Vebrift Inc. Privacy Policy

Last Updated: August 20, 2025

1. Scope and Purpose

Vebrift Bilişim Yazılım Bilgisayar Danışmanlık ve Pazarlama Anonim Şirketi (“Vebrift Inc.,” “we,” “us,” “our”), headquartered in Beşiktaş, Istanbul, Türkiye, is a developer and publisher of interactive entertainment.

This Privacy Policy explains:

the purposes and legal bases for processing personal data across our products, services, and websites (“Services”),

with whom such data may be shared,

how long it is stored, and

your rights under the KVKK and GDPR.

2. Summary Information (Privacy at a Glance)

Data We Collect: Minimum technical data required for the operation and security of the Services and contact data you provide for support purposes (e.g., e-mail).

Purposes of Use: To provide the Services, ensure security, troubleshoot errors, and provide support. We do not process personal data for advertising or other marketing purposes.

Your Rights: Rights such as access, rectification, erasure, objection, restriction, and data portability. Recourse methods and contact details are provided below.

3. Categories of Information We Collect

Depending on your use and interaction with the Services, the following data may be processed:

Communication/Content Data

E-mail address and message content you provide in connection with support requests.

Additional information you voluntarily provide (e.g., screenshots).

Technical and Usage Data

Server logs, truncated IP addresses, device model, operating system, browser information, date/time stamps, referring URLs, error/crash records.

These data are processed in pseudonymized or aggregated form whenever possible.

Billing and Payment

Payments are processed exclusively through third-party platforms (e.g., Apple App Store, Google Play Store, Steam, Minecraft Marketplace).

No personal payment data is collected or stored by Vebrift Inc.

Special Categories of Personal Data

We do not process sensitive categories of personal data (e.g., health, biometric, trade union data).

4. Purposes and Legal Bases for Processing

Provision of Services and Support (account/session management, troubleshooting, responding to requests): KVKK Art. 5(2)(c); GDPR Art. 6(1)(b).

Security and Maintenance (fraud/abuse prevention, performance and availability): KVKK Art. 5(2)(f); GDPR Art. 6(1)(f) (legitimate interest).

Legal Obligations (accounting, tax compliance, responding to lawful requests): KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c).

Cases Requiring Explicit Consent (e.g., non-essential cookies, optional features): KVKK Art. 5(1); GDPR Art. 6(1)(a).

 We do not process personal data for marketing or retargeting purposes. Personal data is never sold or rented.

5. Methods of Data Collection

Directly from you: Support and contact channels.

Automatically: Server logs and security systems.

Through third-party platforms: Product downloads and payment processes (payment details are not transferred to us).

6. Sharing of Data (Recipient Groups)

Service Providers (Data Processors): Hosting providers, content delivery networks (CDNs), e-mail/job management providers. These parties are bound by contractual confidentiality and security obligations.

Legal Authorities: When required by law or pursuant to a valid court order.

Corporate Transactions: In the event of a merger, acquisition, or structural change, data may be transferred subject to confidentiality and security measures.

A current list of data processors can be made available upon request.

7. International Data Transfers

If transfers to data processors or service providers outside Türkiye are necessary:

Under KVKK Article 9, such transfers are based on an adequacy decision, appropriate safeguards (e.g., standard contractual clauses/undertakings), and/or necessary permissions from the Data Protection Authority, or your explicit consent.

Under the GDPR, transfers are based on an adequacy decision (Art. 45) or appropriate safeguards (Art. 46, e.g., SCCs). Where these are not applicable, transfers may rely on exceptions under Art. 49.

8. Data Retention Periods

Mandatory technical logs: Retained for a maximum of 2 years, then securely deleted or anonymized.

Support correspondence: Retained no longer than 6 months after the request has been finalized.

Legal records (accounting/tax): Retained for 10 years in accordance with applicable legislation.

Once the relevant retention period expires, personal data is permanently deleted or irreversibly anonymized through secure destruction procedures.

9. Children’s Privacy

The Services are generally intended for users of legal age. If it is determined that a minor is using the Services, appropriate measures shall be taken, including suspension or removal of the account where applicable. Parents and legal guardians are advised to instruct their children not to share personal data without supervision.

10. Data Security

Personal data is protected through appropriate administrative and technical safeguards, including but not limited to:

transmission security via TLS 1.3,

hosting in ISO 27001-certified data centers,

access controls (RBAC, MFA),

logging and monitoring,

patch management,

encryption and pseudonymization, and

regular penetration testing.

11. Cookies and Similar Technologies

Our Site uses mandatory and functional cookies to ensure proper operation. Analytical and advertising/targeting cookies are disabled by default and activated only with your explicit consent.

You may manage your preferences at any time via the "Cookie Settings" link at the bottom of the page. For further details, please refer to our Cookie Policy.

12. Your Rights (KVKK and GDPR)

You may exercise the following rights in accordance with KVKK Article 11 and the GDPR:

Right of access and to request information,

Right to rectification and update,

Right to erasure, destruction, or anonymization,

Right to object to and request restriction of processing,

Right to data portability (GDPR),

Right to withdraw consent and object to direct marketing (GDPR).

Your rights under KVKK Article 11 are fully reserved. Requests will be responded to within the timeframes stipulated by applicable legislation.

You also have the right to lodge a complaint with the competent supervisory authority in your country of residence. In Türkiye, the relevant authority is the Personal Data Protection Authority (KVKK).

13. Application and Contact

To exercise your rights or for any questions regarding this Policy, please contact:

Company/Data Controller: Vebrift Inc. (including its Sub-Brands)

Address: Beşiktaş, 34353 Istanbul / Türkiye

For KVKK/GDPR Requests: vebrift@gmail.com

General and Technical Support: vebrift@gmail.com

Application Procedure: Applications under the KVKK may be submitted in writing, by e-mail, or via the application form available on our system, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller.

14. Policy Changes

This Privacy Policy may be updated from time to time. Updates shall take effect immediately upon publication on the Site, and the “Last Updated” date at the top will be revised accordingly.

For material changes, you will be notified through appropriate channels (e.g., e-mail notice, in-app message, or on-site announcement). Your continued use of the Services after such changes constitutes acceptance of the updated Privacy Policy.