Privacy Notice (KVKK)

1. Data Controller

Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Makdos Bilişim Teknolojileri San. Tic. Ltd. Şti. as data controller, within the scope described below.

This notice covers the gmacros.com website, the customer panel, the GMacros add-in and macro packages, the GMacros CAM desktop application and the NirvanaAI service.

Address: Hürriyet Mh. Dumlupınar Cd. No:12, Kat:5, Daire:7, Yavuz Plaza, 34192 Bahçelievler/İstanbul

E-mail: info@gmacros.com

2. Personal Data Processed

• Identity and contact: name, e-mail address, phone, panel language preference
• Company and invoice details: legal name, tax number/office, address
• Trial and request forms: name, e-mail, phone, company, how you heard about us, your message and the IP address the form was sent from
• Transaction security: IP address, session logs, timestamps, e-mail verification and two-step verification records
• License and device data: license key; a device identifier derived from the computer's hardware (irreversible digest); computer name, operating system, application and Alphacam version; IP address and times of activation and verification; open-session records; usage counters for usage-based licenses
• Misuse records: detections of use contrary to the license terms, warnings shown and restrictions applied
• Orders and support: order history, selected plan, download records, support and reinstallation requests, messages
• Site visits and interaction: IP address, page visited, referring page, browser details, time of visit, WhatsApp button clicks and installer download records; approximate location (country/city) derived from the IP address and whether the IP belongs to a VPN or data-centre network. This lookup uses a local database on our server; your IP address is not sent to third parties for this purpose. If you are signed in to the panel, or the IP address matches one in your license records, these records are linked to your customer account.
• NirvanaAI content: the text you enter or the image you upload for generation, the generated model and generation records
• Payment: order and invoice details, bank transfer reference, payment transaction number and result. Your card details never enter our system; card payments are made on the bank's 3D Secure page and PayPal payments on PayPal's page.
• For time-limited licenses your computer's clock is compared with the server time; this information is not stored.

3. Purposes of Processing

• Creating your account, verifying your e-mail address and managing the account
• Taking the order, matching the payment, delivering the license key and the installer
• License activation and verification; ensuring a license is used on one computer and in one open session at a time; counting usage rights
• Preventing and detecting misuse (such as key sharing, use on several computers or repeatedly obtaining trials); showing a warning first and, if the misuse continues, stopping use remotely
• Assessing trial requests; matching e-mail, phone and device identifier against earlier requests so that the same person or computer does not receive another trial
• Fulfilling NirvanaAI generation requests
• Providing software updates and service notifications
• Handling support and reinstallation requests
• Site and service security; distinguishing automated requests (bots); visit and download statistics; notifying administrators so new requests are answered quickly
• Issuing invoices, statutory retention obligations and responding to requests from competent authorities
• Sending new product and release announcements if you have given explicit consent

4. Collection Method and Legal Grounds

Your personal data is collected electronically, partly or fully by automated means, through the forms on the site and panel, e-mail and WhatsApp correspondence, the connection the add-in or application makes to the license server, and server logs, and is processed on the following grounds under KVKK art. 5/2:

• Establishing or performing a contract (c): account, order, payment, license delivery, activation and verification, usage counters, NirvanaAI generation, support
• Fulfilling a legal obligation (ç): invoices and commercial records, requests from competent authorities
• Establishing, exercising or protecting a right (e): keeping records in license infringements and disputes
• Legitimate interest (f), provided your fundamental rights and freedoms are not harmed: preventing misuse, trial matching, site and service security, visit and download records and approximate location, administrator notifications
• Explicit consent (KVKK art. 5/1): newsletter and SMS announcements; analytics and ad-measurement cookies (see the Cookie Policy)

5. Transfers within Türkiye

Your data is hosted on servers in Türkiye. Limited to the purposes above, it may be transferred to the following groups of recipients:

• Payment institutions: the bank in Türkiye (Garanti BBVA) and payment service providers, to take card payments
• Hosting, e-mail and SMS service providers: to provide the service and deliver notifications
• Legal and financial advisers we work with: for legal obligations and the protection of rights, under a duty of confidentiality
• Competent public bodies and judicial authorities: where legally required

5a. Newsletter (Explicit Consent)

The e-mail address and optional mobile number you give in the newsletter form are processed only to send new product and release announcements by e-mail/SMS, on the basis of your explicit consent. The subscription does not start until the confirmation link sent to your e-mail is clicked (double opt-in); the time of consent and the IP address are recorded.

