KVKK privacy notice

This notice is for everyone who uses Mühür Mail or whose records are kept in Mühür Mail: organization owners and team members, users of the mailboxes organizations open, people who correspond with these mailboxes, people who apply to the partner program, visitors to muhurmail.com and anyone who writes to us through the contact form.

Mühür Mail is a product name. The business that provides the service, referred to in this notice as "we" or the data controller, is:

Our position regarding your personal data depends on the purpose of the processing and on whose behalf it is done.

• Data we control. Your Mühür Mail account (name, email, phone, password), organization and billing details, subscription records, partner applications, support conversations, the contact form, website visits and records kept for the security of the service. We decide for what purpose and how this data is processed.
• Data we process on behalf of organizations. Records kept or created in Mühür Mail for an organization's email service: the mailboxes the organization opens and their users, message content and attachments, message headers and delivery records, contacts, aliases, groups, rules and mailbox settings. The data controller for these records is the organization concerned. We process this data only on the organization's instructions and to provide the service; the platform team does not read message content.

Data we process as a data controller:

• Identity and contact: first name, last name, email address, phone number.
• Account and transaction security: an irreversible hash of your password, verification codes, session and device details, IP address, login and activity records.
• Organization details: organization name and type, legal name, tax ID and tax office, address, contact details and sector.
• Subscription and billing: billing name, Turkish ID or tax number, tax office, address, the chosen plan and payment status. Card details never reach Mühür Mail; they are entered on the payment institution's page.
• Partner program: the identity, contact, tax and bank details in the application form; referral and commission records.
• Support and contact form: the content of your message and the organization name you give.
• Mühür Assistant usage: the messages you write to the assistant, its replies, the actions you approve and your monthly usage count.
• Marketing consent: your email and SMS preferences, if you gave consent.
• Cookies: session and preference data; analytics data if you consent (cookie policy).

As a data processor, we process the following data as part of an organization's email service: the mailbox user's name and email address; the content, attachments and header details (sender, recipients, subject, date) of incoming and outgoing messages; sender authentication and spam check results; delivery and bounce records; contacts, aliases, groups, rules and mailbox settings.

As a data controller, we process your data on the following grounds listed in KVKK art. 5:

• Establishing and performing a contract (art. 5/2-c): opening an account and logging in, registering an organization, the subscription, payment and invoicing, running the partner program, answering support requests, and mandatory service notifications.
• Legal obligation (art. 5/2-ç): keeping records required by tax and commercial legislation, and requests from authorized institutions.
• Establishing, exercising or protecting a right (art. 5/2-e): records that must be kept as evidence in case of a dispute.
• Legitimate interest (art. 5/2-f): account and service security, preventing spam and misuse, fixing bugs, and improving the service through aggregate usage measurements that don't identify individuals.
• Explicit consent (art. 5/1): sending commercial electronic messages and optional analytics cookies. You can withdraw your consent at any time.

For records we process as a data processor, the purpose and legal ground are set by the organization concerned (for example, providing business email to its employees, corresponding with its customers and suppliers). The organization is responsible for informing its mailbox users and the people it corresponds with and, where necessary, obtaining their explicit consent.

Your data is collected, by automated or partly automated means, from you through the muhurmail.com website, the web dashboard, webmail, the mobile app, IMAP and SMTP connections, the contact form and email; from records organizations enter in the dashboard; and from messages received by and sent from mailboxes, together with the delivery results returned by recipient servers.

Personal data is shared only as far as necessary and limited to the purpose, with the following groups of recipients:

• Server, database, file storage, backup and email delivery service providers.
• Payment institutions for subscription payments (iyzico; Stripe if the foreign card option is on).
• Recipients' email servers, to deliver messages; if sending goes through an intermediate server (relay), the provider of that service.
• For SMS, the Netgsm or Twilio account the organization connects.
• Apple and Google notification services, to deliver mobile notifications.
• Providers of AI language model services, to generate Mühür Assistant replies; only the content needed to answer the question concerned is sent, and message content is never sent without the organization's explicit permission.
• Public institutions authorized by law and, in case of a dispute, our legal advisers.

Some of these providers may have servers abroad. Transfers abroad are made in line with KVKK art. 9: to countries with an adequacy decision, with appropriate safeguards such as the standard contracts announced by the Board, or in the incidental transfer cases listed in the law. The location of the servers where messages are stored will be stated in this notice before the service opens.

• Account, subscription and billing records: for the duration of membership and, after it ends, for the period required by tax and commercial legislation.
• Security and access records: for the period required by the relevant legislation.
• Support and contact form conversations: for a reasonable period after the request is resolved, for possible disputes.
• Records processed on behalf of organizations (mailboxes and messages): for the duration of the service and according to the retention settings the organization chooses; when the organization is deleted or the organization requests it, they are deleted or anonymized, subject to statutory retention obligations.
• Marketing consent: until it is withdrawn.

Under KVKK art. 11, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties to whom it has been transferred; to request its correction if it is incomplete or inaccurate, its deletion or destruction when the legal conditions are met, and notification of these actions to the third parties to whom it was transferred; to object to an outcome against you resulting from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

You can submit your application to info@muhurmail.com from the email address registered to your account, or in writing to Ahmet Aksungur (Aksungur Yazılım), Karşıyaka Mah. 3923 Sk. Tez Apt. No: 2 İç Kapı No: 1 Kepez / Antalya. Your application is concluded free of charge within 30 days at the latest; if the process involves an additional cost, the fee set by the Personal Data Protection Board may apply. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board.

You can delete your Mühür Mail account yourself in the account settings in the app; records subject to statutory retention obligations are kept for that period.

This notice is updated when necessary. The current version is published on this page; the "Last updated" date at the top of the page applies.