Privacy Policy

Last updated: April 17, 2026

This Privacy Policy describes how Marsby Teknoloji A.Ş. (“we,” “us,” or the “Company”) handles personal data in connection with our application and related services (together, the “Services” and the “Application”). It applies whenever you:

• install, sign up for, access, or make use of the Application and its features; or
• communicate with us through channels such as customer support, sales outreach, or marketing.

Below, we describe the categories of personal data we gather, why we gather them, how we safeguard and share them, and the rights available to you together with the process for exercising those rights.

---

Quick Overview

The following is a short snapshot of our practices. For fuller information, please consult the detailed sections that follow.

Which categories of personal data are handled? Depending on how you use our Services, which features you access, and the permissions you grant, we may handle the following:

• your first and last name, e-mail, and phone number when you reach out to us;
• your IP address;
• e-mail mailbox data when you grant us access;
• any files, photos, images, videos, audio, documents, contacts, graphics, media, content, or other material you upload, share, or submit through the Application;
• transactional data for any purchases you make;
• (subject to your permission) mobile advertising and analytics identifiers such as IDFA, IDFV, GAID, and identifiers used for Firebase analytics.

Do we handle special-category data? No. We do not process any special-category (sensitive) personal data. Please refrain from uploading content that contains such data.

Why do we handle your data? Mostly to run and improve our Services, to interact with you, to keep our systems secure, to prevent fraud, and to satisfy legal requirements. Some processing requires your explicit consent. All processing relies on a valid legal basis.

When do we pass data to others? Only when needed to operate the Services, respect legal obligations, defend our rights, or block fraud and abuse. Recipients may include vendors, partners, and public authorities, always under appropriate protections and in line with applicable privacy laws.

How is your data protected? Through a combination of organizational and technical safeguards intended to prevent unauthorized access, leakage, tampering, or loss.

What rights do you have? Depending on where you live, you may have rights including access, correction, deletion, restriction, objection, portability, and withdrawal of consent.

How are rights exercised? Just contact us. We will evaluate and act on your request in line with the applicable privacy laws.

---

Table of Contents

1. The Company and Its Role
2. Age Restriction
3. Security: Technical and Organizational Safeguards
4. How We Collect Personal Data and What We Collect
5. Retention of Data
6. Why We Process Your Data and on What Legal Basis
7. Cross-Border and Third-Party Data Sharing
8. Your Rights
9. External Sites, Cookies, and Notifications
10. Reaching Us
11. EEA, UK, and Switzerland Supplement
12. California Supplement

---

1. The Company and Its Role

Any personal data you have shared with us, or that we have obtained from other sources, may be processed by Marsby Teknoloji A.Ş. acting as the “data controller.” Our contact details appear in Section 10.

Our goal is to handle user data in alignment with core privacy principles and with all privacy laws applicable to you, including in particular Türkiye’s Law on the Protection of Personal Data No. 6698 (“PDP Law”) and any other relevant rules.

We aim to comply with this Privacy Policy under the laws of every jurisdiction where we operate. To reflect local rules, we include region-specific supplements. These include additional disclosures under the EU’s General Data Protection Regulation (Regulation 2016/679). Individuals located in the EEA, the UK, or Switzerland should also refer to Section 11. California residents should also consult Section 12.

When we handle personal data as controller, we follow these core principles: (i) lawfulness and good faith; (ii) accuracy and, where necessary, updating; (iii) specific, legitimate, and transparent purposes; (iv) data minimization, i.e., limiting data to what the purpose requires; and (v) retention only for the period required by law or by the processing purpose.

Capitalized terms not defined in this Privacy Policy carry the meaning given in the Terms and Conditions.

2. Age Restriction

Our Application is not intended for children under 16. We do not knowingly collect personal data from individuals in that age group. If you learn that someone under 16 has given us personal data, please let us know by e-mail.

Anyone between 16 and 18 must have the consent of a parent or legal guardian to use our Services.