You can withdraw consent at any time with the unsubscribe link in every message or by writing to info@gmacros.com; your record is deleted.

6. Transfers Abroad (KVKK art. 9)

• PayPal: if you choose to pay with PayPal, the order details needed for payment are passed to PayPal; PayPal's own privacy notice also applies.
• NirvanaAI: the text you enter or the image you upload for generation is sent to artificial-intelligence service providers abroad so that the model can be generated. Only the content needed for generation is sent; your name, e-mail address and license details are not. Please make sure images do not contain personal data (e.g. photos of faces).
• Microsoft Store: if you install GMacros CAM from the Microsoft Store, the download is handled by Microsoft through your Microsoft account and Microsoft's privacy statement applies; we do not receive personal data about you from Microsoft for that download.
• Analytics and ad measurement: to Google, only if you consent — details in the Cookie Policy.

These transfers are made under the own terms of service, data processing agreements and privacy policies of the respective providers (PayPal, Microsoft, Google and the artificial-intelligence providers used by NirvanaAI); how these providers process data is explained in their own documents. Only the data needed for the respective service is passed to them.

The transfers rely on being necessary to perform the service you choose (NirvanaAI generation, paying with PayPal, installing from the Microsoft Store) (KVKK art. 9/6-b) and, for analytics and ad measurement, on the explicit consent you give through the cookie banner (art. 9/6-a). You do not have to use these options: you can pay by card or bank transfer, download the installer from the panel and decline cookies.

7. Retention Period

Your personal data is kept for the following periods:

• Account, license, activation (including computer ID) and support records: while the membership and license relationship continue and for 10 years after it ends (general limitation period under the Turkish Code of Obligations).
• Order, payment and invoice records, pre-order contract acceptance and panel download records: 10 years (Tax Procedure Law, Commercial Code; burden of proof under the Distance Contracts Regulation).
• Trial requests (name, e-mail, phone, IP, location): 2 years from the request. The computer ID on which a trial license was activated is kept with the license record.
• Warning and stop-of-use records: 2 years from the record being closed or its end date; if there is a dispute, until it is resolved.
• Visit, anonymous download and WhatsApp click records: 1 year.
• NirvanaAI inputs and generated models: 90 days from generation.
• Newsletter: until you withdraw consent.

Expired records are deleted or anonymised by an automatic maintenance job; where a statutory retention duty or an ongoing dispute exists, they are kept until it ends.

8. Your Rights (KVKK art. 11)

Under KVKK art. 11 you have the right to:

• learn whether your personal data is processed and, if so, request information about it
• learn the purpose of processing and whether the data is used in line with that purpose
• know the third parties in Türkiye or abroad to whom the data is transferred
• request correction if the data is incomplete or inaccurate
• request deletion or destruction under the conditions of KVKK art. 7
• request that correction, deletion or destruction be notified to the third parties the data was transferred to
• object to a result against you arising from analysis of the data exclusively by automated systems
• claim compensation if you suffer damage from unlawful processing

Warnings and decisions to stop license use are reviewed and taken by an administrator; you can object to them at info@gmacros.com.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your request — stating your name, Turkish ID number (for Turkish citizens) or nationality and passport/ID number (for foreigners), address for notifications, e-mail/phone if any, and the subject of your request — to info@gmacros.com from the e-mail address registered in our system, with a secure electronic or mobile signature, or via registered electronic mail (KEP).

Written applications: Hürriyet Mh. Dumlupınar Cd. No:12, Kat:5, Daire:7, Yavuz Plaza, 34192 Bahçelievler/İstanbul

Your request is concluded free of charge within 30 days at the latest; if the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is rejected, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board under KVKK art. 14.