Privacy policy
Effective date: September 15, 2026
Last updated: September 15, 2026
This privacy policy explains how mapps.one ("mapps.one", "we", "us") collects, uses and shares personal data when you use the mapps.one website, dashboard and API (together, the "Service"), and when people visit the public pages we host for apps. It also explains your choices and rights.
It covers two groups of people:
- Customers: anyone who creates an account or is invited to a workspace.
- Visitors: anyone who opens a smart link, landing page, legal page, press kit or QR code published with mapps.one, whether on mapps.one or on a customer's own domain.
1. Who is responsible
mapps.one, Sehit Osman Avci Mh Malazgirt 1071 Cd 50A-83 Etimesgut Ankara Turkiye, registration number 416258, is the controller of personal data about customers and of personal data we process for our own purposes. You can reach us at support@mapps.one or through our contact page.
- Representative in the European Union: [EU representative name and address, if appointed under Article 27 GDPR]
- Representative in the United Kingdom: [UK representative name and address, if appointed]
- Turkish Data Controllers' Registry (VERBİS): [Registration number, if applicable]
App pages are published by our customers, who decide what their pages contain and where they link. When we route visitors and provide analytics for those pages, we process visitor data on the customer's behalf, as a processor under the GDPR and the KVKK and as a service provider under the CCPA. We also process a limited part of that data as a controller for our own legitimate purposes: keeping the Service secure, preventing abuse and fraud, and improving the Service. Customers are responsible for informing their own users about their use of mapps.one. Our processing on behalf of customers is governed by our [Data Processing Addendum link].
2. Data we collect from customers
| Category | What it includes |
|---|---|
| Account details | Name, email address, password (stored only as a secure hash), preferred language, time zone and interface theme. Two-factor authentication settings if you turn it on. |
| Google sign-in | If you sign in with Google: your Google account ID, name, email address and profile photo URL. We never receive your Google password. |
| Workspace and team | Workspace names, members and their roles, and the email addresses of people you invite. |
| Content you publish | App names, descriptions, icons, screenshots, store links, developer name, website and contact email, social links, feature lists, press materials, answers to the legal document questionnaire and the generated documents. This content is public on your app pages by design. |
| Billing information | Billing name, email, country, city, address and tax ID; your plan, order amounts, currency, dates and references from our payment processors. We do not receive or store full card numbers. |
| Developer settings | API tokens (stored as hashes), webhook URLs, signing secrets (stored encrypted) and webhook delivery logs, including the payload sent and your server's response. |
| Security and activity logs | IP address, browser user agent and last activity time of signed-in sessions; a log of important actions, such as invitations, payments and changes to apps, with the IP address used; sign-in times. |
| Communications | Messages you send through the contact form (name, email, topic and message) and your emails with our support team. |
3. Data we process about visitors of app pages
Public app pages are designed to collect as little as possible.
When a page is requested
To answer any web request, our servers receive the visitor's IP address, user agent (browser and device details), the referring page if the browser sends one, and the requested URL, including any campaign tags. We use these in the moment to choose where to send the visitor and to derive the analytics described below.
What we store as an analytics event
- The type of event (link click, page view, store click or deep link open), the app and the time.
- The country, derived from the IP address by our content delivery network or a local geolocation database. The IP address itself is not stored with the event.
- Operating system and version, device type, device model, browser and in-app browser name, derived from the user agent. The full user agent string is not stored with the event.
- The referring website's host name and a traffic source category.
- UTM source, medium and campaign tags from the URL.
- The destination the visitor was sent to, the A/B test variant shown (if any) and the custom domain used (if any).
- A pseudonymous visitor identifier: the first 16 characters of a SHA-256 hash of the IP address and user agent, combined with the app, the current date and a secret key. It changes every day and differs for every app, so it cannot be used to recognise a visitor on another day or across apps.
Automated traffic, such as search engine crawlers and link preview bots, is not recorded.
What we do not do on app pages
- We do not set cookies for analytics or advertising, and we do not use local storage or fingerprinting scripts to track visitors.
- We do not build visitor profiles, track visitors across websites or sell visitor data.
- The only cookies that can appear on app pages are one that keeps an A/B test variant consistent while the customer runs an experiment, and a language preference cookie when a visitor chooses a language. See our cookie policy.
Abuse reports
If a visitor reports an app page, we store the reason, the details they write, their email address if they choose to give it, and a hash of their IP address, which we use to limit duplicate reports.