3. Security: Technical and Organizational Safeguards

We retain processed personal data for the period mandated by law or for as long as processing requires. We are committed to implementing appropriate organizational and technical controls and exercising due care to protect the confidentiality, integrity, and availability of personal data. We take the following measures (among others) against unlawful processing, unauthorized access, unlawful disclosure, alteration, or destruction:

• Anti-virus software. All company computers and servers run up-to-date antivirus protection.
• Firewalls. Data centers and disaster-recovery facilities hosting our servers sit behind regularly patched, software-based firewalls. These next-generation firewalls monitor all staff internet connectivity and filter out viruses and related threats.
• VPN access. Vendors connect to our servers only via SSL-VPN configured on our firewalls. Each vendor receives a separate SSL-VPN identity with access restricted to the systems that vendor needs.
• Least-privilege access. Employee permissions to internal systems are restricted to what the role requires. Changes in duties trigger corresponding permission updates.
• Threat and event management. Events on our servers and firewalls feed into an Information Security Threat and Event Management system, which alerts the responsible staff and enables fast response.
• Encryption. Sensitive data is stored with cryptographic protections and, where required, transmitted over encrypted channels. Keys are kept in secure and segregated locations.
• Logging. Every action on sensitive data is logged securely.
• Multi-factor authentication. Remote access to sensitive data and account creation/registration require at least two factors.
• Penetration testing. Our servers are regularly pen-tested. Any gaps identified are remediated and verified with follow-up tests. The event-management system also performs automated penetration tests, with records kept.
• Information Security Management System (ISMS). ISMS meetings are held internally, and the topics in the control forum are reviewed monthly by the information-technology director and the financial-operations director.
• Training. We deliver regular information-security training to minimize human-error-based incidents.
• Physical security. Paper-based personal data is stored in locked cabinets accessible only by authorized staff. Appropriate physical protections (fire, flood, electrical, theft, etc.) are in place.
• Backups. We back up stored data periodically using cloud-provider backup tools and, where appropriate, our own backup systems, all in line with applicable laws and this Privacy Policy.
• Confidentiality contracts. Staff involved in processing sensitive personal data are under non-disclosure agreements.
• Secure transfer of sensitive data. Where sensitive personal data must be sent by e-mail, we use either encrypted corporate mail or Registered E-mail (KEP).

Should a breach occur despite these controls — for example, as a result of an attack on the Application or on our systems — we will notify affected users promptly and, where required, the relevant supervisory authority, and will take any further necessary steps.

4. How We Collect Personal Data and What We Collect

We may process the following categories of your data for the purposes outlined in this Privacy Policy.

Identity and Contact Data. When you get in touch with us — for example, by e-mail or phone — we may process your name, surname, phone number, e-mail address, and any other contact details and the content of the message. Letters sent by post may also contain additional postal-address information.

Technical Data. When you access or use our Services we may collect:

• Usage data: how you interact with our Services, including the length of your sessions, access times and dates, timestamps, visit data, screen recordings, features used, content viewed, searches run, in-app actions taken, device-event information (including crash reports), and in-app/web purchase history.
• Log data: technical log information generated by your use of our Services (through our products or third-party products) — including internet traffic data, network activity, IP address, device name and information, operating-system version, visit data, (when you use a website) browser type, version, and settings, language preference, time zone, information about your use of the Services, your configuration while using the Service/Application, usage timing, and other usage statistics.
• Device data: the device you use to access our Services, including device name, device ID, model, manufacturer, region information, OS, device identifiers, and hardware model.
• Location data: we may infer your general (approximate) location based on your IP address and device region information.
• Identifiers: a unique user ID and, if you enable notifications, a device token ID.

E-mail Mailbox Data. Where you grant us mailbox access (for example, to let us help organize your inbox), we may access the data below. You can refuse or later disable this permission via your device settings, but you may then lose access to core features:

• mailbox account details: Google user ID, nickname, user name, profile picture, user token, Open ID, phone number, e-mail address;
• content and metadata: messages, subject lines, headers, lists, and related metadata.

