Privacy Policy

Version 2026-09-23In effect since September 23, 2026

This policy explains what personal data UXPLIMA collects, why, who it goes to, how long it is kept and what your rights are. It is also our information notice under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), and it covers the EU and UK General Data Protection Regulation (“GDPR”) for visitors from those countries.

1. Who is responsible

The data controller is Siraç Özmen, trading as UXPLIMA (Huzurevleri Mahallesi, 77048 Sokak, Çukurova, Adana, Türkiye; tax number 7030607904).

For anything about your personal data, write to privacy@uxplima.com.

Payments are handled by Tebex Limited (England and Wales, company number 08129184). Tebex is responsible for the data you enter on its payment page - card details, billing address and tax details - under its own privacy policy. We never see your card details.

2. What we collect and why

We collect this data electronically: from what you enter on the site, from your use of your account, from the products that check in with our licence server, and from the payment notifications Tebex sends us.

Your account

What: email address, username, preferred language, and whether you want our newsletter. If you register with a password, a one-way hash of it (never the password itself). If you sign in with Discord, Google, GitHub or Roblox, the ID that service gives your account and, if it sends one, your profile picture link and email address (Roblox does not provide an email, so the account gets a placeholder address). If you turn on two-factor authentication, its secret and backup codes, stored encrypted.
Sessions: for each signed-in session, the IP address and browser description (user agent) it started from, so you can see and sign out your sessions.
Consent records: when you register, which version of the Terms of Service you accepted and whether you chose to receive marketing email - with the time, IP address and browser - and each later change of that choice.
Password check: when you register with a password, we check whether it has appeared in a known data breach using Have I Been Pwned. Only the first 5 characters of a one-way hash of the password are sent; the password itself never leaves our server.
Service emails: we email you receipts, security notices, replies to your support conversations, notices about your licences, and notice of changes to these documents. These are part of running your account and are sent whatever your newsletter choice.
Why: to create and run your account and keep it secure (contract; legitimate interest in security), and to be able to show what you agreed to (legal obligation; legitimate interest).

Purchases

What: your orders - products, options, prices, discounts, coupon, and when they were placed, paid or cancelled - and the payment status and Tebex transaction ID. Tebex sends us notifications about each payment, which contain what you entered on its payment page, such as your name, email address and country.
What we send Tebex: only the products and prices in your order and a reference to it - not your name or email.
Why: to deliver what you bought, to keep order records as commercial law requires, and to handle refunds and disputes (contract; legal obligation).

Downloads

What: each time you download a file, which file, when, whether it completed, and the IP address and browser used. Downloaded ZIP files carry a notice with the order number and a download reference - not your name or email.
Why: to deliver your files and to trace leaked copies (contract; legitimate interest in protecting our products).

Licence keys and installations

Some products check in with our licence server while they run.

What: your licence (stored as a one-way hash, plus an encrypted copy so you can see your key again) and, for each installation: its IP address, an installation ID, a one-way hash of a device fingerprint, basic machine information (operating system and version, architecture, number of CPU cores, memory, runtime and version), the product version, and platform-specific status - for Minecraft servers the server software and version, port, player counts, TPS, memory and plugin version; for Roblox the place and universe IDs, player count and FPS; for websites and XenForo the host name, PHP version and web server or XenForo version - with when it was first and last seen.
Why: to enforce the number of installations your licence allows, to let you see and deactivate them, and to detect abuse (contract; legitimate interest).

Support

What: your tickets, the messages in them and any files you attach. If you invite someone to a ticket, we store their email address only as a one-way hash; an invitation expires after 14 days.
Why: to help you (contract; legitimate interest).

Reviews and favourites

What: your reviews (rating, text, status) and the products you saved as favourites.
Why: to show your review and your saved products (contract; legitimate interest).

What: your email address, language and subscription status, with the times you confirmed. Subscribing needs a confirmation by email (double opt-in).
Why: to send you the newsletter you asked for (your explicit consent, which you can withdraw at any time from any newsletter or your account). Unsubscribing deletes your address.

API keys

What: the name and prefix of each API key you create (never the key itself), and when and from which IP address it was last used.
Why: to let you manage your keys and spot misuse (contract; legitimate interest).

