KVKK notice

This is an English translation of the Turkish clarification text; the Turkish version prevails. Under Article 10 of the Personal Data Protection Law No. 6698 (“Law”) and the Communiqué on the obligation to inform, Selo Corp, as data controller, informs you about how your personal data is processed within the Testerloop service.

1. Identity of the data controller

• Name: Selo Corp
• Email: selocorp@outlook.com

2. Personal data processed

• Identity: display name; Google account name when signing in with Google.
• Contact: email address.
• Customer transactions: plan and subscription information, credit movements, watchlist, saved searches, test requests and participations, test-squad participation (app name, test link, proof questions and normalised answers, daily check-ins, points), feedback, notifications, applications to us.
• In-squad contact: your Google Play account email, shared with the members of your test squad only if you give explicit consent.
• Transaction security: salted hash of the IP address and browser information in consent records, rate-limit counters, bot-protection signals, server logs.
• Marketing: email preference for product news, only if you give explicit consent.
• Data made public in stores: developer names published on the App Store and Google Play.

No special categories of personal data are processed. Card details never reach Testerloop.

3. Purposes

• Running memberships and providing the service (radar, watchlist, alerts, testing community);
• Managing subscriptions, credits and invoicing;
• Sending the service emails you requested;
• Information security, prevention of abuse and fraud, community moderation;
• Meeting legal obligations, resolving applications and protecting rights in possible disputes;
• Communication about product news and offers, if you consented.

4. Legal grounds and method of collection

Data is collected electronically through forms in the service, Google sign-in, notifications from the payment provider and automatically while you use the service. Legal grounds: art. 5/2-c (contract), 5/2-ç (legal obligation), 5/2-d (data made public by the data subject), 5/2-e (establishing, exercising or protecting a right), 5/2-f (legitimate interest, provided your fundamental rights are not harmed) and art. 5/1 (explicit consent, only for product news emails — optional and withdrawable at any time).

5. Recipients and purposes of transfer

Data is transferred, limited to the purposes above, to processors that provide the service’s infrastructure: Supabase Inc. (Database, authentication and file storage); Vercel Inc. (Application hosting and delivery); Lemon Squeezy LLC (Merchant of record: payments, invoicing, tax); Resend Inc. (Transactional email delivery); Cloudflare Inc. (Bot protection (Turnstile)); Google LLC (Optional “Sign in with Google”); Google Ireland Ltd. / Google LLC (AdSense) (Ads on the free plan, only with your cookie consent (independent controller)); GitHub Inc. (Scheduled data collection jobs (no user data)). It may be disclosed to authorised public institutions when the law requires. In community features your display name and reputation are visible to other users; owners of tests you join see your display name, check-in count and feedback. In a test squad, members see each other’s display name, app, test link, points and daily progress. Your Google Play email is shown only with your explicit consent (art. 5/1), only to the members of your squad, only after it locks and only so they can add you to their closed tests; it is deleted 30 days after the squad ends. Otherwise your email is never shared with other users.

6. Transfers abroad

Because some processors are located abroad (EU and USA), personal data is transferred abroad under Article 9 of the Law by signing the standard contracts announced by the Board; the standard contracts are notified to the Board within five business days of signature.

7. Retention

Data is kept for as long as the purpose requires and the statutory limitation and retention periods last, then deleted or destroyed. See “Retention” in the Privacy Policy.

8. Your rights under Article 11

You may apply to the controller to learn whether your data is processed and request information; learn the purpose and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request notification of those operations to recipients; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

9. How to apply

Apply through the form in Settings → Privacy & data after signing in with your registered email, or by email from the address registered with us to selocorp@outlook.com. Include your name, email and a clear description of the request. Applications are concluded within thirty days free of charge; if the action incurs an additional cost, the fee in the Board’s tariff may be charged. If your application is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board under Article 14.

More: Data requests