Privacy Policy

We process a limited set of personal data in order to provide the service. It falls into these categories:

• Account details: name, username, email address, phone number, country, date of birth and profile photo. We ask for your date of birth to check the age limits for signing up (13) and for buying a paid plan (18).
• Details you choose to add to your profile: Turkish ID number, passport number, your emergency contact's name and phone number, company, department and staff number. These fields are optional; ID, passport and emergency contact details are stored encrypted.
• Who can see these details: In your account settings you choose which kinds of workspaces (those you are a member of, a client of, or freelancing for) can see the fields above, together with your phone number, date of birth and country. In the workspaces you allow, people with member management permission can see them and export them to project crew lists. The one exception is travel planning: if you are added as a passenger to an event's travel plan, the authorized admins who manage travel in that workspace can see your ID or passport number and date of birth for ticketing and bookings, regardless of this setting.
• Hub profile (optional): details you enter in your Hub profile, such as your role, city, languages, day rate range, bio, portfolio and LinkedIn links. By default your Hub profile is visible only to workspaces you work with; if you choose to be listed in the Hub directory, other workspaces using TodoMore can see it too.
• Workspace content: the projects, tasks, files and messages you create, and their metadata.
• Live location (iOS app only): if your role allows location sharing and a shoot you are part of is live, the iOS app sends your latest position using your phone's location permission. Only the latest position is kept, with no history; it is deleted within a few minutes after the shoot's live window ends. Only crew members allowed to view that shoot's live map can see it.
• Usage and security records: IP address, browser and device information, session and activity logs, application error reports, and, for a small share of sessions, screen interaction recordings with all text masked.
• Billing details: plan, subscription status, billing name and address, tax ID or Turkish ID number (stored encrypted). Your card number, expiry date and CVV never reach us.
• Acceptance records: the version and date of the Terms of Use and Privacy Policy you accepted at sign-up; the version of the Distance Sales Agreement you accepted at checkout, the time of your confirmations and declarations, and your truncated IP address, its country and your browser information at that moment.
• Analytics (only with your consent): page views and product usage measurements.

• To create, verify and manage your account
• To check the age limit for signing up and buying a paid plan
• To provide, maintain and improve the platform's features
• To run shoot operations: crew lists, emergency information and the crew's location during a live shoot
• To detect and prevent activity that could threaten security
• To be able to prove your contract acceptances and your declarations at checkout
• To deliver service notifications and support responses
• To operate subscription and billing processes
• To meet our legal obligations

Your personal data is never sold, rented or transferred to third parties for advertising or marketing purposes, unless there is a legal obligation (court order, lawful request) or you have given explicit consent.

To the extent necessary to provide the service, we work with the following providers as data processors. Data processed outside Türkiye, and where it is processed, is listed under "Transfers Abroad" in the KVKK Disclosure Notice:

• Database and authentication (Supabase; Frankfurt, Germany, EU region): the database holding account and workspace data, sign-in, and billing documents.
• File storage (Cloudflare R2, EU jurisdiction): the files, images and profile photos you upload.
• Video streaming (Cloudflare Stream): processing and playback of videos uploaded to ReView.
• CDN, hosting and security (Cloudflare, Inc.): serving the site and app, carrying traffic, bot protection and attack filtering, and bot checks on the sign-in, sign-up and password reset forms (Cloudflare Turnstile). In this context your IP address and browser information are processed for security purposes.
• Semantic search (Cloudflare Workers AI): turning text in project, task, file, equipment, client and ReView records into numeric vectors so you can search your workspace by meaning.
• Payment providers: iyzico for customers billed in Türkiye (subscription charges and refunds). Once international online checkout opens, Paddle.com Market Ltd will act as merchant of record for customers billed elsewhere (charges, invoicing, tax handling and refunds).
• Email delivery (Resend): transactional email such as invitations, notifications and billing emails.
• Error monitoring (Sentry, EU data region): diagnosing errors and performance problems in the app. Error reports include your user ID and email address. In the screen interaction recordings taken for a small share of sessions, all text and form fields are masked and images are not recorded.
• Google: sign-in if you choose Sign in with Google (name, email address, profile photo); calendar sync if you connect Google Calendar; showing maps and address search.
• Consent record: when you accept cookies, we store the date of the decision, the approved categories, the policy version, your browser type and an irreversible hash of your IP address, so that consent can be demonstrated. When you withdraw a consent you gave, the withdrawal is recorded with the same details and linked to the earlier record. Nothing is stored when you reject without ever consenting.
• Public authorities: only where legally required, limited to the scope requested.

Payments from customers billed in Türkiye are processed by the licensed payment institution iyzico. International online checkout is not open yet; once it opens, payments from customers billed elsewhere will be processed by Paddle.com Market Ltd as merchant of record. Your card number, expiry date and security code are never transmitted to TodoMore servers, are not visible to us and are not stored by us.

That data is processed directly in the payment provider's PCI-DSS compliant environment. We retain only the outcome of the charge (success or failure), the amount, the date and the transaction reference generated by the provider.

Your data is encrypted in transit with TLS and at rest on the server side; sensitive fields such as identity numbers are additionally encrypted at column level.

Access between workspaces is separated by row-level security policies in the database — one workspace's data cannot be read by another.

Even so, no method of transmission over the internet can be guaranteed 100% secure. Account-side measures such as using a strong password and enabling two-step verification remain your responsibility.

Our security architecture is described in detail on the Security page.

We keep your personal data for as long as your account is active and for as long as it is needed to provide the service.

When you delete your account, your content data is permanently deleted within a reasonable period. Billing and accounting records must be retained for the minimum period required by tax legislation (as a rule, ten years).

We use strictly necessary cookies for core functions such as session management and remembering preferences; the site does not work without them.

Analytics cookies run only with your explicit consent. Until you consent, not a single request is sent to analytics providers and their scripts are never downloaded to your browser. You can withdraw that consent at any time via the “Manage my cookie preferences” link at the bottom of the page; your decision is asked again after 12 months.

Every cookie we use — its name, who sets it, how long it is kept and what it does — is listed in a table on the Cookie Policy page.

No cookie is used for advertising, profiling or selling data to third parties.

Under KVKK and the GDPR you may contact us to exercise the following rights:

• To learn whether your personal data is being processed and request information about it
• To request correction of incomplete or inaccurate data
• To request erasure or destruction where the grounds for processing no longer apply
• To export a copy of your data in a structured format
• To object to processing and to withdraw consent you have given

We may update this policy from time to time. For material changes we notify the email address registered on your account. The current version applies from the date it is published.

Write to us with any questions or requests about our privacy practices. All inquiries go through a single address; naming the type of request in the subject line (for example KVKK Request or Security Report) helps us route it faster.

For KVKK applications and the detail of your rights under Turkish law, see the KVKK Disclosure Notice.

Email

[email protected]