1.Who we are
Mücahid Ali Karaman, a sole proprietorship registered in Türkiye, with its registered address at Meşrutiyet Mah. Karanfil Sk. Zafir İş Merkezi No: 4/91, 06420 Çankaya, Ankara, Türkiye, runs rabolic.com and the Rabolic service (“Rabolic”, “we”). This policy explains what personal data we collect, why, who we share it with, how long we keep it and what your rights are under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU and UK General Data Protection Regulation (GDPR).
Questions and requests: privacy@rabolic.com.
2.Controller and processor
- For data about our customers and their teams (accounts, organizations, billing, support) and about visitors to rabolic.com, we are the controller. This policy covers that data.
- For the events our customers send about the people who use their websites and apps, the customer is the controller and we are their processor. We handle that data only on their instructions, under the data processing terms. If you are one of those people, the website or app you used is responsible for your data; its privacy notice should say so, and you can send your request to it. If you write to us instead, we will pass your request on.
3.What we collect about customers
- Account
- What it includes
- Your name, email address and whether it is confirmed, your password (stored only as a salted hash, never in plain text), and your profile picture if you add one. With two-factor sign-in: the authenticator secret, stored encrypted, and your backup codes.
- Sign-in with Google
- What it includes
- If you choose “Continue with Google”: your Google account id, name, email address and profile picture, and the tokens Google returns at sign-in. We don’t receive your Google password or use your Google data for anything but signing you in.
- Sessions
- What it includes
- For each signed-in session: the IP address, the browser and device (user agent), and when it was created and expires.
- Organization and billing
- What it includes
- Organization and project names, settings and domains, your plan and its status, the billing email, the overage spending limit, and the Dodo Payments customer and subscription ids. Card details go to Dodo Payments; we never receive full card numbers.
- Members and invitations
- What it includes
- Who belongs to the organization, with which role and which projects, and the email addresses you invite.
- Activity
- What it includes
- A log of changes in your organization: who did what, and when. Notifications we show you and your email preferences.
- Keys and integrations
- What it includes
- Project keys (secret keys stored as hashes) and payment provider connections (webhook secrets stored encrypted with AES-256-GCM).
- Usage
- What it includes
- How many events each project sent per day, by environment and platform, and how many were dropped or rejected.
- Support
- What it includes
- What you tell us when you write to us.
4.Visits to rabolic.com
rabolic.com measures its visits with Rabolic itself, in cookieless mode: no cookies are set and nothing is stored on your device, so each page view stands alone. We record the page, the referrer and campaign parameters, the browser, operating system and device type, and the country and city derived from your IP address. The IP address itself is not stored. We use no advertising or third-party analytics tools.
5.Data about our customers’ users
When a website or app uses Rabolic, its SDK sends us events about the people who use it. On the customer’s behalf, we receive:
- a random anonymous id for each browser or app install, and the user id the customer assigns when someone signs in;
- the events the customer chooses to send, with their properties, and profile properties the customer sets;
- device, operating system, browser and app version; page URLs, screen names, referrers and campaign parameters; session ids and timing;
- the country, region and city, derived from the IP address, which is then dropped and never stored;
- purchases, renewals and refunds sent by the customer’s server or by a payment provider the customer connects.
The SDKs never collect advertising ids (IDFA, GAID), form field values, clipboard contents, device fingerprints or precise location, and Rabolic never links two people by IP address or by guessing.
6.Why we use it, and on what legal basis
- Creating your account and providing the Service: sign-in, organizations, projects, reports, alerts and the emails the Service sends
- Legal basis (KVKK Art. 5 / GDPR Art. 6)
- Necessary to perform our contract with you
- Billing, the trial, usage limits and overage, invoices and tax records
- Legal basis (KVKK Art. 5 / GDPR Art. 6)
- Contract, and legal obligations
- Keeping accounts and the Service secure: sessions, two-factor sign-in, rate limits, preventing abuse of the trial, investigating problems
- Legal basis (KVKK Art. 5 / GDPR Art. 6)
- Our legitimate interests, and legal obligations
- Telling you about your trial, plan, usage, data deletion, and changes to the Service or these policies
- Legal basis (KVKK Art. 5 / GDPR Art. 6)
- Contract, and our legitimate interests
- Measuring visits to rabolic.com, without cookies, to improve the site
- Legal basis (KVKK Art. 5 / GDPR Art. 6)
- Our legitimate interests
- Answering support requests
- Legal basis (KVKK Art. 5 / GDPR Art. 6)
- Contract, and our legitimate interests
- Responding to legal claims and requests from authorities
- Legal basis (KVKK Art. 5 / GDPR Art. 6)
- Legal obligations, and establishing or defending legal claims
We don’t sell personal data, we don’t use it for advertising, and we don’t use customers’ event data for anything but providing the Service to that customer.
