Content: designs you save to the cloud, customer links, orders, your stone price table | Providing the Service | Performance of a contract (c) |
AI input: the prompts you write and the photos you attach | Generating the model you request | Performance of a contract (c) |
The name and address required for invoicing are entered directly with Polar during payment; your card details never reach Kumpix and are not stored by Kumpix. Designs you draw in the desktop application are kept only on your own computer; only sign-in, license renewal and the operations you start (AI requests, customer links) are sent to the cloud.
Data about your customers: The name and notes your customer enters through a customer approval link are processed on your instructions and on your behalf. For this data, you are the data controller and Kumpix is the data processor. Informing your customers and, where required, obtaining their consent is your responsibility.
3. How personal data is collected
Your personal data is collected electronically and partly by automated means through the sign-up and sign-in forms, the desktop application, the account portal, customer approval links and subscription notifications sent by the payment provider.
4. Transfer of personal data
Your personal data is transferred to the following service providers only to the extent necessary to provide the Service:
Recipient | Purpose of transfer | Location |
Polar Software Inc. (polar.sh) | Collecting payment as Merchant of Record and issuing receipts | USA |
Hetzner Online GmbH | Hosting the cloud server and database | Germany (EU) |
Vercel Inc. | Hosting the kumpix.com website and the account portal | USA |
Pollinations.ai and the AI model provider in its infrastructure (Google Gemini) | Processing AI requests | EU / USA |
Email delivery service provider | Sending account verification and password reset emails | Country where the service provider is located |
Transfers abroad are carried out under Article 9 of the KVKK by providing one of the appropriate safeguards set out in the law, primarily the standard contracts announced by the Personal Data Protection Board; where this is not possible, they are carried out within the incidental transfer cases regulated in the same article. Unless required by law, your personal data is not sold, rented or shared with third parties for marketing purposes. Data may be transferred to authorized public institutions and organizations upon their lawful request, within the framework of the relevant legislation.
5. Retention period
Account data is kept for as long as your account remains open. When you delete your account, your account, session and computer records and the data stored in the cloud are deleted, and your subscription is canceled. Records that must be kept by law (for example, financial records) are kept for the period required by the relevant legislation and are deleted, destroyed or anonymized at the end of that period.
6. Data security
Kumpix takes the technical and administrative measures required under Article 12 of the KVKK to keep your personal data secure. Passwords are stored with the scrypt algorithm and a per-user salt; session keys and email link codes are stored only as SHA-256 hashes; repeated failed sign-in attempts are temporarily blocked; all connections are encrypted with HTTPS; and desktop licenses are signed with the server's private key.
7. Your rights as a data subject
Under Article 11 of the KVKK and the GDPR, you have the right to learn whether your personal data is processed; to request information about it if it has been processed; to learn the purpose of processing and whether it is used in accordance with that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to request its correction if it is incomplete or inaccurate; to request its deletion or destruction under the conditions of Article 7 of the KVKK, and that these actions be notified to the third parties to whom it was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.
You can delete your account yourself in the application. You can send your other requests to info@kumpix.com from the email address registered to your account. Requests are resolved free of charge within 30 (thirty) days at the latest, depending on their nature. Your right to lodge a complaint with the Personal Data Protection Board is reserved.
8. Cookies
Kumpix does not use cookies for advertising or tracking. Only strictly necessary cookies are used in your browser to keep your session and your interface preferences (theme, language). For details, see the Cookie policy.
9. Changes
This notice may be updated as a result of changes in legislation or in our data processing activities. The current version is always published on this page; material changes are also notified to your registered email address.
Oğuzhan ÇART (Kumpix) · Cebeci Mahallesi, 2516. Sokak, Sultangazi / İstanbul, Türkiye · +90 537 250 38 18 · info@kumpix.com