PRIVACY & DATA

Privacy Notice

Draft revision: 2026-10-25 · Replace all marked fields and review with counsel before any public launch.

1. Data controller and scope

[LEGAL NAME] (the “Controller”) operates PayTOmuro. This notice covers the customer portal, quote requests, account access, order tracking and checkout redirects.

2. Data we process

• Account access: email address, one-time sign-in token hash, session identifiers and timestamps.
• Guest and account orders: contact email, order reference, character name, game region and server, class, item level, selected goal, notes, quote and order status.
• Contract records: the terms/privacy notice version accepted and the acceptance time.
• Payment details: card information is entered on the payment provider’s hosted page. PayTOmuro does not request or store card number, security code or expiry date. For iyzico checkout, the site sends the buyer and billing fields required by the provider; the national identification number is sent to iyzico and is not stored in the PayTOmuro order database.
• Security: limited request metadata needed to rate-limit sign-in and order abuse. [CONFIRM LOGGING AND RETENTION SETTINGS BEFORE LAUNCH.]

3. Purposes and legal grounds

Data is used to create and secure accounts, respond to quote requests, perform and track orders, prevent abuse, process payments, meet accounting/legal obligations and handle disputes. The final legal basis for each purpose must be confirmed for the markets where the service is offered.

4. Providers and recipients

Depending on the enabled setup, data may be processed by Cloudflare (hosting, Worker and D1 database), Resend (transactional sign-in/order email), iyzico (card checkout), and BTCPay Server (crypto invoices, if enabled). Do not enable a provider until its role, processing terms, region, retention and transfer safeguards have been reviewed and described here.

5. International transfers

Some infrastructure providers may process data outside the customer’s country. Before launch, specify each provider’s processing locations and the applicable transfer mechanism/safeguards: [COMPLETE PROVIDER AND TRANSFER DETAILS].

6. Retention

One-time sign-in links expire after 10 minutes; server sessions expire after 7 days. Order, payment, accounting and legal records are retained for [SET A PERIOD BASED ON APPLICABLE LAW AND BUSINESS NEED], then deleted or anonymised. Local file-preview data remains in the browser storage until the user clears it.

7. Security

The hosted implementation uses HTTPS-only, HttpOnly and SameSite session cookies, hashed one-time tokens, server-side role checks and rate limits. Payment secrets remain server-side. No security measure eliminates all risk; contact yaydim.pazarlama@gmail.com if you identify a vulnerability.

8. Your rights and contact

Depending on applicable law, you may request access, correction, deletion, restriction, objection or a copy of your data. Contact yaydim.pazarlama@gmail.com and include enough information to locate the request without sending passwords, payment card data or game credentials.

9. Cookies and local storage

The hosted service uses a strictly necessary session cookie. The static local preview uses browser session/local storage for demo account and order data. No advertising or analytics tracker is included in this build. Game artwork and web fonts may be requested from their source hosts when the page loads; self-hosting/licensing should be reviewed before commercial launch.

Terms · Service Agreement · Cancellation & Refunds · Seller Information