We do not store your e-mails on our servers — these operations happen on your own device or your own cloud storage. In addition, we do not use Google Workspace APIs to build, improve, or train generalized AI/ML models.

User Content. We process whatever you provide through the Application: files, documents, images, photos, videos, audio and visual recordings, voice recordings, graphics, media, choices, contact lists, and any other input, record, or content you supply, upload, transmit, create, store, or share.

We may request permission to access your device’s photo library, gallery, or cloud storage so we can deliver features such as identifying similar photos. You can refuse or later disable access, with the same caveat that some functionality may then be unavailable. We do not store contacts, photos, videos, or other media on our servers — the processing happens on your device or your own cloud storage.

Transaction Data. We may collect order details from you, from our marketing vendors, or from payment processors, including the order and payment dates, subscription type, billing cycle, invoice, payment amount, outstanding balance, payment status, and any related transaction identifiers (e.g., billing ID or associated e-mail). We do not collect card numbers or comparable payment credentials, because payment processing is handled by third parties.

Marketing Data. With your permission, we may process Usage Data, IDFA, IDFV, GAID, and identifiers used for Firebase Analytics.

Where this data comes from. We may collect the above data directly from you (via electronic or physical channels), your device, your browser, third-party apps, or third-party sources used to access our Application (such as Apple App Store, Google Play Store, or payment processors such as Paddle), in order to operate the product, satisfy legal obligations, maintain and improve the Services, handle your use of the Services, and allow you to navigate the Services easily.

Important note regarding Google and Gmail APIs. When you use Gmail API services via the Application, we do not access, collect, or retain your personal data. Any access we receive is used only to enable you, as the user, to read, write, modify, or manage your Gmail message bodies (including attachments), metadata, headers, and settings — so we can provide a web e-mail client for composing, sending, reading, and processing messages. Because we do not process that data, we cannot share such Google user data with others. We do not access or process Google user data when you use Google APIs via the Application. Therefore, we cannot use Google user data received via Google APIs for advertising purposes such as retargeting, personalized, or interest-based advertising. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

5. Retention of Data

We keep your data for as long as the purpose of processing requires or for as long as applicable law mandates.

We may continue to keep your personal data after the original purpose has ended if required by other laws or if you have given a separate consent for extended storage.

Where you have consented to extended retention, data will be deleted, destroyed, or anonymized promptly when that period ends or when consent is withdrawn.

In addition, data may be retained past the processing purpose where needed to establish, exercise, or defend our legal rights — until the relevant limitation periods expire (where the GDPR applies, retention on this basis relies on our legitimate interests).

6. Why We Process Your Data and on What Legal Basis

Your personal data is processed by automated or non-automated means for the purposes below, consistent with Articles 5 and 6 of the PDP Law and with applicable law generally. The legal bases are: (i) where legally permitted; (ii) for the formation or performance of a contract with you; (iii) for our legitimate interests, so long as your fundamental rights and freedoms are safeguarded; or (iv) to fulfil our legal obligations.

If you are in the EEA, UK, or Switzerland, please also review Section 11.

(a) Purposes of Processing

We process your personal data for the following purposes, in line with the principles and legal bases described:

• running sales of goods and services;
• managing contracting processes;
• managing company/product/service commitments;
• operating the product;
• creating user accounts;
• carrying out storage and archiving;
• managing communications;
• delivering post-sale support;
• meeting legal obligations;
• conducting and auditing business activities;
• running information-security processes;
• conducting audit/ethics activities;
• ensuring continuity of operations;
• complying with law and protecting individuals’ rights, privacy, and safety;
• responding to authorized institutions, bodies, and organizations;
• preventing crime and other unlawful behavior;
• tracking customer satisfaction;
• tailoring the Services, understanding users and their preferences to improve experience and quality of use.

