Personal Data Protection Notice

1. Data controller

Under Turkish Law No. 6698, the data controller is Globalmeta Dijital Pazarlama ve Yazılım Hizmetleri Ticaret Limited Şirketi.

• Trade name: Globalmeta Dijital Pazarlama ve Yazılım Hizmetleri Ticaret Limited Şirketi
• Registered office: Esentepe Mah. Milangaz Cad. Monumento Plaza No:75A/133, 34870 Kartal/İstanbul
• Telephone: 0850 330 10 10
• Email: hello@sharehub.link
• Registered electronic mail address: globalmetadijital@hs01.kep.tr
• Tax office and number: Kartal Vergi Dairesi / 3961693137
• MERSIS number: 0396169313700001
• Trade registry number: 1063529

2. Groups of data subjects

• Prospective customers and visitors to public ShareHub pages.
• Account users, organization administrators, members, and invited users.
• Buyers, subscribers, billing contacts, and support requesters.
• Recipients authorized to open an OTP-protected publication.
• Authorized users and agents participating in API, MCP, or Agent Space workflows.

3. Data categories

• Identity and contact data, organization and membership data, billing address, and identity or tax number required for payment.
• Subscription, agreement-consent, iyzico reference, invoice, and transaction status data.
• Publication, project, recipient, access-rule, version, and Agent Space content supplied by the customer.
• Security, authorization, API-key prefix, audit, support, country, device class, and limited verified-view data.
• Full card number, CVV, card password, raw IP, and full user-agent string are not stored in the ShareHub application database.

4. Purposes and legal grounds

• Contract formation and performance: accounts, publishing, access control, subscriptions, payment verification, and support.
• Legal obligation: accounting, invoicing, regulatory response, and statutory record retention.
• Establishment, exercise, or protection of a right: audit evidence, disputes, fraud review, and security incidents.
• Legitimate interests, without harming fundamental rights: service security, abuse prevention, reliability, and limited aggregated measurement.
• Explicit consent only where a processing activity legally requires consent; disclosure and consent are presented separately.

5. Collection methods

Data is collected electronically through account and checkout forms, organization invitations, publication and access settings, API and MCP calls, Agent Space actions, OTP verification, render events, support communications, and records returned by service providers.

6. Recipients and transfer purposes

• Supabase, Netlify, Microsoft, and network providers for hosting, authentication, delivery, email, and security.
• iyzico, banks, accounting, and invoicing providers for charges, subscriptions, refunds, invoices, and payment disputes.
• Professional advisers where necessary to establish or protect a right.
• Authorized public institutions or courts where a legal obligation or valid request exists.
• Customer-selected recipients for content and access data under the customer's instructions.

7. International transfers

Because service data is hosted in Frankfurt and certain providers operate internationally, necessary data may be transferred abroad under Article 9 of Law No. 6698 and applicable safeguards. Transfers are limited by purpose and data minimization.

8. Retention periods

• Account and contract data for the relationship and applicable limitation periods.
• Financial records for periods required by tax and commercial law.
• OTP codes for a short operational period; each code is valid for 15 minutes.
• Detailed view events for closed shares until deletion within 30 days after revocation or expiry.
• Support, audit, and security records only as long as required for purpose, legal duty, or rights protection.

9. Rights under Turkish data protection law

• Learn whether personal data is processed and request information about processing.
• Learn the purpose of processing and whether data is used consistently with that purpose.
• Learn the recipients inside or outside Türkiye.
• Request correction of incomplete or inaccurate data and notification to recipients.
• Request deletion or destruction where legal conditions are met and notification to recipients.
• Object to a result produced exclusively by automated analysis that is adverse to the individual.
• Claim compensation for damage caused by unlawful processing.

10. Application method

Applications may be sent to hello@sharehub.link, globalmetadijital@hs01.kep.tr, or the registered office using a method permitted by law. Include enough information to verify identity, the right exercised, the relevant account or organization, and a response address. Do not include card credentials or unnecessary personal data.