Privacy Policy

1. Who We Are & Our Two Roles

IEMSuite ("we") operates iemsuite.com and the IEMSuite Shopify app. We process personal data under Turkish Law No. 6698 (KVKK), the EU GDPR where applicable, and applicable US state privacy laws.

Controller role: for your account, registration, and usage data, IEMSuite is the data controller. Processor role: for your own customers' data that you bring into the platform (e.g. Shopify orders/customers), you are the controller and we act strictly as your processor (see the DPA clause in our Terms). Contact: [email protected]

2. Data We Collect

Account & registration: name, company, email, phone, country, industry, website, notes you provide.

Business data (yours): inventory, production, order, and customer records you enter or sync from Shopify. This data belongs to you.

Usage & security data: IP address, timestamps, pages/features used, browser info, and audit logs of actions inside your workspace (who did what, when) - kept for security and traceability.

Consent records: which document versions you acknowledged/accepted, when, and from which IP address (KVKK/GDPR proof-of-consent duty).

Demo (Playground): if you try the public demo, your verified email and session start/end times are recorded; the demo workspace itself is automatically deleted after the session expires.

3. Purposes & Legal Bases

• Contract (KVKK m.5/2-c, GDPR 6/1-b): providing the Service, account management, Shopify sync, support.
• Legal obligation (m.5/2-ç, 6/1-c): consent records, invoicing, responding to lawful requests.
• Legitimate interest (m.5/2-f, 6/1-f): security monitoring, fraud/abuse prevention, error tracking, service improvement.
• Explicit consent (m.5/1, 6/1-a): marketing emails only - opt-in, withdrawable anytime, never a condition of service.

4. Third Parties We Actually Use (sub-processors)

We do not sell personal data and we use no advertising or behavioral-analytics trackers. The complete list of service providers that may touch personal data:

• Shopify (Canada/USA) - store synchronization for Shopify-connected workspaces.
• Stripe (USA) - payment processing for web subscriptions (inactive while billing is disabled).
• Sentry (USA) - error monitoring (technical error context; not used for profiling).
• Cloudflare (USA) - DNS/proxy and Turnstile bot protection on the demo entry.
• Oracle Cloud / Coolify - application and database hosting.
• SMTP e-mail provider - transactional e-mail delivery (OTP codes, invites, notices).

Shopify AI commitment: merchant/customer data from Shopify (including derived or anonymized forms) is never used to train or improve any AI/ML system.

5. International Transfers

Some providers above are outside Türkiye/the EEA (primarily the USA). For KVKK, transfers rely on the standard-contract regime in force since July 2024; for GDPR, on the 2021 EU Standard Contractual Clauses with transfer impact assessments. Details and copies of safeguards: [email protected].

6. Retention

Account data: while the account is active, deleted within 30 days after account deletion (unless law requires longer). Registration applications: 12 months. Consent records: retained as long as needed to prove consent. Security/audit logs: up to 24 months. Demo sessions: workspace data hours (auto-purged); the session record (email, duration) is retained for product analytics.

7. Your Rights - KVKK (Türkiye)

Under Article 11 of Law No. 6698 you may: learn whether your data is processed; request information; learn the purpose and whether it is used accordingly; know third-party recipients; request correction, deletion, or destruction; request notification of these to recipients; object to results of purely automated analysis; claim damages for unlawful processing. Apply to [email protected]; we respond within 30 days at the latest. You may complain to the Kişisel Verileri Koruma Kurulu.

8. Your Rights - GDPR (EU/EEA)

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (Articles 15–22). Breaches notifiable to the supervisory authority within 72 hours where required (Article 33). You may lodge a complaint with your national supervisory authority. Note: for data your merchant brought into the platform, direct your request to that merchant (the controller); we will assist them as processor.

9. Your Rights - US State Privacy Laws

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use sensitive data for secondary purposes. If you are a resident of California (CCPA/CPRA) or another US state with a comprehensive privacy law, you may request access, deletion, correction, or portability via [email protected]. We honor such requests regardless of statutory thresholds.

10. Security

TLS in transit, encrypted storage, role-based access control with per-organization isolation, full audit logging of workspace actions, and least-privilege operational access. No system is 100% secure; in the event of a breach we will notify affected users and authorities as required by KVKK and GDPR.

11. Cookies

Only strictly necessary cookies (session/CSRF and a short-lived demo-verification cookie). No advertising or analytics cookies. Details: Cookie Policy.

12. Contact & Complaints

[email protected] - or the Turkish Kişisel Verileri Koruma Kurulu / your EU supervisory authority.