1. Who we are
| Controller | CY Soft Solutions |
|---|---|
| Address | KKTC |
| [email protected] | |
| Phone | +905453992946 |
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Identity | Full name, (optional) national ID number | Order and contact forms |
| Contact | E-mail, phone, address, city, country | Order and contact forms |
| Order | Order number, plan, amount, license key, the site the license is for, order note | Order form |
| Billing | Company name, tax office, tax number, payment details shown on the bank transfer | Order form, bank |
| Security | IP address, browser (user agent), timestamps, form submission records | Automatic |
| Communication | Messages you send through the contact form or WhatsApp | Contact form, WhatsApp |
We never ask for or store credit card details, and we do not process special categories of data.
3. Why we process it (legal bases)
| Purpose | Legal basis |
|---|---|
| Taking your order, matching your payment, delivering your license key | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation |
| Answering support requests and messages | Contract; legitimate interest |
| Preventing abuse, spam and fraud; keeping the site secure | Legitimate interest; legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interest |
We do not send marketing e-mails. If we ever want to, we will ask for your consent first.
4. Who we share it with
- Hosting and e-mail providers, to run the website and send e-mails.
- Banks, to confirm your bank transfer.
- Our accountant, for invoices and statutory records.
- Authorities, when legally required.
The site loads fonts and interface libraries from content delivery networks (Google Fonts, jsDelivr, Tailwind CDN), which receive your browser’s IP address. If you message us on WhatsApp, your messages pass through WhatsApp/Meta servers. These providers may be located outside your country.
5. Cookies
We only use the strictly necessary mvsid session cookie, which keeps your session and protects forms (CSRF). It is deleted when you close the browser. We use no advertising, analytics or tracking cookies.
6. How long we keep it
| Data | Retention |
|---|---|
| Orders, invoices and payment records | 10 years (statutory) |
| License records | License term + 10 years |
| Contact messages | 2 years after the request is closed |
| Form rate-limit records (one-way hash of the IP) | 24 hours |
| Server access logs | 1–2 years (statutory) |
7. The Migvora plugin
The Migvora WordPress plugin runs on your own server. Your backups, database and site content are never sent to us; you decide where they are stored (your server, your own Google Drive, Amazon S3 or FTP/SFTP account).
- Google Drive (optional): Google sign-in goes through our connection service, which only hands the access token to your site. It never sees or stores your backup files. Drive access is limited to files created by Migvora.
- Telegram (optional): if you connect @MigvoraBot, your chat ID, display name and site address are kept on our connection service. Notification text (site address, backup name and size, destination, duration, error message if any) passes through it but is not stored. Send
/stopto the bot at any time to disconnect. - License check: when you activate a Premium license, the license key and your site address are sent to us to check that the license is valid.
8. Your rights
You can ask us whether we process your data, get a copy of it, have it corrected or deleted, restrict or object to processing, ask for data portability, learn who it was shared with, and complain to a data protection authority (in Turkey, the Personal Data Protection Board; in the EU, your local supervisory authority).
9. How to contact us
Write to [email protected], preferably from the e-mail address you ordered with. We reply free of charge within 30 days.
10. Security
Connections are encrypted with SSL/TLS. Only authorised staff can access the admin panel, passwords are stored as one-way hashes, and forms are protected against CSRF and abuse. If a data breach occurs we will notify the authorities and affected people as required by law.
11. Changes
We may update this policy from time to time. The current version is always published on this page, and customers are e-mailed about important changes.