Terms of Service

1. Parties and Subject Matter

These Terms of Service (the "Terms") govern the software service made available at musterim.net (the "Service" or the "Platform") and are entered into between ANADOLUDAN YÖRESEL ÜRÜNLER SANAYİ ve TİCARET LTD. ŞTİ. (the "Provider", "we" or "us"), a company established in the Republic of Türkiye, registered address Hasanbey Mah., Hasanbey Cad., 61/B, Gümüşhane, Türkiye, Central Registry (MERSİS) No. 0069119000200001, e-mail destek@musterim.net, telephone 0850 309 4530, and the natural or legal person who registers for the Service (the "Member" or "you").

The Terms take effect when you confirm your registration electronically. They form a contract concluded at a distance by electronic means. The Service is designed for businesses that operate an online store; by registering you confirm that you are acting in the course of a trade, business or profession, or that you are otherwise authorised to bind the business on whose behalf you register.

2. Scope of the Service

• The Service is a cloud-based software (SaaS) that lets the Member connect an e-commerce store through its API, synchronise order data, analyse customers (RFM segmentation), generate coupons and deliver those coupons to customers via WhatsApp, SMS or e-mail.
• The Service also lets the Member define campaigns (shared coupon codes and one-to-one or bulk announcement of the campaign to customers), add customers manually who did not come from the connected store (for example, walk-in or social media customers), and view an earnings report based on coupon redemptions.
• Supported platform: WooCommerce (REST API). The list of supported platforms may be extended or changed over time.
• Each plan is limited in the number of orders synchronised per store and the number of stores that may be connected; current limits are published on musterim.net. When a limit is exceeded, synchronisation is restricted to the most recent orders.
• Delivery channels and sender identity:
  • WhatsApp: messages are sent from the Member's own device and account, with the Member's confirmation.
  • SMS: messages are sent through the Member's own SMS provider account and the Member's own approved sender ID. SMS charges are a matter between the Member and its provider.
  • E-mail: messages are sent through the Member's own e-mail (SMTP) account and from the Member's own sender address.
  The Provider does not send commercial electronic communications on the Member's behalf under its own identity; the Member is the sender in every case. The sole exception is one-time verification codes (OTP) sent by SMS to protect the Member's own account. Such messages are transactional, not commercial, and are delivered through the Provider's contracted SMS provider.

3. Account Registration and Security

• The Member must provide accurate and current information at registration and keep it up to date.
• The Member is responsible for the security of its account and password; all actions taken through the account are attributed to the Member.
• The Member may protect the account with SMS-based two-step verification. A Member who enables this feature is responsible for ensuring that the registered telephone number belongs to the Member and is current. After a successful verification the browser used may be marked as a "trusted device" for a limited period; the Member bears the risk arising from this marking on shared devices or devices accessible to others.
• The Member represents that it is authorised to register the store API credentials on the Platform.

4. Fees, Payment and Renewal

• The Service is provided under paid subscription plans. Prices are shown in the currency selected at checkout (TRY, USD, EUR or GBP) and include Turkish VAT where applicable; the Member remains responsible for any taxes, duties or bank charges that apply in its own jurisdiction. Current prices and plan features are published on musterim.net.
• Card payments are processed by PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., a licensed payment institution in Türkiye. Card details are never stored by the Provider.
• The subscription renews automatically at the end of each billing period on the same terms. The Member may stop renewal at any time before the end of the period using the "Cancel subscription" option in the Subscription section of the panel. After cancellation the Service remains fully available until the last day of the paid period; the Member's data is retained during that time and the Member may reverse the cancellation before the period ends. No partial refund is made for a paid period.
• Price changes are notified to existing subscribers by e-mail at least 30 days in advance and take effect at the next renewal.

5. Right of Withdrawal and Refunds

The Service is a digital service that is performed immediately upon activation of the subscription. By completing the purchase the Member expressly requests that performance begins immediately and acknowledges that, once performance has begun, no statutory right of withdrawal (or "cooling-off" right) applies to the extent permitted by applicable law, including Article 15/1-ğ of the Turkish Distance Contracts Regulation. Subscription fees are non-refundable except where a refund is required by mandatory law. Full information about the scope and features of the Service is available on musterim.net before purchase.

6. Data Processing Terms

This section and Annex 1 (Data Processing Addendum) set out the controller — processor relationship between the parties under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies to the Member, the EU/UK General Data Protection Regulation ("GDPR").