8.International transfers
Rabolic’s servers are in Germany and its backups in Western Europe. Some sub-processors are, or may process data, outside Türkiye and the European Economic Area: Dodo Payments and Google in the United States, and Cloudflare’s global network. When personal data goes abroad, we rely on the safeguards the law provides, such as standard contracts under KVKK Article 9 and the European Commission’s standard contractual clauses, or an adequacy decision where one exists.
9.How long we keep it
- Account
- How long
- While your account exists. Write to us to delete it; we do so within 30 days, unless the law requires us to keep something.
- Sign-in sessions
- How long
- A session lasts 30 days from when it was last renewed, or until you sign out.
- Organization, projects, members and settings
- How long
- While the organization exists. When an owner deletes it, it is closed at once and its memberships end; its billing history is kept as the law requires.
- Customers’ analytics data: events, sessions, people and transactions
- How long
- For the data retention of the customer’s plan (Starter 12 months, Growth 24 months, Scale 36 months; Business by contract), also after the plan changes. A person’s profile goes once none of their events is left inside it. The data is deleted 7 days after a trial ends without a plan, 30 days after a canceled plan’s paid period ends, and sooner when the customer deletes a person or a project. Details are in the Terms.
- Daily usage counts, invoices and billing records
- How long
- As long as tax and commercial law require, up to 10 years.
- Activity log
- How long
- While the organization exists, and afterwards as long as the law requires.
- Visits to rabolic.com
- How long
- 12 months, without cookies and without identifying you (see Cookies).
- Support emails
- How long
- As long as we need them to answer and follow up.
- Backups
- How long
- Removed as they expire, within 30 days.
10.Your rights
Under KVKK Article 11 and, where it applies, the GDPR, you can ask us to:
- tell you whether we process your personal data, and give you a copy of it;
- tell you why we process it, and who we share it with, in Türkiye or abroad;
- correct data that is wrong or incomplete;
- delete it, or restrict how we use it, when there is no longer a reason to keep it;
- give it to you in a portable format (GDPR);
- stop processing that relies on our legitimate interests;
- object to a result that affects you and comes solely from automated analysis, and claim compensation for damage caused by unlawful processing.
Send requests to privacy@rabolic.com from the email address on your account. We answer within 30 days. If your request is about a website or app that uses Rabolic, send it to that website or app; we will help it respond.
You can also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, if you are in the EU or UK, to your local data protection authority.
11.Security
- Everything travels over HTTPS, and our servers are in Germany.
- Passwords are stored as salted hashes; API keys and invitation tokens as SHA-256 hashes; payment provider webhook secrets encrypted with AES-256-GCM; two-factor secrets encrypted.
- Two-factor sign-in with an authenticator app, which owners can require for everyone in their organization.
- Roles with per-project access, and every query is scoped to a project, so one customer can never read another’s data.
- IP addresses are used to look up a country and city and to recognize a customer’s own internal traffic, then dropped.
- Rate limits at sign-in and at ingest, and nightly backups to separate storage.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
13.Children
Rabolic is a service for businesses and people aged 18 and over. We don’t knowingly collect data from children about their own accounts; if you believe a child has given us personal data, contact us and we will delete it.
14.Changes to this policy
If we change this policy in a way that matters to you, we will tell you in the dashboard or by email before the change takes effect. The date at the top shows the latest version.
15.Contact
Mücahid Ali Karaman, Meşrutiyet Mah. Karanfil Sk. Zafir İş Merkezi No: 4/91, 06420 Çankaya, Ankara, Türkiye. Privacy and data protection: privacy@rabolic.com. Support: support@rabolic.com.