Privacy and Security Policy

1. Operator and scope

ShareHub is operated by Globalmeta Dijital Pazarlama ve Yazılım Hizmetleri Ticaret Limited Şirketi. This policy applies to https://sharehub.globalmeta.net, the admin panel, checkout pages, API, MCP, Agent Space, support communications, and publishing viewer surfaces under /s/.

• Trade name: Globalmeta Dijital Pazarlama ve Yazılım Hizmetleri Ticaret Limited Şirketi
• Registered office: Esentepe Mah. Milangaz Cad. Monumento Plaza No:75A/133, 34870 Kartal/İstanbul
• Telephone: 0850 330 10 10
• Email: hello@sharehub.link
• Registered electronic mail address: globalmetadijital@hs01.kep.tr
• Tax office and number: Kartal Vergi Dairesi / 3961693137
• MERSIS number: 0396169313700001
• Trade registry number: 1063529

2. Roles of Globalmeta and the customer

Globalmeta acts as data controller for account creation, organization membership, subscriptions, billing, security, and support.

For HTML documents, recipient lists, project content, and access rules uploaded or determined by a customer, the customer is the data controller and Globalmeta processes data only to follow the customer's instructions and securely provide the service. Customers must have a valid legal basis for uploaded content and recipient data.

3. Categories of data processed

• Account and organization data: name, surname, business email, organization domain, membership, role, and permissions.
• Payment and invoice data: contact details, identity or tax number, billing address, billing period, agreement records, and iyzico references. Full card and CVV data are not stored by ShareHub.
• Subscription data: plan reference, monthly or annual period, status, start and period end, and latest payment result.
• Publishing and project data: title, HTML, version, project, access mode, permitted email or domain, expiry, session duration, and publication status.
• Agent Space and integration data: membership, messages or handoff content, MCP and REST permissions, API-key prefix, audit events, and operation records.
• View data: share, version, event type, time, country, and device class; for OTP-protected shares, the verified email and a limited daily per-share visitor digest.
• Support and security data: request content, error details, operation time, and limited records required for abuse review.

4. Purposes of processing

• Create and securely maintain accounts, organization memberships, and permissions.
• Start, renew, verify, cancel, charge, and refund subscriptions.
• Version and serve HTML, enforce OTP and timed access, and enable immediate revocation.
• Keep view signals based on real human renders while filtering scanners and preview bots.
• Operate authorized human and agent workflows through Agent Space, REST API, and MCP.
• Protect information security, prevent abuse, investigate faults, maintain auditability, and comply with law.
• Answer support requests and improve reliability using aggregated or de-identified measurements.

5. Payment and card security

The card form is provided by iyzico. ShareHub does not store the full card number, CVV, card password, or 3D Secure authentication data. Only transaction references and status information required for subscription verification, accounting, and dispute handling are retained.

Card credentials must not be sent by email, support request, Agent Space, or uploaded content.

6. Data minimization for view signals

The application database does not store raw IP addresses or full browser user-agent strings. For an OTP-protected share, a raw IP may be used in memory solely to produce a per-share, per-day digest and is then discarded. No visitor digest is written for public shares.

Email scanners, messaging previews, and known bots are not counted as real views. A view signal is created only from a render event or verified OTP event.

7. Service providers and disclosures

Data is not sold or rented. Limited data may be shared where required to provide the service.

• Supabase for database, authentication, and service data hosted in the Frankfurt region.
• Netlify and network providers for application delivery, request routing, and infrastructure security.
• Microsoft Graph and email services for OTP, security, and service messages.
• iyzico, banks, and payment providers for checkout, subscription charges, refunds, and disputes.
• Accounting, e-invoice, legal, and professional advisers for statutory obligations.
• Authorized public bodies and courts only when a lawful obligation or valid request exists.

8. International transfers

Service data is hosted in Frankfurt and some infrastructure providers operate outside Türkiye. Transfers are limited to data necessary for the service and are handled under the current conditions and appropriate safeguards in Article 9 of Turkish Law No. 6698.

9. Retention and deletion

• Account, organization, contract, and subscription records are kept for the service relationship and applicable limitation periods.
• Accounting and payment records are retained for statutory fiscal periods.
• OTP codes are valid for 15 minutes and old records are periodically removed.
• Detailed view events for revoked or expired publications are deleted within 30 days.
• Customer content is deleted or made inaccessible after termination once legal retention and security needs are satisfied.
• A non-personal aggregate view count may remain as a service statistic.

10. Security, rights, and contact

ShareHub uses row-level database security, role and organization authorization, encrypted transport, signed sessions, hashed keys, audit records, and immediate revocation. No online service can promise absolute security.

Requests for access, correction, deletion, objection, and other rights under Turkish data protection law may be sent to hello@sharehub.link, globalmetadijital@hs01.kep.tr, or the registered office. Identity and request scope may need to be verified.