ParaSende TR· EN

Privacy Policy

Effective date: 2026-05-27 · Last updated: 2026-05-27

ParaSende ("we", "the app") is a free mobile + web software for small and medium wholesale/retail businesses to manage inventory, customers, invoices, credit-sales debt and reports. This Privacy Policy explains what personal data we process, why, how long we keep it, who we share it with and your rights regarding that data.

1. Data controller

Controller: Yağız Karabulut (individual developer)
Country: Türkiye
Contact: destek@toptanpanel.com
Website: toptanperakende.online

2. Categories of data we collect

Category	Data	Source
Account	Full name, email, optional phone, business name, hashed password	User's in-app sign-up screen
Session	Device type (iPhone / Android / web), last sign-in time, session ID	Automatic (on sign-in)
Business data	Products, customers, invoices, debts, payment records, categories	Created by user inside the app
Uploaded files	Product images, business logo	Files uploaded by user
Technical logs	Request ID, HTTP method, status code, duration (ms), error trace	Generated automatically by the backend

Data we do not collect: location, contacts, microphone, persistent camera, health data, calendar, App Tracking Transparency identifiers, third-party advertising-network data — we do not request or collect any of these.

3. Why we process data and our legal basis

Service delivery (GDPR 6(1)(b), Turkish DPL 5/2-c — performance of a contract): create your account and let you sign in, store and serve your product/invoice/debt records.
Security and abuse prevention (GDPR 6(1)(f) — legitimate interests): approve new accounts before activation, detect anomalies in session logs, hash passwords to limit breach risk.
Service continuity: daily backups, debugging, performance monitoring.
Legal obligations (GDPR 6(1)(c)): lawful requests from competent authorities.

4. How long we keep your data

Active account data: as long as the account is active.
After an account-deletion request, active records are deleted within 14 days.
Backups (S3 / EBS snapshots) are rotated out within 30 days.
Records subject to legal retention obligations are kept for the period required by law.
Technical logs: at most 90 days.

5. Who we share data with

Your data is never sold, shared or rented for advertising or marketing. The only data sharing is:

Infrastructure providers: Amazon Web Services (AWS, Frankfurt — eu-central-1) — server (EC2), database (PostgreSQL on EC2), object storage (S3), backups. TLS in transit; AWS-managed encryption at rest.
Legal obligations: lawful written requests from Turkish or EU authorities.

No third-party advertising network, analytics (Google Analytics, Facebook Pixel, etc.), CRM or marketing-automation service is used.

6. Where data is stored and security measures

All data is stored in AWS Frankfurt (eu-central-1) — a GDPR-compliant region.
Passwords are irreversibly hashed with Argon2id (time_cost=3, memory=64MB, parallelism=4); plaintext passwords are not stored anywhere.
Sessions use JWT access + refresh rotation; password changes invalidate every session on every device.
The database runs in a private, isolated subnet with no public access.
Images are stored in a private S3 bucket and only ever exposed via short-lived presigned URLs.
Tenant isolation: a user from one business can never see another business's data.
Server access is SSH-key-only; fail2ban protects against brute force.
All traffic is HTTPS (Let's Encrypt with auto-renewal).

7. Children

ParaSende targets business owners 18+. We do not market to or knowingly collect data from children. If we discover that data from a minor has been collected in error, we will delete it upon request.

8. Cookies and similar technologies

We use no marketing, tracking or analytics cookies/SDKs. Only the technical storage strictly required to run the app (e.g. storing the session token) is used. Details: Cookie Policy.

9. Your rights

Under GDPR articles 12–22 (and Turkish DPL article 11) you have the right to:

be informed and access your personal data,
know the purposes of processing,
know the third parties to whom data is transferred,
request rectification,
request erasure or anonymization,
request data portability (export),
object to automated decision-making (we use none in the app),
seek compensation in case of damages.

To exercise these rights, email destek@toptanpanel.com. We aim to respond the same business day; statutory deadline is 30 days.

10. Policy updates

When this policy is updated, the "Effective date" and "Last updated" fields change. Significant changes (e.g. a new data category) are announced inside the app and on this page.

11. Contact

For any question, request or complaint about this policy or your personal data:
destek@toptanpanel.com