dot — Privacy Policy

1. Scope and service provider

This policy describes how personal data is processed during account creation, task and list management, collaboration, notifications and home screen widgets in the dot application. The data controller and service provider is Ventix Global Medya Yazılım Reklam ve Danışmanlık Sanayi Ticaret Limited Şirketi (“Ventix Global”) and dot is offered under the Ventix Studio brand.

For your requests regarding privacy and personal data, you can contact dot@ventixglobal.com by writing “dot / KVKK Request” in the subject line. General corporate information of the company is available at ventixglobal.com.

2. Processed data

Account information: name, email address, account ID, login provider, profile picture if available, and invitation code. When registering and logging in via email, the password is transmitted to the server via HTTPS for verification. When logging in with Google or Apple, the authentication token provided by the relevant provider and the profile information shared are used.

Contents: list and task names, notes, dates, reminders, repeat settings, completion and importance information, person assignments, list memberships, invitations and related notifications.

Device and notification information: device token used for notification delivery, device operating system type, and notification permissions. The device's time zone is used to ensure local reminders run at the correct time.

Network requests to the service may generate IP address, request time, requested resource, and error/security records. GoDaddy explains that it rotates shared hosting logs every 7 days to remove old records. Additionally, access logs are archived in our cPanel account after statistics are processed; The setting to remove the previous month's archives at the end of the month is on. These archives are separate copies from the provider's log rotation cycle.

For content security, the account IDs of the users you blocked, the content or user IDs you reported, the reason you chose, your explanation and review status are stored. These records are used for review by authorized support staff; The relevant notification description can be sent to the dot support email account.

3. Processing purposes and legal bases

Data necessary for account creation and login, saving and syncing tasks across devices, sharing lists with people you choose, delivering invitation and task notifications, running reminders, and secure session management are processed. These purposes include evaluating inappropriate content notifications, implementing user blocks, and preventing abuse.

Processing operations necessary for the establishment and provision of the service are considered within the scope of the establishment or execution of the contract, to the extent applicable. Processing operations carried out for security and prevention of abuse are legitimate interests, taking into account your rights and freedoms; Mandatory records are considered within the scope of the relevant legal obligation. If there is a transaction that requires explicit consent, it is requested separately and for a specific purpose.

Viewing the Privacy Policy or accepting the Terms of Use does not mean that you give explicit consent to all personal data processing activities. Notification permission is also managed separately through the device operating system.

4. Sharing and service providers

List and task contents, task assignments, and related account information you add to shared lists are made accessible to authorized list members. Before sharing a list, consider that the content may be visible to these people.

Google authentication services are used when logging in with Google, and Apple authentication services are used when logging in with Apple. Remote notifications can be delivered via Firebase Cloud Messaging and the Apple Push Notification service on iOS. GoDaddy mail infrastructure is used to send e-mails regarding support, personal data requests and content notifications, and Google Workspace is used to receive them; dot support address is linked to the company's info mail group. These providers may process the necessary identity, contact, message content and technical data to provide the relevant service.

dot account, list and task data is maintained on the API server on the GoDaddy hosting infrastructure. In the hosting panel, the server region is stated as Europe; Country-by-country location has not been confirmed. Account, content and technical data are processed in this infrastructure to provide service, synchronization and security. Google and Apple login/notification services and Google Workspace email service may also result in data processing abroad. Hosting abroad or access from abroad is evaluated regardless of whether our company is established in Turkey.

Data processing addendum for GoDaddy's hosting services; It regulates the processing of data for service purposes and documented instructions, confidentiality and security measures, obligations of sub-processors and support for data subject requests. Ventix Global is responsible for evaluating your requests regarding your personal data.

This version does not use in-app advertising or behavioral analytics SDK. If a different data processing purpose is added in the future, this purpose is disclosed in advance; If necessary, additional permission is obtained.

