Privacy Policy

Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data in connection with the MGVault service is processed by MGVault (“MGVault”, “we”) as the data controller.

For any question or request about your personal data, contact us at muhammed@aliguc.com.

For organization accounts, the organization may also act as a data controller for the decisions it makes about its own members and vaults; in that case MGVault acts as a data processor providing the service to the organization.

Your master password never leaves your device and is never sent to us. Your vault items, including passwords, two-factor secrets, notes and their names, are encrypted on your device before they reach our servers. Decryption keys exist only with you and the people you grant access to. MGVault cannot access or read your vault contents and cannot hand them to anyone in readable form.

• Account data: email address, language preference, account creation and verification details.
• Authentication data: a hash of the verifier derived from your master password on your device, key derivation parameters, your public keys and keys encrypted with your own key; if you use two-factor authentication, the encrypted authenticator secret and passkey public key details.
• Encrypted vault data: encrypted items we cannot read, with their version and date information.
• Organization data: organization name, memberships, roles, invitations and collection access.
• Session and device data: device name and type, session start and last-used times.
• Security and activity logs: events such as sign-ins, sessions, password changes and organization actions. IP addresses in these logs are stored masked (/24 for IPv4, /48 for IPv6).
• Technical data: your IP address is processed briefly to prevent abuse and protect the service.
• Correspondence: the content of messages you send us.
• Payment data (paid plans): details needed for payment and invoicing (full name, Turkish ID number, email, phone, billing address) are processed only to pass them to the payment institution and are not stored on our servers. Your card details are collected solely by the payment institution and never reach us. Subscription status and payment institution references are stored.

• Creating your account, authentication, storing and syncing your vault and providing organization features: establishment and performance of a contract (KVKK Art. 5(2)(c)).
• Sending verification, invitation and security notification emails: performance of a contract (Art. 5(2)(c)) and legitimate interest (Art. 5(2)(f)).
• Securing accounts and the service, preventing abuse and unauthorized access, keeping activity logs: legal obligation (Art. 5(2)(ç)) and legitimate interest (Art. 5(2)(f)).
• Answering support requests and operating the service: performance of a contract (Art. 5(2)(c)) and legitimate interest (Art. 5(2)(f)).
• Payments, invoicing and financial obligations for paid plans: performance of a contract (Art. 5(2)(c)) and legal obligation (Art. 5(2)(ç)).
• Responding to competent authorities and establishing, exercising or defending legal claims: legal obligation (Art. 5(2)(ç)) and establishment, exercise or protection of a right (Art. 5(2)(e)).

We do not use your personal data for advertising, profiling or sale, and we do not send commercial electronic messages without your consent.

We do not sell personal data. Your data may be transferred only to the following groups of recipients, limited to the purposes above and to what is necessary:

• service providers supporting us with hosting, encrypted backup and email delivery;
• a licensed payment institution for payments and subscriptions on paid plans;
• authorized administrators of organizations you belong to (limited to the member list, roles and organization activity logs);
• public authorities and courts legally entitled to request it, where we have a legal obligation.

Our authorized staff may access account information (e.g. email address, verification status, organization and plan details) only as needed for support and operations; such access is logged. Your vault contents are never disclosed in readable form to any recipient, including our staff.

The service's primary infrastructure is in Türkiye. We use service providers located abroad for supporting services such as encrypted backup and email delivery. These transfers are made in accordance with Article 9 of KVKK and with appropriate technical and organizational measures; backups are encrypted before they leave the country and cannot be read by the provider.

• Account, authentication, encrypted vault, session and personal account security records: for as long as your account remains open.
• Organization activity logs: 7 days on the Free plan, 365 days on the Team plan.
• IP counters used to prevent abuse: short-lived; deleted automatically when their time window ends.
• Backups: kept encrypted for 14 days and deleted automatically afterwards.
• Payment and invoicing records (paid plans): for the periods required by tax and commercial law.
• Support correspondence and staff activity logs: as long as required for the purpose and possible disputes.

When a period ends or the reason for processing no longer exists, the data is deleted, destroyed or anonymized.

You can delete your account at any time in Settings. Deletion permanently removes your account and personal vault and removes you from the organizations you belong to. Deleted data rolls off our encrypted backups within the backup retention period. Records we are legally required to keep continue to be retained for the required period.

We apply appropriate technical and organizational measures to protect your data, including end-to-end encryption, encryption in transit, access controls, masked logs and encrypted backups. See the Security page for details.

We use only cookies that are necessary for the service to work; we do not use analytics, advertising or third-party tracking tools. Details: Cookie Policy.

Your rights under Article 11 of KVKK and how to exercise them are described in the KVKK Privacy Notice. For privacy questions, write to muhammed@aliguc.com.

We may update this policy. We will announce material changes by email or in-app notice before they take effect. The current version and effective date are shown on this page.