In addition, with your explicit consent, your Marketing Data may be used for marketing analytics, advertising (including personalized ads), campaigns, and promotions. The GAID is processed based on explicit consent only if your jurisdiction requires this (for example, under the PDP Law or the GDPR).

With your explicit consent, your identity and contact data may also be used to send you marketing communications about new products, services, and applications, and about advertisements and promotions.

These purposes may also be updated based on Company policies and legal obligations, including in particular:

• managing digital subscription and in-app purchase flows;
• managing auto-renewable subscriptions to grant access to content, services, or premium features;
• managing finance and accounting operations;
• strategic planning;
• managing requests and complaints.

(b) Purposes and Corresponding Legal Bases

On top of these, with your explicit consent we may process:

• Marketing Data (consent captured via Apple and/or Google and/or in-app) to run marketing analytics and advertising, campaigns, and promotions — including personalized ads.
• Identity and Contact Data (consent captured at marketing opt-in) to communicate with you about services, products, apps, ads, promotions, and other marketing.

7. Cross-Border and Third-Party Data Sharing

Procedures for transferring personal data are set out in Articles 8 and 9 of the PDP Law. Personal and special-category data belonging to vendors may be transferred to third parties domestically or abroad because we use servers and cloud systems located in other countries.

To ensure safe and compliant cross-border transfers, we rely on:

• Standard Contractual Clauses issued by the Turkish Data Protection Authority under Article 9(4)(c) of the PDP Law.

The following data may be transferred abroad to our service providers on the legal bases noted above (Section 6(b)) and under the applicable Standard Contractual Clauses:

• Technical Data, Identity and Contact Data, Transaction Data, and User Content — for storage and archiving (including cloud and database services) needed for operations.
• E-mail Mailbox Data — for user-account authentication needed for operations.
• Technical Data — for correcting technical specifications, errors, and defects needed for operations.

We may also share your Marketing Data with service providers (including Google, Apple, Facebook SDK, Adjust, and Firebase Analytics, all integrated into our Services) for marketing analytics and advertising, campaigns, and promotions, including personalized advertising.

We may also share personal data with authorized public authorities, institutions, and judicial bodies in order to comply with our legal obligations, on the basis that such sharing is necessary to fulfil a legal obligation.

If you are in the EEA, UK, or Switzerland, please also refer to Section 11. If you are in California, please also refer to Section 12.

8. Your Rights

Under Article 11 of the PDP Law, you may request that we:

• confirm whether we are processing your personal data;
• provide information about that processing;
• tell you the purpose of the processing and whether your data is used in line with that purpose;
• identify the third parties, domestic or foreign, to whom your data has been transferred;
• if the data has been processed incompletely or incorrectly, correct it and notify third parties to which it has been transferred;
• erase, destroy, or anonymize your data when the grounds for processing no longer apply, and notify third parties to which it has been transferred;
• let you object to outcomes adverse to you that result solely from automated analysis;
• compensate you for any damages arising from unlawful processing;
• honor your withdrawal of explicit consent at any time for consent-based processing.

Your request must be clear and understandable, and must specify the rights you wish to exercise. If you are submitting a request concerning someone else’s data, you must be specifically authorized in a documented way. The request must include your identity and address details, along with identity-verification documents.

You can submit such requests to us by e-mail. In line with Article 13 of the PDP Law, we will respond free of charge, within at most thirty (30) days, depending on the nature of the request. If we reject the request, we will provide written or electronic notice of the reasons.

If you are in the EEA, UK, or Switzerland, please also read Section 11. If you are in California, please also read Section 12.

9. External Sites, Cookies, and Notifications

The Application may link to third-party websites or apps whose content we do not control. These destinations may have their own terms and conditions separate from ours. The Company cannot be held responsible for the practices of those third-party sites or apps, nor for third-party sites linking to our Application.