5. On-device storage, widgets and notifications

Copies of lists and tasks, pending changes, and pinned list preferences are kept on the device for offline use. The session token and account profile are protected by the operating system's secure storage mechanism. Offline cache of tasks/lists is not the same secure storage.

Widgets can show task titles, date/person information, and list summary on the home screen. Notification previews may also appear on the lock screen, depending on device settings. Limit widgets and notification previews on shared devices as per your need.

Logging out of the account removes login information and triggers a purge of widget content; It does not delete your account. Offline list/task cache is not automatically deleted on exit. Before giving the device to someone else, clear application data through the operating system or uninstall the application.

6. Storage and account deletion

Active account, session, device and list/task records are processed as long as your account and service relationship continues. Individual content deletion or account deletion is applied within the scope explained below. Support and content notifications are evaluated with the time criteria required for the review and conclusion of the request or incident, protection of security, and the relevant legal obligation or dispute, if any. Service relationship, record type, review completion and applicable obligations may result in different retention periods.

You can delete your account via Profile → Delete account in the app. Successful action removes your account, your lists and tasks, memberships, comments, session and device records and associated notifications from the active database. Tasks you create in shared lists belonging to someone else are protected by being linked to the list owner; Task assignments made to you are cleared. If you added personal information to common task content, review it before deleting it.

GoDaddy's standard Web Hosting (cPanel) service offers 1-day restore access from daily backups; Only the last daily backup can be selected in the account panel reviewed. Additional paid backup products may offer longer history; This policy does not show a 30 or 90 day retention period as applying because the existing account has not been verified as using them. The restore access window does not mean that the provider irreversibly deletes all copies after the same period.

Monthly access log archives in cPanel and separate manual maintenance backups created before the update are different from the daily hosting backup. Therefore, the restoration access window for daily backups does not apply to manual copies. Information deleted from the active database can be found in a backup or infrastructure record until the cycle ends or the relevant copy is also deleted. When a deletion request is submitted, these record types and the need for retention, if any, are evaluated separately.

GoDaddy's data processing addendum includes the return, deletion or de-identification of data in accordance with the contract when the service relationship ends; If there is a legal obligation to keep it, it envisages returning or deleting it when this obligation ends. This statement does not mean that the hosting agreement ends with the deletion of a single dot account. The official documents reviewed do not specify a single exact number of deletion days for all infrastructure copies.

Technical records in the Google and Apple identity/notification infrastructure and support e-mail copies are also evaluated within the scope of the relevant provider's terms and applicable obligations. Logging out or uninstalling the app does not replace account deletion. This policy does not guarantee that all data is deleted instantly or within a single period across all providers.

7. Manage your security and preferences

HTTPS is used in server communication, and authentication tokens are used in session management. Protect the access security of your account and device; Share your password and invitation code only with necessary people.

You can change notification permission from device settings; You can remove reminders from task settings and remove home screen widgets. Absolute security assurance cannot be given for any internet service.

8. Your rights and requests

Within the framework of the applicable personal data protection legislation, you have the right to learn whether your data is being processed, to obtain information about the processing, to learn the purpose and transfer recipients, to request correction of incorrect/incomplete data, to request deletion or destruction when the conditions are met, and to request that these transactions be notified to the relevant recipients.

You can also object to a result against you arising exclusively from automatic analysis and request compensation if damage occurs due to unlawful processing. Access, data portability, restriction and objection rights under applicable law in other regions are also considered.

You can send your request to exercise your rights to dot@ventixglobal.com with the title “dot / KVKK Request”. Specify your request and the email address associated with your dot account; Do not send your password. Necessary and proportionate additional information may be requested to verify the relationship of the request with your account. Requests are evaluated within the framework of the time period and procedures stipulated by the applicable legislation. You can also initiate account deletion via Profile → Delete account.

9. Changes

The version of the policy and its update date are displayed on this page. Whenever there is an update that significantly changes data usage, the new data processing practice is disclosed in advance; If necessary, the notification and permission process is also carried out.