Privacy: what data is stored, KVKK/GDPR
Which personal data Polpo Desk stores, which it never stores, how long it keeps it, and how to exercise your KVKK/GDPR rights.
Last updated:
Polpo Desk is designed to work with the minimum data needed to provide the service. This article summarizes which data is stored and what your rights are. The binding text is the Privacy Policy.
Data controller
The data controller for your personal data is İNFORMAC TEKNOLOJİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ (MERKEZ MAH. FİRUZE SK. S OFİS S OFİS NO: 5 F, Kağıthane / İstanbul, Türkiye). Your data is processed in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR). Contact: [email protected]
Data we never store
The content of remote sessions is never stored on our servers:
- the screen image and video stream,
- keyboard and mouse control,
- chat messages,
- transferred files and clipboard content.
This content is transmitted end-to-end encrypted (WebRTC DTLS-SRTP) only between the parties to the connection. No session recording (screen recording) is kept on the server.
Data we store
| Data | Examples | Why |
|---|---|---|
| Account data | Email, name, display name, password hash, profile photo, language preference | Sign-in, authentication, introducing you in the approval window, sending emails in your language |
| Organization and plan | Organization name, plan, user seats | Managing limits and the subscription |
| Billing and orders | Billing details, orders, invoices | Payments and legal obligations |
| Device information | Connection ID, device name, operating system, last seen time, a small preview of the desktop wallpaper (screen content isn't included) | Making the device easy to recognize in device lists |
| Address book | Saved devices, aliases, groups, tags, favorites | Letting operators organize their devices |
| Remembered passwords | A device's permanent access password, if an operator chose to have it remembered | Connecting to that device without typing the password |
| Session records | Start/end time, duration, operator, device, type, status | Reports and usage limits |
| Audit records | Action, time, user, IP address | Security and accountability |
| Support requests | Subject, messages, category and priority | Providing support to you |
If the Discoverable on local network setting is on, the client reports its local (private) IP addresses and computer name to the server so that operators on the same network can find the device.
How your data is protected
- Account data such as email addresses, names, billing details, support messages and the email and IP addresses in audit records is stored encrypted in the database.
- Account passwords and permanent access passwords are kept only as one-way hashes; nobody can read them back.
- Permanent access passwords that an operator chose to have remembered are stored encrypted on the server and are never sent back to the browser or app.
- Access to data is limited to authorized personnel.
For technical details, see How Polpo Desk keeps you secure.
Cookies
We only use the cookies and browser storage needed for the service to work: the sign-in token, your language preference and your theme preference. No third-party advertising or tracking cookies are used.
International transfers
Cloudflare is used for content delivery and connection infrastructure (CDN and TURN relay services). As a result, some technical data may be processed on servers outside Türkiye. These transfers are carried out with the safeguards required by KVKK and the GDPR. Session content that passes through a relay server also remains end-to-end encrypted.
Retention periods
- Your data is kept only for as long as the purpose of processing requires and for the statutory retention periods.
- When your account is deleted, your data is deleted or anonymized unless legal obligations require otherwise.
- Invoices and payment records are kept for 10 years as required by the Turkish Commercial Code and Tax Procedure Law.
- If you are a team member of an organization, past session and audit records belong to your organization; they may remain in its reports until the organization account is deleted.
Your rights
Under Article 11 of KVKK and the GDPR, you have the right to:
- find out whether your data is processed and access it,
- request that it be corrected or deleted,
- object to processing and restrict processing,
- request the portability of your data,
- withdraw any consent you have given and lodge a complaint with a supervisory authority.
To exercise these rights, write to [email protected].
Deleting your account and data
From the email address registered to your account, send an email to [email protected] with the subject "Account deletion request". Once we have confirmed that the request comes from you, your account and the related data are deleted within 30 days at the latest. Step-by-step guide: Delete your account and data.