We collect information fairly and lawfully, with your awareness and consent. We also explain why we collect it and how it will be used. You may decline, with the caveat that certain features of our Services may then be unavailable.

If, while using the Application, you provide information via third-party sites or apps, please remember that your obligations and liabilities to those third parties continue to apply, and we are not responsible for their terms, conditions, rules, or policies.

Cookies. Cookies are small text files placed on your browser or device when you visit a web page. They help a website operate efficiently and can offer a more personalized, responsive browsing experience. They contain only information about your visits; they do not access personal files on your device. We may use cookies where necessary for running our Services, improving functionality and performance, and serving content — including ads relevant to your interests — on our or third-party sites. You can delete existing cookies and prevent new ones from being stored through your browser.

Browsers are generally set to accept cookies by default. Cookie management differs from one browser to another, so please consult the help menu of your browser or app for details. See also our Cookie Policy.

Push Notifications. We may send push notifications via our mobile apps or website regarding updates or our Services. You can manage or disable these through your device settings at any time.

10. Reaching Us

If you have questions about this Privacy Policy that are not addressed here, or wish to exercise a right, you may contact us:

• Company name: Marsby Teknoloji A.Ş.
• Address: Ankara, Türkiye
• E-mail: info@themarsby.com

11. EEA, UK, and Switzerland Supplement

Where the GDPR, the UK Data Protection Act, or the Swiss Federal Act on Data Protection applies, please read this supplement alongside the main Privacy Policy above.

Purposes of Processing and Legal Bases

We will only process the following personal data with your consent. You may withdraw consent at any time by contacting us via e-mail or as noted below. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

• Marketing Data (consent captured via Apple and/or Google and/or in-app) for marketing analytics and advertising, campaign, and promotion execution. You can revoke consent via your account settings.
• Identity and Contact Data (consent captured at marketing opt-in) for marketing communications regarding services, products, apps, ads, promotions, and other communications. You can revoke consent by clicking the “unsubscribe” link in messages or by following the instructions in the communication.

Cross-Border Transfers

For transfers outside the EEA, Switzerland, or the UK, we apply:

• Adequacy Decisions issued by the European Commission under Article 45(1) GDPR. See the current list of adequate countries.
• Standard Contractual Clauses (SCCs) and Supplementary Measures. Where no adequacy decision applies, we use the SCCs under Article 46(2)(c) GDPR. We also deploy additional safeguards where needed, such as:
  • encryption of personal data in transit and at rest,
  • data minimization and anonymization where possible,
  • technical access controls to limit third-party access,
  • ongoing Transfer Impact Assessments (TIAs) to monitor local laws.
• Binding Corporate Rules (BCRs) approved by the competent supervisory authority under Article 46(2)(b) and Article 47 GDPR, where applicable.

Data that may be transferred abroad on the legal basis described above, and for the stated purposes, includes:

• Technical Data, Identity and Contact Data, Transaction Data, and User Content — for storage and archiving (cloud and database services) necessary for operations.
• E-mail Mailbox Data — for account authentication necessary for operations.
• Technical Data — for fixing technical specifications, errors, and defects necessary for operations.

We may also transfer Marketing Data to service providers (including Google, Apple, Facebook SDK, Adjust, and Firebase Analytics) for marketing analytics and advertising, campaign, and promotion execution, including personalized ads.

We may also share personal data with authorized public institutions, bodies, and judiciary bodies to meet legal obligations, where necessary to comply with such obligations.

Your Rights Regarding Data Transfers

• You may request a copy of the safeguards we use (such as SCCs or BCRs) by e-mailing us.
• If you think your data was transferred unlawfully, you may complain to your local data-protection authority or to the European Data Protection Supervisor (EDPS).

