Privacy Policy (GDPR & KVKK Compliant)

1. Data Controller & Our Commitment

Dikasto (“We”, “Us”, or “Our”) is committed to protecting the privacy, confidentiality, and security of our users’ personal data. This Privacy Policy is constructed in strict adherence with the European Union General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”), and Turkish Data Protection Law (“KVKK”).

This policy outlines how your information is gathered, processed, transferred, and safeguarded when interacting with the Dikasto website, user accounts, and scoring services.

2. Information We Collect

We believe in strict data minimization. We only collect data essential for delivering our services:

• Account Credentials: Email address, public username, and securely salted/hashed passwords required for user authentication.
• User-Generated Media Records: Scored titles, release years, poster image URLs, subjective criterion scores, personal notes, and preferred display language.
• Technical & Telemetry Data: IP address, device type, operating system, and anonymous performance telemetry via Vercel Analytics for infrastructure monitoring.
• Payment Transaction Tokens: Payment processing is handled exclusively by our authorized Merchant of Record, Paddle. We never collect or store your payment card numbers or CVV codes on Dikasto servers. We only retain transaction reference IDs to grant digital entitlements.

3. Legal Bases & Purposes of Processing

We process your data strictly on recognized legal bases:

• Contractual Performance (GDPR Art. 6(1)(b)): Persisting your customized scoring tables, providing cloud synchronization across sessions, and provisioning digital product licenses.
• Legitimate Interests (GDPR Art. 6(1)(f)): Maintaining server uptime, preventing fraudulent bot automation, enforcing platform security, and analyzing system bottlenecks.
• Statutory Compliance (GDPR Art. 6(1)(c)): Meeting tax, accounting, and lawful law-enforcement requirements.

4. Cookies & Local Storage

Dikasto employs strictly necessary first-party authentication cookies and browser Local Storage to keep you signed in and preserve language/filter preferences. We do not deploy invasive cross-site advertising trackers or sell browsing data to data brokers.

5. Sub-Processors & Data Sharing

We never monetize or rent your personal information. Data is shared exclusively with certified cloud sub-processors vital to our service operation:

• Supabase: Managed PostgreSQL cloud database infrastructure with encryption at rest and in transit.
• Vercel: Global serverless cloud execution and content delivery network.
• Paddle.com: Certified Merchant of Record for global checkout fulfillment, tax reporting, and invoicing.

6. Security & Data Retention

All data transmission between your browser and Dikasto is secured via HTTPS/TLS 1.3 encryption. Your data is retained for the lifetime of your account. If you choose to delete your account, all associated scoring records and credentials are permanently purged from active databases.

7. Your Rights Under GDPR & International Law

Regardless of your geographic location, we extend comprehensive privacy rights:

• Right of Access: Request a complete summary of your stored personal information.
• Right to Rectification: Request correction of inaccurate profile data.
• Right to Erasure (“Right to Be Forgotten”): Request complete deletion of your account and records.
• Right to Data Portability: Export your scoring data in structured, machine-readable formats.
• Right to Withdraw Consent: Revoke any previously granted processing consent at any time.

8. Children's Privacy

Our Service is not directed to individuals under 13 years of age. We do not knowingly solicit or collect personal data from minors. If we discover that a child under 13 has registered without parental verification, we will promptly delete that account.

9. Data Protection Inquiries

To exercise any of your data rights or communicate with our data protection team, please email support@dikasto.com. We respond to all verified inquiries within 30 calendar days.