KVKK Disclosure Notice

This notice is issued by the company identified below, acting as data controller under Personal Data Protection Law no. 6698 (KVKK).

Data controller

TodoMore Yazılım ve Teknoloji Hizmetleri Limited Şirketi

Brand

TodoMore

Address

Ünalan Mah. Ünalan Cad. No: 1 İç Kapı No: 01 Üsküdar / İstanbul

Tax ID

8450774678

Email

[email protected]

• Identity data: first name, last name, username, date of birth; if you choose to add them to your profile, Turkish ID number and passport number (stored encrypted)
• Contact data: email address, phone number, country
• Visual record: profile photo
• Emergency contact (optional): the name and phone number of the emergency contact you add to your profile (stored encrypted)
• Professional data (optional): the company, department and staff number you add to your profile; the role, city, languages, day rate range, bio, portfolio and LinkedIn links you enter in your Hub profile
• Location data (iOS app only): if your role allows it, your latest position while a shoot you are part of is live; no history is kept, and it is deleted after the shoot's live window ends
• Customer transaction data: account activity, preferences, subscription status
• Financial data: billing name and address, tax ID or Turkish ID number (stored encrypted), payment amount and date, payment institution transaction reference (card numbers are not processed)
• Legal transaction data: the version and acceptance date of the Terms of Use, Privacy Policy and Distance Sales Agreement you accepted; the time of your confirmations and declarations at checkout, and your truncated IP address, its country and your browser information at that moment
• Transaction security data: IP address, browser and device information, session records, application error reports, and, for a small share of sessions, screen interaction recordings with all text masked
• Marketing data (only with explicit consent): cookie and analytics data

• Providing and maintaining our services
• Account creation, authentication and authorization
• Checking the age limit for signing up and buying a paid plan
• Running shoot operations: crew lists, emergency information and the crew's location during a live shoot
• Operating subscription, collection and invoicing processes
• Running customer satisfaction and support processes
• Operating information security processes and preventing abuse
• Proving contract acceptances and declarations made at checkout
• Meeting legal obligations
• Product development and marketing analysis, where you give explicit consent

Your personal data is processed on the following legal grounds under Article 5 of the KVKK:

• Necessary for the conclusion or performance of a contract — the user agreement and subscription relationship (Art. 5/2-c)
• Compliance with a legal obligation — keeping tax and accounting records (Art. 5/2-ç)
• Legitimate interests — system security, fraud and abuse prevention (Art. 5/2-f)
• Explicit consent — marketing analytics and non-essential cookies (Art. 5/1)

Your personal data is collected electronically, wholly or partly by automated means, through the channels below, and is processed on the legal grounds and for the purposes set out above:

• From you: sign-up and profile forms, the billing details form, content you create in the app and emails you send us
• Automatically while you use the service: session and activity records, IP address, browser and device information, application error reports, screen interaction recordings for a small share of sessions; analytics cookies if you consent
• From the iOS app: your live location, using your phone's location permission, if your role allows it and a shoot you are part of is live
• From third parties: your name, email address and profile photo from Google if you sign in with Google; your calendar events if you connect Google Calendar; the charge outcome and transaction reference from the payment institution (iyzico)
• From other users in your workspace: details entered by users who invite you to a workspace or add you to a project, shoot or client record (for example your email address and role)

Your personal data is shared with the following parties to the extent necessary to provide the service, within the scope of your explicit consent, or where legally required:

• Database and authentication provider: Supabase (Frankfurt, Germany, EU region)
• File storage provider: Cloudflare R2 (EU jurisdiction); for uploaded files and profile photos
• Video streaming provider: Cloudflare Stream; for processing and playing ReView videos
• CDN, security and hosting provider: Cloudflare, Inc.; for serving the site and app, carrying traffic, bot protection, attack filtering and bot checks on account forms (Turnstile)
• Semantic search: Cloudflare Workers AI; for turning text into vectors so you can search your workspace by meaning
• Payment providers: iyzico Ödeme Hizmetleri A.Ş. (Türkiye) for customers billed in Türkiye; once international online checkout opens, Paddle.com Market Ltd (merchant of record) for customers billed elsewhere
• Email service provider: Resend; for delivering transactional email
• Error monitoring provider: Sentry (EU data region); for diagnosing application errors
• Google: for Sign in with Google and Google Calendar sync (if you use them), maps and address search
• Authorized users in your workspaces: fields such as your phone number, date of birth, ID and passport numbers and emergency contact can be seen by people with member management permission in the workspaces you allow in your account settings. If you are added as a passenger to an event's travel plan, the authorized admins who manage travel in that workspace can see your ID or passport number and date of birth for ticketing and bookings, regardless of this setting. Details are in the Privacy Policy.
• Public authorities: only where legally required and limited to the scope requested

To provide the service, part of your personal data is processed outside Türkiye. These transfers are carried out within the framework of Article 9 of the KVKK, for the purpose of providing the service and keeping it secure.

For customers billed in Türkiye, payment data is processed in Türkiye by iyzico and is not transferred abroad. International online checkout is not open yet; once it opens, payment data of customers billed elsewhere will be processed by Paddle as merchant of record.

A detailed breakdown of data processed through cookies is available on the Cookie Policy page.

Providers that process data outside Türkiye, and where the data is processed:

• Supabase (Frankfurt, Germany, EU): database and authentication
• Cloudflare R2 (EU jurisdiction): files and profile photos
• Sentry (EU data region): application error reports
• Cloudflare (global server network): content delivery, security, video streaming (Stream) and semantic search (Workers AI); traffic data such as IP addresses may be processed on edge servers abroad
• Google (Google's servers abroad): Sign in with Google, calendar sync, maps and address search
• Resend (the provider's servers abroad): transactional email

Your personal data is retained for as long as the purpose of processing requires and for the limitation periods set out in applicable legislation.

When you delete your account, your content data is deleted within a reasonable period; billing and accounting records are retained for the minimum period required by tax legislation.

Under Article 11 of the KVKK you have the right to:

• Learn whether your personal data is being processed
• Request information if it has been processed
• Learn the purpose of processing and whether the data is used in line with that purpose
• Know the third parties to whom the data is transferred, in Türkiye or abroad
• Request correction if the data is incomplete or inaccurate
• Request erasure or destruction in line with legislation
• Request that correction, erasure or destruction be notified to third parties to whom the data was transferred
• Object to a result against you arising from analysis carried out exclusively by automated systems
• Claim compensation for damage suffered due to unlawful processing

You may submit KVKK requests in writing or electronically. Requests are concluded within thirty (30) days at the latest, depending on the nature of the request.

Email

[email protected]

Subject line

KVKK Request

Please include

Your full name, the email address of the account concerned, contact details and the subject of your request

Postal address

Ünalan Mah. Ünalan Cad. No: 1 İç Kapı No: 01 Üsküdar / İstanbul

This notice may be updated as needed. For material changes, a notification is sent to your registered email address.