• Roles. With respect to personal data of the Member's store customers, the Member is the controller and the Provider acts solely as processor, processing that data only to provide the Service and only on the Member's documented instructions. With respect to the Member's own account, subscription and billing data, the Provider is the controller.
• Processing on instructions. The Provider does not use store customer data for its own purposes; it does not sell it, share it for marketing, or combine it with data of other Members.
• Confidentiality. Provider personnel with access to the data are bound by confidentiality obligations; access is limited to what is strictly necessary for their role.
• Security. The Provider implements the technical and organisational measures listed in Annex 1 (TLS in transit, AES-256-GCM encryption of API keys and of e-mail and SMS credentials, irreversible hashing of passwords, role-based access, logging).
• Sub-processors. The Provider uses the sub-processors listed in Annex 1 to provide the Service. The Member will be informed before a new sub-processor is engaged and may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Member may terminate the affected part of the Service.
• Data subject requests. If a store customer submits a request under KVKK Article 11 or GDPR Chapter III to the Provider, the request is forwarded to the Member, and the Provider gives the Member reasonable technical assistance in responding to it.
• Breach notification. The Provider notifies the Member without undue delay after becoming aware of a personal data breach affecting data it processes, and provides the information the Member needs to meet its own notification duties to the competent supervisory authority.
• Return and deletion. When a store connection ends, the related store customer data is deleted or anonymised within a reasonable period; when the Member deletes its account, all data is deleted immediately (Section 9). Before termination the Member may request a copy of its data.
• Data location and international transfers. The Provider stores and processes data on servers located in Türkiye and does not transfer it elsewhere. Members located outside Türkiye (including the EEA, the United Kingdom and North America) acknowledge that using the Service involves transferring their store customer data to Türkiye, and are responsible for ensuring that such a transfer is lawful under the data protection law applicable to them. Where the Member connects an e-mail or SMS provider of its own choice that is located in another country, the Member is responsible for the lawfulness of that transfer.
• Further details are set out in the Privacy Notice and the Privacy & Cookie Policy.

7. Commercial Electronic Communications

For SMS and e-mail messages sent to its customers, the Member is the sender within the meaning of the Turkish Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communications, and of any equivalent anti-spam or e-marketing law applicable to the Member (for example the ePrivacy rules in the EU, PECR in the UK, CAN-SPAM in the United States and CASL in Canada). The Platform is only a technical tool that facilitates sending.

• Consent and opt-in registers. Obtaining prior consent from recipients of commercial messages and, where required, recording that consent in the Turkish Message Management System (İYS) or any equivalent register is solely the Member's responsibility. The Member represents and warrants that it holds valid consent for every recipient it messages.
• Bulk SMS. Before a bulk SMS send (such as a campaign announcement) starts, the Platform asks the Member to confirm expressly that the recipients have given valid consent, and records that confirmation (with its date and scope) as evidence. The daily sending volume and time window are set by the Member; the rate limits and scheduling applied by the Platform do not relieve the Member of its responsibility as sender.
• Sender identification. The Member must enter its legal name and contact details in the footer field of the Settings section; this information is placed at the bottom of every e-mail sent.
• Opt-out. The Platform automatically adds an "unsubscribe" link and a one-click unsubscribe header (List-Unsubscribe) to every commercial e-mail. Recipients who opt out receive no further e-mail from the same store; this protection cannot be disabled by the Member.
• Liability. Administrative fines and third-party claims arising from unsolicited messages, misleading content or missing sender identification are borne by the Member. If a sanction is imposed on the Provider for such reasons, the Member indemnifies the Provider for the resulting loss.
• Suspension. If the Provider detects sending that breaches applicable law or generates a high volume of complaints, it may temporarily suspend the affected channel after notifying the Member.

8. Service Levels and Limitation of Liability

• The Provider uses reasonable efforts to keep the Service available without interruption; planned maintenance is announced in advance where possible.
• The Provider is not responsible for changes to or outages of WooCommerce, WhatsApp or other third-party services.
• The Service is provided "as is". To the fullest extent permitted by applicable law, the Provider excludes all implied warranties, including warranties of merchantability, fitness for a particular purpose and non-infringement.
• To the fullest extent permitted by applicable law, the Provider's total aggregate liability under or in connection with these Terms is limited to the subscription fees paid by the Member for the one-month period immediately preceding the event giving rise to the claim; the Provider is not liable for indirect or consequential loss, loss of profit, loss of business or loss of data. Nothing in these Terms excludes liability that cannot be excluded by law, including liability for gross negligence or wilful misconduct.

