Privacy Policy
Last updated: 9 กรกฎาคม 2569
Contents
Overview
This policy explains what personal data DOJILAB processes and why, who we share it with, how long we keep it, and your rights. It is written with the principles of Turkey's KVKK and the GDPR in mind; country-specific detail is in the KVKK Notice and GDPR Notice pages.
Data controller
The controller of your personal data is PAX GROUP DOO. Requests for access, rectification, erasure, restriction of processing, objection and data portability can be sent to contact@paxgroupglobal.com. The full contact details are in the block at the end of this page.
Categories of data and retention
มีเพียงข้อมูลด้านล่างเท่านั้นที่ถูกประมวลผลเพื่อให้บริการ คุกกี้เชิงวิเคราะห์และการตลาดอยู่ภายใต้นโยบายคุกกี้
| Data | Scope | Retention |
|---|---|---|
| Account data | Name, email, password hash, language preference, consent timestamp | Until the account is deleted |
| Phone | Phone number and verification status (anti-bot / real-user check) | Until the account is deleted |
| Chart images | Screenshots you upload (private, access-restricted storage) | Until account deletion; rejected/inappropriate uploads deleted immediately |
| Analysis reports | AI-generated technical-outlook reports | Until the account is deleted |
| Audit and log data | Security events (register, login, analysis), IP address, device/browser info | Limited period for security |
| Quota counters | Monthly analysis usage counts | Per month; until account deletion |
Purposes of processing
Your data is processed for, and limited to, the following purposes.
| Purpose | Detail |
|---|---|
| Providing the Service | Creating and managing your account and access |
| Producing analyses | Generating technical-outlook reports from your charts |
| Security | Preventing abuse and running quota and fraud checks |
| Communication | Sending transactional email/SMS (verification, key notices) |
| Legal obligation | Meeting statutory retention and reporting duties |
Legal bases
Each processing activity relies on one of the legal bases below.
| Legal basis | Applied to |
|---|---|
| Performance of a contract | บัญชีและการวิเคราะห์ (KVKK 5/2-c; GDPR 6/1-b) |
| Explicit consent | Risk consent and international transfers (KVKK 5/1, 9; GDPR 6/1-a) |
| Legitimate interest | Security, logging and abuse prevention (KVKK 5/2-f; GDPR 6/1-f) |
| Legal obligation | Statutory retention duties (KVKK 5/2-ç; GDPR 6/1-c) |
Sub-processors
The following sub-processors are used to run the Service. Each accesses only the data needed for its function.
| Provider | Role | Region |
|---|---|---|
| Database & storage provider | Hosting account data and chart images | EU (Amsterdam) |
| Application hosting provider | Running the web app and API | Global / US |
| Cache / rate-limit provider | Quota and rate-limit counters | Global |
| AI model provider | Processing chart images for analysis | US |
| Email provider | Sending transactional email | Global / US |
| Phone verification provider | SMS phone verification | Global |
International transfers
Because some sub-processors are located abroad, your data may be transferred internationally. Such transfers rely on your explicit consent and/or appropriate safeguards such as standard contractual clauses, under KVKK art. 9 and GDPR Chapter V.
Retention periods
Your data is kept while your account is active and for as long as legal obligations require. Security and audit logs are kept for a limited period. After a deletion request, data is deleted within a reasonable technical timeframe; see the Data Retention & Deletion section.
Data security
We apply technical and organizational measures such as access control, encrypted transport, and private, access-restricted storage. No system is 100% secure, but we work to reduce risk to a reasonable level.
Your rights
You have the rights of access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent. Requests can be made to the contact address below and are answered within the statutory period (at most 30 days).
Children's data
The Service is not directed to persons under 18, and we do not knowingly collect data from children. If we learn we have processed a child's data, we delete it.
Changes to this policy
We may update this policy. Material changes are announced in the Service or by email, and the current version is always published on this page.
Contact
For all privacy requests, use the data controller's contact details below.
Business and data-controller details
- Legal name
- Mert Gül
- Address
- Tekirdağ, Türkiye
- Data controller
- PAX GROUP DOO
- Controller address
- Zrtava Fasizma 46, Montenegro (PIB 03800709)
- Support
- contact@paxgroupglobal.com
- Legal notices
- contact@paxgroupglobal.com