Server and network logs
Our hosting and content delivery providers may keep short-lived technical logs, including IP addresses, to operate and protect the network. [Describe the log retention periods of the hosting and content delivery providers.]
4. How we use personal data and our legal bases
| Purpose | Data | Legal basis under the GDPR | Legal basis under the KVKK (Article 5) |
|---|---|---|---|
| Create and run your account, workspaces and apps, and host your pages | Account details, workspace and team, content | Performance of a contract (Art. 6(1)(b)) | Necessary for the establishment or performance of a contract (Art. 5(2)(c)) |
| Route visitors and provide analytics to customers | Visitor request data and analytics events | Legitimate interests of the customer and of us in operating app links and measuring their reach (Art. 6(1)(f)); as a processor, on the customer's instructions | Legitimate interests (Art. 5(2)(f)); as a processor, on the customer's instructions |
| Take payments, issue receipts, meet tax and accounting duties | Billing information | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | Contract (Art. 5(2)(c)); legal obligation (Art. 5(2)(ç)) |
| Send service emails, such as email verification, invitations, receipts, renewal reminders and security notices | Account details | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Contract (Art. 5(2)(c)); legitimate interests (Art. 5(2)(f)) |
| Keep the Service secure, prevent fraud and abuse, and handle reports | Security and activity logs, abuse reports | Legitimate interests (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)) | Legitimate interests (Art. 5(2)(f)); legal obligation (Art. 5(2)(ç)) |
| Provide support | Communications, account details | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Contract (Art. 5(2)(c)); legitimate interests (Art. 5(2)(f)) |
| Establish, exercise or defend legal claims | Relevant records | Legitimate interests (Art. 6(1)(f)) | Establishment, exercise or protection of a right (Art. 5(2)(e)) |
| Send product news and marketing emails [only if we send them] | Email address, name | Consent (Art. 6(1)(a)) | Explicit consent (Art. 5(1)), and consent for commercial electronic messages under Law No. 6563 |
5. Who we share personal data with
We share personal data only as described here. We do not sell personal data and we do not share it for cross-context behavioural advertising.
| Recipient | Purpose | Location |
|---|---|---|
| [Hosting provider] | Servers, databases and backups | [Hosting region] |
| [Content delivery network and DNS provider] | Delivering pages, TLS certificates, protection against attacks and country detection | [Regions] |
| [Email delivery provider] | Sending service emails | [Region] |
| [File storage provider] | Storing icons, screenshots and press assets | [Region] |
| Google sign-in, only if you choose it | United States and other countries | |
| Paddle (Paddle.com Market Limited and its affiliates) | Checkout, payment processing, tax and invoicing for payments in US dollars | United Kingdom and other countries |
| iyzico | Card payments in Turkish lira | Turkey |
| PayTR | Card payments in Turkish lira | Turkey |
| [Error monitoring provider, if used] | Diagnosing errors | [Region] |
Payment processors. When you pay in US dollars, Paddle is the merchant of record and reseller of your purchase. It processes your payment details, billing address and tax information as an independent controller under its own privacy notice. iyzico and PayTR are licensed payment institutions in Turkey that process your card details under their own privacy notices. We receive the payment result and transaction references, not your card number.
At your direction. Webhook endpoints and integrations you configure, such as Zapier, receive the event data you subscribe to. Members of your workspace can see its content and analytics according to their role.
Other disclosures. We may disclose personal data when the law requires it; to protect the rights, safety and property of our users, the public or mapps.one; and to a successor if our business is merged, acquired or sold, in which case this policy continues to apply.
6. International transfers
Our main servers are located in [Hosting region]. Some providers process data in other countries, including countries outside the European Economic Area, the United Kingdom and Turkey. When we transfer personal data internationally, we rely on adequacy decisions (such as the EU-U.S. Data Privacy Framework for certified recipients) or standard contractual clauses approved by the European Commission or the UK authorities. For transfers subject to Turkish law, we rely on the conditions in Article 9 of the KVKK, such as an adequacy decision, standard contracts notified to the Personal Data Protection Authority, or other appropriate safeguards. [Confirm the transfer mechanism used with each provider.]
