Privacy notice

• Company: [company name]
• Address: [address]
• Registration / tax no: [number]
• Contact: [email address]
• [Lawyer: EU/UK representative under GDPR Art. 27, if required]

• Identity and contact: your name and email address; your company name and phone number if you gave them.
• Account security:
  • your password (only an irreversible hash; the password itself is never stored);
  • if two-step sign-in is on, its key (encrypted) and hashes of your recovery codes;
  • your sessions: IP address, browser details, sign-in and last-seen times;
  • activity records: who did which significant action on your account and when (for example deletions or access changes); some include an IP address;
  • error records: if something breaks on a panel screen, the error text, the page address, your browser's name and version, and which account it happened in. Kept only in the server's memory (at most the last 50 errors) and gone when the server restarts.
• What you create in the panel: projects, variants and their settings; images, sounds, fonts and models you upload; export records; what you write to the editor assistant; the share links you create and the labels you give them.
• Consent records: which text you accepted, which version, and when; the IP address and browser details at that moment.
• Install tracking (only if you connect it): your measurement tool's (AppsFlyer or Adjust) read key (encrypted), your app IDs, and the daily installs per ad pulled from the tool. These numbers belong to the ad; no person or device identifiers are pulled from the tool.
• Playable Wizard: videos and answers you give the Wizard are covered by the Wizard's own terms and privacy notice, shown the first time you use it.

• Providing the service (opening your account, letting you build and export ads, support): performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Protecting your account and our systems (verifying sign-ins, detecting unauthorised access and abuse, keeping activity records): legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)) and the duty to keep data secure (KVKK Art. 12; GDPR Art. 32).
• Legal obligations (invoicing, requests from authorities): legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• Consent records: establishing, exercising or defending a right (KVKK Art. 5/2-e; GDPR Art. 6(1)(f)).

Your data is never sold and never shared for advertising. The service runs on these providers:

• Fly.io (US company): hosts the panel and its database. The servers are in Frankfurt, Germany. Backups of uploaded files are kept in Fly.io's storage service (Tigris) for 8 weeks.
• Cloudflare (US company): the files you upload are stored at Cloudflare, on servers in the European Union; so are the database backups (14 days). Cloudflare also receives the measurement signals sent by live ads (see section 6).
• AppsFlyer or Adjust (only if you connect install tracking): the panel uses the key you give it to read the installs-per-ad report there; nothing but the key is sent to them.
• Google (Gemini, US): when you use the editor assistant, what you write and the ad's settings are sent to Google.
• Playable Wizard's AI services: listed in the Wizard's own notice.
• Resend (US company): emails sent by the panel (alerts to our team, including requests from the website's form; later, notifications to you).
• Authorities legally entitled to it, only when they request it.

International transfers: some of these providers are outside Türkiye and the EEA. [Lawyer: transfer basis — KVKK Art. 9 standard contract notification or explicit consent; GDPR standard contractual clauses / adequacy.]

• Account details and your content: while your account is open. Deleted within [period] after the account is closed.
• Sessions: a session ends after 30 days at most and its record is deleted.
• Notifications in the panel (the bell): 90 days, then deleted.
• Demo requests from the website: 12 months, then deleted.
• Backups: database backups are kept for 14 days, file backups for 8 weeks. Deleted data leaves the backups at the latest when that period ends.
• Activity and consent records: [period — suggestion: 2 years], then deleted.
• Raw ad-measurement records: 30 days; after that only daily totals remain, which cannot be linked to anyone.
• Install tracking: the raw report from the tool for 90 days, daily totals per ad while your account is open. When you remove the connection, the key and the install data are deleted immediately.

Ads exported from the panel send small measurement signals when played: was the ad opened, played, did it open the store.

• Sent: operating system and major version, screen size and orientation, device language, timings of the steps in the ad.
• The country is derived from the IP address on Cloudflare's server. The IP address itself is never stored.
• There are no cookies and no identifier stored on the device: two views by the same person cannot be linked.
• This data is processed on behalf of our advertiser customer, only to show how the ad performs.

The website sets no cookies, has no analytics and loads nothing from other companies (its fonts included). Your theme choice is kept only in your browser.

The demo request form. When you send it, we receive:

• your name, company and email address;
• your game's store link and your note, if you fill them in;
• that you confirmed reading this notice, and the language of the page.

We use these only to reply to your request and, if we work together, to set up your panel: steps taken at your request before a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)). The request reaches our team by email (via Resend) and is kept in the panel's activity records for 12 months, then deleted. To stop abuse, the number of requests from your IP address is counted for about an hour; the IP address is not stored with the request.

• The panel uses one cookie: the session cookie (__Host-mmps_session). It remembers that you are signed in and lasts at most 30 days. It is strictly necessary for the service.
• Preferences such as theme and layout are kept only in your browser and never sent to us.
• The panel has no advertising or analytics cookies.

• All connections are encrypted (HTTPS).
• Passwords are stored irreversibly; two-step sign-in is supported.
• Each customer sees only their own data. When our team views an account as that user for support, it is recorded.
• Regular backups are taken.

You can ask us to:

• tell you whether we process your data, and give you information about it (access);
• tell you the purpose and whether it is used accordingly;
• tell you who it was shared with, in Türkiye or abroad;
• correct it if it is incomplete or wrong, delete it when the conditions are met, and notify those it was shared with;
• object to a result against you that comes solely from automated analysis;
• compensate you if you suffered damage from unlawful processing.

Under the GDPR you also have the right to data portability, to restrict processing, and to lodge a complaint with your local supervisory authority.

How to apply: write to [email address] with details that let us verify your identity. We answer within 30 days at the latest.

If this notice changes, the current version is published on this page; for significant changes we will also tell you in the panel.

*Version: 2026-10-draft*