Your Rights as a Data Subject

Under the GDPR you have:

• Right of Access (Art. 15 GDPR): to request a copy of your personal data and information on how we process it.
• Right to Rectification (Art. 16 GDPR): to correct data you consider inaccurate or complete data you consider incomplete.
• Right to Erasure (Art. 17 GDPR, “right to be forgotten”): to have your data deleted, except where retention is required for legal obligations, public interest, or legal claims.
• Right to Restriction of Processing (Art. 18 GDPR): to have processing restricted under the conditions set by the GDPR.
• Right to Data Portability (Art. 20 GDPR): to receive your data in a structured, commonly used, machine-readable format such as CSV or JSON, or have it transmitted to another provider where technically feasible.
• Right to Object (Art. 21 GDPR): to object to processing based on legitimate interests. Objections to direct marketing stop processing immediately; other objections are assessed against our legitimate interests.
• Automated Decisions and Profiling (Art. 22 GDPR): if a decision affecting you is made solely by automated means (such as AI-driven decisions), you may seek human review, express your views, and contest the decision.
• Right to Withdraw Consent (Art. 7(3) GDPR): where we rely on consent, you can withdraw it at any time. Withdrawal does not affect earlier processing.

You can exercise these rights by sending a request by e-mail. We will respond within one month, as required by the GDPR. For complex requests, we may extend this by up to two additional months, with notice to you.

If you believe your rights have been violated by us or by anyone with whom we have shared your data, you can file a complaint with your local data-protection authority (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) or with another competent supervisory authority. For UK complaints, contact the Information Commissioner’s Office (https://ico.org.uk/). For Switzerland, contact the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/en).

12. California Supplement

Please read this supplement alongside the main Privacy Policy above.

Your Rights

As a California resident you have certain rights, including: to know what personal information we collect, use, disclose, and sell; to request deletion of your personal information; to correct inaccurate personal information; to opt out of the sale or sharing of your personal information; to limit the use and disclosure of sensitive personal information; and to non-discrimination. We do not sell your personal information in the traditional sense, though we may share usage data with third-party service providers for analytics and functionality. We do not process sensitive personal information (see Section 4). To exercise these rights, or to designate an authorized agent to act on your behalf, contact us by e-mail. We will not discriminate against you for exercising your privacy rights.

We may verify your identity before responding to a request, to protect your privacy and security.

Our Services comply with all applicable laws and we maintain systems that honor users’ constitutional right to privacy.

Disclosure of Personal Data Collected

We may collect the following categories of personal data: identifiers (e.g., name, e-mail address, phone number, IP address); information described in California Civil Code Section 1798.80(e) (e.g., name, contact information such as phone number, account name, billing information); inferences drawn from your personal data to build a profile of your preferences (if personalization is an option and you enable it, the inferences are used to personalize services); and network-activity data (how users interact with our apps and websites).

For the full description of what we collect and how, see Section 4. For the purposes of use, see Section 6.

Third-Party Tools Disclosure

We may use tools such as Google, Apple, Facebook SDK, Adjust, and Firebase Analytics to understand app use and improve performance. These tools may collect identifiers and in-app events (see the Marketing Data description in Section 4).

Under California law, using certain analytics and advertising tools may be considered a “sale” or “sharing” of personal information. We do not sell your personal information for money, but we may share it to deliver personalized advertising or to measure marketing analytics.

Before using your information for personalized ads or marketing analytics, we may ask for your permission. California residents may at any time opt out or withdraw permission by changing their privacy settings or by contacting us.

See Section 7 for additional information.

Data Retention

See Section 5 for how long we retain personal data.

Changes to This Privacy Policy

We may update this Privacy Policy over time to reflect changes in our practices, technology, legal requirements, or other factors. When updates are made, we will reflect the revised date at the top of the Policy.

When we make material changes (those significantly affecting your rights or how we handle your data), we will notify you prominently before they take effect. Notice may take the form of an in-app pop-up, an e-mail to the address on your account (if any), or another reasonable method appropriate to the circumstances.

We encourage you to check this Privacy Policy periodically. Your continued use of the Services after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms, unless applicable law requires a different form of acceptance (such as explicit consent for certain changes).