7. How long we keep data
| Data | Retention |
|---|---|
| Account, workspace and app content | While your account exists. When you delete an app, workspace or account, the data is removed from our live systems immediately and from backups within [backup retention period]. |
| Analytics events | Up to 2 years, then deleted automatically. Your plan decides how much of this history you can see. Events are also deleted together with their app. |
| Signed-in sessions | Until you sign out, or until the session expires after 2 hours of inactivity. If you choose "Keep me signed in" or sign in with Google, you stay signed in on that browser until you sign out. |
| Workspace invitations | Until accepted or expired, then deleted. |
| Security and activity logs | [Audit log retention period] |
| Webhook delivery logs | [Webhook delivery log retention period] |
| Billing records and invoices | [Retention period required by tax and commercial law, for example 10 years] |
| Contact messages and abuse reports | [Support and abuse report retention period] |
We may keep data longer where the law requires it, or where it is needed to resolve a dispute or enforce our terms.
8. Your rights
For everyone
You can view and edit most of your account data in the dashboard, and you can delete your account at any time from your account settings. To exercise any right described below, email support@mapps.one. We may ask you to verify your identity. We respond within one month under the GDPR, within 30 days under the KVKK and within 45 days under the CCPA, unless the law allows an extension.
European Economic Area, United Kingdom and Switzerland
You have the right to access your personal data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting earlier processing. You can also lodge a complaint with your local data protection authority.
Turkey (Law No. 6698 on the Protection of Personal Data, "KVKK")
This policy also serves as our information notice under Article 10 of the KVKK. Under Article 11, you have the right to:
- learn whether your personal data is processed, and request information about the processing,
- learn the purpose of the processing and whether the data is used for that purpose,
- know the third parties in Turkey or abroad to whom your personal data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of your data under the conditions of Article 7,
- request that third parties who received your data be notified of a correction, deletion or destruction,
- object to a result against you that arises solely from automated analysis of your data,
- claim compensation for damage caused by unlawful processing.
You can send your request in writing to Sehit Osman Avci Mh Malazgirt 1071 Cd 50A-83 Etimesgut Ankara Turkiye, from your registered email address to support@mapps.one, or by other methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer free of charge within 30 days, unless the request involves a cost that the law allows us to charge. If your request is rejected or not answered, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
California
In the last 12 months we collected these categories of personal information: identifiers (such as name, email address and IP address); customer records and commercial information (such as billing details and purchases); internet or other electronic network activity (such as usage logs and app page analytics); approximate geolocation (country); and account login credentials, which we use only to authenticate you. We collect this information from you, from your browser or device, and from Google and our payment processors, for the purposes in section 4, and we disclose it to the service providers in section 5.
We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it. You have the right to know what personal information we collect, use and disclose; to request deletion; to request correction; and not to be discriminated against for exercising your rights. You can use an authorised agent to make a request. We treat Global Privacy Control signals as a request to opt out of sale and sharing, even though we do neither.
Visitors of app pages
Because our analytics use a pseudonymous identifier that changes daily and no cookies, we usually cannot connect analytics events to a specific person. For questions about an app or its data practices, please contact the developer named on the app's page first. We will help customers respond to requests where we can.
9. Security
We protect personal data with encryption in transit (HTTPS), hashed passwords and API tokens, encrypted storage of secrets such as webhook signing secrets and payment credentials, optional two-factor authentication, role-based access for workspace members, restricted staff access and monitoring. No system is completely secure. Please use a strong, unique password and tell us at support@mapps.one if you notice anything suspicious.
10. Children
The Service is intended for businesses and adults. You must be at least 18 years old, or the age of majority where you live, to create an account, and we do not knowingly collect personal data from children to create accounts. App pages may promote apps that are used by children. Analytics on those pages are limited as described in section 3, and developers of apps for children are responsible for complying with the laws that apply to them, such as COPPA. If you believe a child has given us personal data, contact us and we will delete it.
11. Automated decisions
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. To protect visitors, an app page is suspended automatically when several abuse reports about it are open at the same time. A member of our team then reviews the case, and the developer can contact us to ask for the decision to be reconsidered.
12. Changes to this policy
We will update this policy when our practices change. If we make material changes, we will notify customers by email or in the dashboard [at least 30 days] before they take effect. The date at the top of this page shows when it was last updated.
13. Contact
mapps.one
Sehit Osman Avci Mh Malazgirt 1071 Cd 50A-83 Etimesgut Ankara Turkiye
Privacy: support@mapps.one
Support: support@mapps.one