Privacy Policy and KVKK Notice

1. Controller and processor

For the data you give us when you create a Hubzone account and use the service (account, sign-in and usage data), the controller is Stokzone Teknoloji Limited Şirketi ("Hubzone", "we").

For the records that you or your team enter into your Hubzone workspace (customers, contacts, companies, deals, e-mails and similar), you (the organization that opened the workspace) are the controller; we host that data only on your behalf and on your instructions, as your processor. You can ask for a data processing agreement.

Company: Stokzone Teknoloji Limited Şirketi

Address: Esentepe Mah. Büyükdere Cad. Levent 199 No: 199 İç Kapı No: 6, Şişli / İstanbul

Tax office / No: Zincirlikuyu / 7811172592

Trade registry no: 1158703 (İstanbul Ticaret Sicili Müdürlüğü)

MERSIS: 0781117259200001

Phone: 0850 840 15 46

E-mail: [email protected]

2. Data we process

• Account and identity data: name, e-mail address, password (stored only as a one-way hash), two-step verification data (stored encrypted), and, if you sign in with Google, the name, e-mail address and profile picture Google gives us.
• Usage and security records: sign-in times, IP address, browser information, security events and audit logs.
• Workspace content: the records, notes, files, e-mails and meeting records that you or your team put into Hubzone. This content is yours.
• Communications: support and feedback messages you send us.
• Payment: Hubzone is free during the launch period and we do not collect payment card data. This notice will be updated when paid plans start.

3. Purposes and legal bases

• To create your account, verify your identity and provide the service (performance of a contract).
• To send account, security and system messages by e-mail (performance of a contract, legitimate interest).
• To keep the service secure, prevent abuse and unauthorized access and fix errors (legitimate interest, legal obligation).
• To answer support requests and improve the product (legitimate interest).
• To meet legal obligations and requests of competent authorities (legal obligation).

4. Cookies

Hubzone uses only the cookies the service needs to work: the session cookie that keeps you signed in and security cookies. We do not use third-party advertising or tracking cookies. The developer portal stores your light/dark theme choice in your browser.

5. Sharing and service providers

We use the following providers to run the service and share your data with them only for that purpose and to that extent:

• Hosting: Hostinger (server infrastructure; the data centre is in Germany).
• Domain, DNS, network security, human verification and the private file and backup store (Cloudflare R2): Cloudflare.
• E-mail delivery and Google sign-in: Google (Google Workspace, Google account).
• Optional integrations (calendar, e-mail, meetings): the provider you choose to connect (for example Google, Microsoft, Zoom), only if you connect it.

5A. Google user data (calendar and Google Meet)

If you choose to connect your Google account (Settings > Integrations), Hubzone asks for three permissions: to view and edit events in your calendars (calendar.events), to read information about your Google Meet conferences, and to create, edit and view the Google Meet conferences the app creates for you. Nothing is requested until you press Connect, and you can disconnect at any time.

We use these permissions only to make the Meet room and the calendar event of a meeting you create in Hubzone, to show the join link and, if you switch it on, to read the recording, transcript and notes of that meeting so they can be added to the meeting record. We do not read other events or conferences for any other purpose.

How the data is handled: the access key Google gives us is stored encrypted and used only for these actions on your behalf. We do not sell Google user data, do not use it for advertising, do not give it to data brokers and do not use it to train generalized AI models. People do not read it except with your permission, to investigate abuse, or where the law requires.

Hubzone's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting: disconnect in Settings > Integrations (the access key is deleted at once), or remove Hubzone at https://myaccount.google.com/permissions. The data of meeting records stays in your workspace until you delete it.

6. Transfers abroad

Your data is hosted in a data centre in Germany, files and backups are kept in Cloudflare's private store, and some of our providers are outside Türkiye. Your personal data may therefore be transferred abroad, limited to the purposes above and in line with the conditions of article 9 of the KVKK. We do not sell your data, share it for advertising, or use your customer data to train AI models.

7. Retention

Account data is kept while your account is open. After you delete your account, data is deleted within a reasonable time; legal retention duties and the rotation of backups (14 days on the server, at most 30 days off the server) remain. You can find how to delete your account and workspaces on the /account-deletion page. Security and audit records are kept for as long as needed for security and as the law requires.

8. Security

Your data is encrypted in transit (TLS). Passwords are stored as one-way hashes, two-step verification is required, workspaces are isolated from each other at database level and access is logged. No system is perfectly secure; if a breach occurs, we notify the people concerned and the authority within the legal periods.

9. Your rights (KVKK art. 11)

• Learn whether your personal data is processed and ask for information about it.
• Learn the purpose of processing and whether it is used accordingly.
• Know the third parties, at home or abroad, that receive your data.
• Ask for correction of incomplete or wrong data.
• Ask for deletion or destruction under the conditions of the law, and for this to be told to the third parties that received the data.
• Object to a result against you that comes only from automated analysis.
• Ask for compensation if you suffer damage from unlawful processing.

10. How to apply

Send requests about your rights to [email protected]. We answer within thirty days at most, as the KVKK and related rules require. For requests about workspace content you can also contact the workspace owner, who is the controller.

Your right to complain to the Personal Data Protection Authority remains.

11. Changes

We update this notice when needed and announce important changes by e-mail to your account address and inside the app.