9. Termination and Account Deletion

• Cancelling the subscription (Section 4) does not close the account; the Member's account and data are retained so that the Member can subscribe again.
• Closing the account (account deletion). The Member may close its account at any time using the "Permanently delete account" option in the Subscription section of the panel. To prevent unauthorised deletion, the request is confirmed with a one-time code sent to the Member's verified telephone number or e-mail address. Upon confirmation the Member's account and all data held on the Platform — connected store records, synchronised and manually added customer records, order copies, coupons, campaigns, workflows and delivery logs — are deleted immediately and irreversibly. Only a single audit record consisting of the e-mail address and IP address, showing that the account was deleted, is kept for the statutory limitation period. The unused remainder of a paid period is not refunded.
• Data in the Member's store is not affected. Account deletion covers only data on the Platform. Orders, customers, products and coupons previously created through the Platform remain unchanged in the Member's e-commerce store (WooCommerce). The Provider performs no write operation on the Member's store during deletion. Removing the API key configured in the store is at the Member's discretion.
• If the Member uses the Service in breach of these Terms, applicable law or third-party rights, the Provider may suspend or terminate the account; in that case the Member's data is deleted within a reasonable period.

10. Intellectual Property

All rights in the Platform's software, design, logo and content belong to the Provider. The Member is granted only a non-exclusive, non-transferable, revocable right to use the Service for the duration of its subscription. The Member retains all rights in the data it uploads to or synchronises with the Platform.

11. Force Majeure

In circumstances beyond the reasonable control of the parties, such as natural disaster, war, epidemic, or large-scale internet or power outages, the affected obligations are suspended until the impediment ceases.

12. Changes to these Terms

The Provider may update these Terms. Material changes are notified to the Member by e-mail. Continued use of the Service after a change takes effect constitutes acceptance of the updated Terms; a Member who does not accept the change may cancel its subscription under Section 4.

13. Governing Law and Jurisdiction

These Terms are governed by the laws of the Republic of Türkiye. Members who qualify as consumers may apply to the Consumer Arbitration Committees and Consumer Courts of their place of residence in Türkiye and, where mandatory consumer-protection rules of another jurisdiction apply to them, retain any rights those rules grant. All other disputes are subject to the exclusive jurisdiction of the Courts and Enforcement Offices of Gümüşhane, Türkiye.

Annex 1 — Data Processing Addendum

This Annex forms an integral part of Section 6 and describes the scope of the processing that the Provider carries out as processor.

a) Subject matter, purpose and duration

• Subject matter: synchronising order and customer records from the Member's store (or customer records added manually by the Member), segmenting them, generating coupons, preparing campaign announcements and delivering them through the chosen channel, and reporting coupon redemptions.
• Purpose: provision of the Service only; no processing for any other purpose.
• Duration: for as long as the membership or store connection continues; deletion or anonymisation within a reasonable period after it ends.

b) Categories of data and data subjects

• Data subjects: customers who have purchased from the Member's store and customers the Member has added to the Platform manually.
• Categories of data: name, telephone number, e-mail address, order details (date, amount, products, status, coupon codes used), the source note entered by the Member for manually added records, calculated segments and scores, generated coupon and campaign records, delivery logs (channel, date, result; including campaign mention and bulk SMS queue records), e-mail validity flags and e-mail opt-out requests.
• No special categories of personal data are processed; the Platform is not designed for entering such data.

c) Sub-processors

• Hosting: the Türkiye-based hosting provider on whose servers the Platform runs.
• PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş.: solely for the Member's subscription payments; no store customer data is shared.
• The Provider's contracted SMS provider: solely for delivering one-time verification codes (OTP) sent for the Member's account security (the Member's telephone number and the code text); no store customer data is shared.
• SMS and e-mail providers chosen by the Member: because messages are sent through the Member's own account, the relationship with these providers is directly between the Member and the provider; the choice of provider and its lawfulness are the Member's responsibility.

d) Technical and organisational measures

• SSL/TLS encryption of all traffic.
• AES-256-GCM encryption of store API keys and of SMS and e-mail credentials in the database; these values are never displayed again in the interface.
• Storage of Member passwords only as irreversible hashes (bcrypt).
• Rate limiting of login attempts, bot protection and logging of failed logins.
• Role-based access; logging of server access.
• No storage of e-mail bodies in delivery logs (only recipient, subject and result are kept).

e) Member obligations

• To provide the information required by KVKK Article 10 (and, where applicable, GDPR Articles 13–14) to store customers and to persons added manually to the Platform, and to obtain consent where required. For manually added records, obtaining the person's details lawfully is exclusively the Member's responsibility.
• To obtain consent for commercial electronic communications and to record it in İYS or any equivalent register (see Section 7).
• To transfer to the Platform only data it is authorised to process, and not to share account access with unauthorised persons.