Security and site operation

Rate limiting: to stop abuse, our servers count requests per IP address in memory for 60 seconds at a time.
Security events: failed sign-ins, failed two-factor checks and blocked requests are logged with the IP address - but not your email address or username.
Server logs: record which address was requested, the result and how long it took - without IP addresses. Email addresses are masked in all logs.
Admin actions: changes made by our staff (for example a ban, a licence change or a refund-related action) are recorded in an audit log.
Page counts: we count page views without cookies - see the Cookie Notice. Your country, as reported by Cloudflare, is used once to choose which currency to show approximate prices in; it is not stored.
Why: to keep the site secure and working (legitimate interest; legal obligation).

We do not make decisions about you based solely on automated processing, and we do not sell your personal data.

3. Legal bases

Under KVKK Article 5 we rely on: the performance of a contract (5/2-c), our legal obligations (5/2-ç), the establishment, exercise or protection of a right (5/2-e), our legitimate interests without harming your fundamental rights (5/2-f), and your explicit consent for the newsletter (5/1). Under the GDPR Article 6 the corresponding bases are 6(1)(b), (c), (f) and, for the newsletter, (a).

Tebex Limited - United Kingdom; what for: Payments, tax, receipts, refunds (independent controller)
Cloudflare, Inc. - United States / global; what for: Serving the website, network protection, DNS, and storing our database backups
Resend - United States; what for: Sending our emails (receipts, verification, security notices, support replies)
Discord, Google, GitHub, Roblox - United States; what for: Only if you choose to sign in with them
Have I Been Pwned - Global; what for: Password breach check - receives only a partial hash, no personal data
Our hosting provider - Türkiye; what for: The server our database and files run on

We may also send order and licence events - IDs, never contact details - to automation we operate ourselves (for example a Discord bot). We disclose data to public authorities only when the law requires it.

5. Transfers abroad

Our servers are in Türkiye. Some of the providers above are in other countries, mainly the United States and the United Kingdom, and your data reaches them because running the site and delivering what you buy requires it. Each processes it under its own data processing terms; those of Cloudflare and Resend include the European Commission's standard contractual clauses. Tebex, as the seller, processes payment data as a controller under its own privacy policy, and a sign-in provider receives data only if you choose to sign in with it.

6. How long we keep data

Account and profile - Until you delete your account
Expired sessions and sign-in challenges - Deleted within 7 days of expiring
Download records - IP address and browser for 2 years, then removed; the record of the download stays
Licence installations - Until the installation stops checking in for 24 hours
Payment notifications from Tebex - Your personal details are removed after 1 year
Orders and payment records - As long as they are the record of what you own, and at least 10 years as Turkish commercial law requires; they hold no contact details, and are unlinked from you if you delete your account
Support tickets and attachments - 3 years after the ticket closes
Admin audit log - 5 years
Newsletter subscription - Until you unsubscribe
Database backups - Rotated: daily backups for 30 days, monthly backups for about a year

7. Deleting your account

You can delete your account from your account settings. We then delete your account, sessions, linked sign-ins, two-factor settings, trusted devices, consent records, reviews, favourites, cart, API keys, download records, the installations and history of your licences, and the support conversations you started with their files; messages you wrote in other people's conversations stay, without your name. We remove your details from the payment notifications Tebex sent us, and, if you tick the box, your newsletter subscription. Your licences are revoked. Orders and payment records are kept for the period above, no longer linked to you. Copies can survive in backups until those rotate out.

8. Your rights

Under KVKK Article 11 you have the right to learn whether your data is processed and to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the recipients in Türkiye and abroad; to ask for incomplete or incorrect data to be corrected; to ask for deletion or destruction under Article 7; to ask that recipients be notified of a correction or deletion; to object to a result that goes against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

Under the GDPR you have the rights of access, rectification, erasure, restriction, data portability and objection, and you can withdraw consent at any time.

Most of this you can do yourself: Download my data in your account settings gives you a copy of everything we hold about you, and Delete account erases it. For anything else, write to privacy@uxplima.com. We answer within 30 days. You may also complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or, in the EU or UK, to your local data protection authority.

9. Security

Traffic is encrypted in transit. Passwords are stored only as salted one-way hashes; two-factor secrets and licence keys are stored encrypted. Sign-in cookies are secure and cannot be read by scripts. Sensitive requests are rate-limited, and our staff's actions are logged. No system is perfectly secure; if you find a vulnerability, please tell us at security@uxplima.com.

10. Children

The site is not intended for anyone under 16, and we do not knowingly collect data from them. If you believe a child has given us personal data, write to privacy@uxplima.com and we will delete it.

11. Changes

We will publish any change to this policy here, with its version and the date it takes effect. We will tell you about material changes by email and with a notice on the site.