Privacy Policy

1. Scope

This policy covers three situations:

1. visiting the milofly.com website,
2. opening an account in the Milofly store admin and using the service,
3. shopping in a store built with Milofly.

2. This site (milofly.com)

• This site does not measure visitors and uses no tracking cookies. When you press the language button, only a preference cookie that remembers the language you chose is written; the details are in the Cookie Policy.
• The contact form on this site (writing to us and meeting requests) sends what you write to Milofly's server; your request is saved, an acknowledgement is emailed to you, and it is only used to answer your request. Which information the form processes is set out in the KVKK Information Notice. If you choose WhatsApp, a ready message opens in WhatsApp, sending it is up to you, and the message is delivered under WhatsApp's own terms.
• Fonts load from this site's own server; no other company's server is contacted when the page opens.
• The site is hosted on Vercel. Vercel keeps access logs (IP address, date, requested page, browser details) for security and error detection for the period set in its own terms of service; Milofly does not download or keep these logs separately. Requests sent by the contact form reach Milofly's API server and are kept for the periods in section 7.

3. Store admin (people using the service)

When you open an account and use the service, we process the following information:

• Identity and contact: first name, last name, email, phone.
• Account security: not your password itself but the hash used to verify it; sign-in records.
• Sign in with Google: if you choose this, the account ID, email address and name Google passes to us.
• Store information: store name, domains, settings, catalogue and other data you enter in the admin.
• Services you connect: when you connect your payment provider, carrier, marketplace, Google or Meta account to your store, the account IDs and access keys needed for the connection. These keys are stored encrypted.
• AI features: when you use Milo or the AI writing features, your request and the store information needed for the answer are sent to the AI service provider to produce the answer.
• Payment: subscription payments are taken through the payment institution PayTR. The card number, expiry date and security code are sent from your browser straight to PayTR; Milofly does not receive or store them. Only the first 8 digits of the card number reach Milofly's server, to show the instalment options.
• Invoicing: the business name, tax and address details needed for invoicing.

We process this information to provide the service, keep your account secure, invoice you and meet our legal obligations.

4. People who shop in stores

When you shop in a store built with Milofly, that store is the data controller for your personal data. Milofly processes this data only on the store's behalf and on its instructions, to provide the service (as a data processor). To exercise your rights, contact the store you shopped with.

5. Transfers

Your information may be transferred, as far as the service requires, to companies providing hosting, storage and backup, email sending, payment, address suggestion and map, and AI services, to the providers of services you connect to your store and to authorities entitled by law. Transfers abroad are made in line with the conditions in Article 9 of Law No. 6698. The service providers we work with, what each is used for and the countries where the data is processed:

• Hetzner: API server and databases; the server is in Finland (Helsinki).
• Vercel: the store admin, storefronts and this site; a US company, with server processing for the admin and storefronts in Germany (Frankfurt).
• Cloudflare: domain name (DNS) service, the secure connection to the API server, and image and file storage; a US company.
• Resend: email sending; a US company.
• Google: AI (Gemini) and storage of database backups (Google Drive); a US company.
• Anthropic: AI (Claude); a US company.
• Amazon Web Services: address suggestions and maps; service region Sweden (Stockholm).
• PayTR: collection of subscription payments; Türkiye.

Services you connect to your store yourself (payment providers, carriers, marketplaces, Google, Meta and apps) are not in this list; their terms are subject to the contract you make with each provider.

6. Security

Connections to the site and the admin are encrypted (HTTPS). Passwords and connection keys are never stored as plain text. In the admin, each user only sees the data their permissions allow. Access to data is limited to people authorised for their work.

7. Retention

• Account details (name, email, phone, sign-in details): as long as your account is open; after the account is closed, 10 years as evidence in possible legal disputes.
• Accounts whose email address was never verified and that never opened a store: deleted automatically after 14 days.
• Store data (catalogue, orders, your store's customers and settings): not deleted when the subscription ends; deleted within 30 days when you ask in writing for it to be deleted.
• Invoice, payment and accounting records: 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253).
• Agreement and approval records (approved text, moment of approval, IP address): for the term of the agreement and 10 years after it ends.
• Contact form requests (form content, IP address, browser details): 2 years after your request is concluded; if you make an agreement with us in that time, as for account details.
• Consents to commercial electronic messages: 3 years after the consent ends.
• Milo chats: until you delete them or your account is deleted.
• Security records (sign-in records, IP address): at most 2 years.

Data whose retention period has ended is deleted, destroyed or anonymised.

8. Your rights

Your rights over your personal data and how to exercise them are set out in the KVKK Information Notice.

9. Changes

When this policy changes, the current text is published on this page and the effective date at the top is updated.