DIGIYZ Demo — marketplace preview. Checkout opens soon; sellers can set up their stores now and claim one of the first 100 Founding Creator spots.
Skip to content
DIGIYZ

Legal

Privacy Policy

Last updated: October 2026.

0. Who the data controller is

DIGIYZ (the "Company") is the data controller for personal data processed through this site. DIGIYZ is operated from Türkiye by an independent developer; a UK Ltd. registration is planned and this notice will be updated accordingly once that company is active. Contact for privacy matters: privacy@digiyz.com. Turkish-language disclosure under KVKK: see KVKK Aydınlatma Metni.

1. What we collect

  • Account: email, username, display name, hashed password (via Supabase Auth).
  • Profile: optional avatar, bio, country, language, timezone.
  • Orders: order history, items, totals, provider reference. Not card numbers.
  • Seller data: if you become a seller, submerchant onboarding payload (contact, IBAN, tax info) is forwarded to iyzico — we store references only.
  • Technical: IP, user agent, correlation IDs for the duration of a request; coarse analytics (never cross-site).
  • Feedback: what you submit via the beta feedback widget — subject, body, page path, user-agent string.

2. What we don't collect

  • Card details. Payment pages are hosted by iyzico (PCI Level 1 certified). We never see card number, CVV, or expiry.
  • Keystrokes, screen recordings, or persistent cross-site tracking.

3. Where data lives

DIGIYZ data is hosted on Supabase in the Frankfurt region (eu-central-1). Private files (digital products you buy) live in a private storage bucket and are served only via short-lived signed URLs after an entitlement check.

4. Who it's shared with

  • iyzico — payment processing (buyer billing info, order total).
  • Supabase — hosted database and storage.
  • Cloudflare — edge delivery and DNS.
  • No ad networks. No analytics brokers. Period.

5. Legal basis (GDPR Art. 6)

  • Contract (Art. 6(1)(b)): account creation, orders, payouts.
  • Legal obligation (Art. 6(1)(c)): tax and commercial record-keeping (TR: 10-year retention for financial records).
  • Legitimate interest (Art. 6(1)(f)): fraud prevention, security monitoring.
  • Consent (Art. 6(1)(a)): marketing communications (not active today), non-essential cookies.

6. Retention

  • Account data: while your account is open; anonymized within 30 days after erasure request.
  • Order and financial records: 10 years (TR tax law).
  • Server logs: 12 months.
  • Consent audit trail: 10 years (as evidence of lawful processing).

7. Your rights (GDPR Art. 15–22 + KVKK Art. 11)

You can:

  • Access / Portability: download a JSON copy of all your data at /account/privacy.
  • Rectification: edit your profile at /account/profile.
  • Erasure: request account deletion from /account/privacy. Non-financial PII is anonymized immediately; orders stay with buyer identity nulled for the 10-year tax window.
  • Restriction / Objection: email privacy@digiyz.com.
  • Complaint: you may file a complaint with the Turkish data authority (KVKK) or your local EU supervisory authority.

We respond within 30 days of a verified request.

8. International transfers

Our Supabase project is hosted in Frankfurt (eu-central-1), inside the EU. Cloudflare serves edge content globally; traffic is encrypted end-to-end. No personal data is transferred to jurisdictions without adequate protection without additional contractual safeguards.

9. Automated decision-making

DIGIYZ does not make legally significant decisions about users through fully automated means. Content moderation is assisted by rules and lightweight scoring but a human admin reviews flagged cases.

10. Children

DIGIYZ is not for users under 18. We ask for an 18+ confirmation at signup. If we learn a minor has registered, the account is deleted and any associated data erased.

11. Cookies

We use a small number of first-party cookies / localStorage keys for auth session, cart contents, and UI preferences. See Cookie Policy for the full list.

12. KVKK (TR)

Separate Turkish-language disclosure is required by Turkish law. See KVKK Aydınlatma Metni.

13. Beta exceptions

During the private beta we may contact you about major changes, outages, or feedback requests. These are transactional, not marketing.

14. Changes to this policy

Material changes are announced at least 30 days before taking effect, via in-app notification and email to the address on file.

15. Contact

Data questions: privacy@digiyz.com. General support: support@digiyz.com.