Dropvia KVKK Privacy Notice

1. Data controller and contact

Under Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller is Emre Çakıroğlu, the individual developer providing Dropvia under the TrimCode name. Address: Mecidiyeköy Mah., Esentepe Cad., Hafız Ata Çık. Sok., Nuri Bey Apt. No:10 D:20, 34387 Şişli / Istanbul, Türkiye. For privacy and KVKK requests, contact support@dropvia.app.

2. Categories of personal data processed

• Identity and contact: first name, last name, display name, email, phone number, and country code.
• Account and customer transactions: Dropvia ID, account and verification status, language and time zone, Dropvia contacts, linked devices, Free/Plus plan, and store subscription and transaction records. Dropvia does not receive full payment-card details.
• Security: IP address, session and device tokens, public key, device/OS/app version, connection state, login, error, security, and notification records.
• Transfer metadata: file name, extension, size, hash, sender/recipient, devices, time, status, errors, and progress. Encrypted file content is not stored in the Dropvia database; it is carried temporarily through a live relay to perform the transfer.
• Legal and support: data-subject requests, support messages, complaints, and correspondence concerning security, abuse, and copyright reports.

Dropvia does not ask you to provide special-category personal data. If a selected file contains such data, you are responsible for having a valid legal basis for the transfer; file content is processed as an end-to-end encrypted live transfer.

3. Purposes and legal grounds

Data is processed to create and verify accounts, pair devices, manage contacts and transfer requests, perform file transfers, display history, deliver notifications, administer Free/Plus entitlements and store subscriptions, maintain information security, prevent fraud and abuse, provide support, resolve disputes, and comply with law. Under Article 5(2) of the KVKK, processing relies as applicable on formation or performance of a contract, legal obligation, establishment, exercise, or defense of rights, and legitimate interests that do not prejudice fundamental rights. Separate consent is obtained for optional permissions or processing where legally required.

4. Collection method

Data is collected electronically, by fully or partly automated means, directly from you through registration, account, settings, and support screens; from the files and recipients you select; from device, app, and server security records; and from store, notification, and subscription providers.

5. Recipients and international transfers

Personal data may be transferred, only as necessary for the stated purpose, to İBT İstanbul Bilgi Teknolojileri Tic. Ltd. Şti., which operates the main server in Türkiye’s Black Sea region and backup infrastructure in Istanbul; to the SMTP delivery infrastructure for transactional emails and Google Gmail for support or legal messages; to Google Firebase Cloud Messaging and Apple Push Notification service (APNs) for notification delivery; to Apple App Store, Google Play, Microsoft Store, and Huawei AppGallery infrastructure for distribution, licensing, and subscription verification; to support or legal-service providers; and to legally authorized public authorities. If use of these providers requires processing outside Türkiye, no international transfer will take place until a valid transfer mechanism under Article 9 of the KVKK has been established. Only data necessary for the relevant purpose is shared.

6. Retention and disposal

• File content is not stored in the Dropvia database; no permanent file copy remains after the live transfer ends.
• Transfer, contact, and device-pairing requests and related notifications are expired and cleaned within a maximum 7-day operational cycle.
• User-visible transfer history is limited to the latest 20 records and no more than 7 days per record. ‘Clear History’ in the app immediately deletes the relevant user’s active SQL history rows.
• Device heartbeat records are retained for 7 days; login and standard security logs for 30 days. Verification codes are removed on expiry or within 7 days at the latest; revoked or expired authentication tokens are cleaned after 30 days.
• Deleted data in daily incremental and weekly full backups is restricted from ordinary use and is removed when the provider’s verified rotation/destruction cycle completes; the exact maximum has not yet been confirmed in writing by the provider.

Account, device, subscription, support, and legal records are retained only for the period required for the service, legal duties, applicable limitation periods, or the establishment, exercise, or defense of rights, then deleted, destroyed, or anonymized.

7. Age requirement

Dropvia is not offered to persons under 16, and users under 16 are not accepted. If we learn that an account belongs to a person under 16, we may request verification, close the account, and erase related data in accordance with law. If your jurisdiction requires a higher age to enter into a contract, parental or guardian authorization or supervision may be required.

8. Your rights under Article 11

You may ask whether your personal data is processed; request information if it is; learn the purpose of processing and whether it is used accordingly; learn the recipients in Türkiye or abroad; request correction of incomplete or inaccurate data, deletion or destruction where the conditions are met, and notification of those actions to recipients; object to an adverse result produced solely through automated analysis; and claim compensation for damage caused by unlawful processing.