Legal Document

Privacy & Cookie Policy

Last updated: 23.09.2026

Contents

  1. 1. Overview
  2. 2. Data Security
  3. 3. Cookies
  4. 4. Server Logs
  5. 5. Third Parties
  6. 6. Account Deletion and Data Retention
  7. 7. Breach Notification
  8. 8. Contact

1. Overview

musterim.net (the "Platform") is committed to protecting the privacy of its members and of its members' store customers. This policy explains what data is collected and how it is protected, and describes our use of cookies. For details of how personal data is processed, including your rights under KVKK and the GDPR, please read the Privacy Notice.

2. Data Security

  • All traffic is encrypted with SSL/TLS.
  • Store API keys, SMS provider credentials and e-mail (SMTP) passwords are stored in the database encrypted with AES-256-GCM; once saved, they are never displayed again in the interface.
  • E-mail delivery logs do not store the message body; only the recipient, subject and delivery result are kept. Tokens in verification and password-reset links are stored as irreversible hashes, never in plain form.
  • Passwords are stored as irreversible hashes (bcrypt); plain-text passwords are never stored.
  • Accounts can be protected with optional two-step verification (a one-time code by SMS or e-mail). Verification codes are likewise stored only as irreversible hashes and expire after a short time.
  • Card details never reach the Platform's servers; payment pages are served by PayTR.
  • Server access is role-based and logged.

3. Cookies

The Platform uses only cookies that are strictly necessary for the service to work:

  • musterim_session — the strictly necessary cookie that keeps you signed in; encrypted and readable only by the server. It lasts until the browser is closed or you sign out.
  • musterim_2fa_trust — a cryptographically signed, strictly necessary cookie that marks the browser of a member who has completed two-step verification as a trusted device. While it is valid (10 days by default; set by the Platform administration), sign-ins from the same browser do not ask for a new SMS code. The cookie contains no personal data; it carries only a signed validity token. It is not created for members who have two-step verification switched off.
  • musterim_lang — a strictly necessary cookie that remembers your interface language (Turkish or English) so that pages are shown in the language you chose. It contains no personal data.

Strictly necessary cookies do not require consent; you can delete cookies from your browser at any time, but doing so ends your session and, if enabled, triggers a new two-step verification at your next sign-in.

Optional analytics cookies. On the public, legal and sign-in pages we may use Google Analytics (Google Ireland Ltd.) to measure visit statistics. Measurement starts only if you choose "Accept" in the cookie banner; without consent no Google script is loaded and no _ga / _ga_* cookies are set. IP addresses are anonymised, and analytics never runs on panel or administration pages. Your choice is stored for 180 days in the musterim_consent cookie and can be changed at any time via the "Cookie preferences" link in the footer. No advertising or tracking cookies are used.

4. Server Logs

For security and error diagnosis we keep access logs containing the IP address, date and time and request details; these logs are deleted automatically after a reasonable period.

5. Third Parties

Data is shared only with our hosting provider and our payment institution (PayTR), and only to the extent the service requires. Data is never sold to any third party or shared for marketing purposes. SMS and e-mail messages to customers are sent through the member's own provider account — the Platform does not send those messages under its own identity.

The only exception is security codes: when SMS is chosen as the two-step verification method, the one-time code (OTP) messages are delivered through the Platform's contracted SMS provider. These are transactional messages about the security of your account, not commercial messages, and only the member's telephone number and the code text are passed to the provider.

All data is stored on servers located in Türkiye. If you are located in the European Economic Area, the United Kingdom or elsewhere outside Türkiye, see Section 5 of the Privacy Notice for information about international transfers.

6. Account Deletion and Data Retention

Members can delete their own account from the Subscription section of the panel by confirming with a one-time code sent to their telephone or e-mail address. Upon deletion, the account and all data held on the Platform — store connections, customer records, order copies, coupons, campaigns, workflows and delivery logs — are deleted immediately and irreversibly; a single audit record consisting of the e-mail address and IP address is kept for the statutory limitation period. The account-deletion confirmation e-mail is a transactional message and is sent regardless of notification preferences.

Deletion covers only data on the Platform: orders, customers, products and previously created coupons in the member's e-commerce store (WooCommerce) remain unchanged in the store, and the Platform performs no write operation on the store during deletion. If the subscription is merely cancelled, data is not deleted; it is retained until the end of the paid period.

7. Breach Notification

If a security breach affecting personal data is detected, the Turkish Personal Data Protection Board, any other competent supervisory authority and the affected users are informed as soon as reasonably possible in accordance with applicable law.

8. Contact

For any privacy-related question: destek@musterim.net