1. Data Controller
As Mindora, in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"), we process your personal data as Data Controller for the purposes specified below.
Data Controller: Mindora
Contact: support@usemindora.com
Website: usemindora.com
2. Personal Data Processed
2.1. Identity Data
First name, last name, professional title.
2.2. Contact Data
Email address, phone number, address.
2.3. Account Security Data
Password (hashed), MFA information (encrypted), active sessions, login attempts, IP address, device information.
2.4. Financial Data
Session fees, payment status, invoice information. Credit card information is not stored by Mindora.
2.5. Special Categories of Personal Data
Health Data: Clinical notes, session information, therapy goals, mental state assessments, and other clinical content entered by therapists on the platform constitute health data.
National ID Number (TC Kimlik No): Collected solely for e-SMM invoice issuance and stored encrypted with AES-256-GCM.
2.6. Digital Footprint Data
Cookie data, session logs, IP address, browser and device information, geolocation (approximate, IP-based).
3. Purposes of Processing
- Account registration and management
- Authentication and account security
- Providing platform services (client management, session scheduling, note-taking)
- Google Calendar synchronization and Google Meet integration
- Payment processing and invoicing
- Email notifications and reminders
- Responding to support requests
- Compliance with legal obligations
- Information security management
- Audit and compliance activities
4. Data Transfers
4.1. Domestic Transfers
- iyzico (PayTR coming soon): Used via API integration when the therapist connects their own payment provider account to Mindora, for payment link creation and status tracking. Funds flow directly to the therapist's account; Mindora is an intermediary layer that does not hold funds or take commission.
- Parasut: Client identity and invoice data for e-SMM invoice issuance.
4.2. International Transfers
- AWS (Germany / Frankfurt): Primary data center hosting all client and clinical data (EU region). A region providing adequate protection under both KVKK and GDPR.
- Paddle (Merchant of Record): Collection of Mindora subscription payments and international VAT/tax management.
- Stripe: Used via API integration when the therapist connects their own US/international payment provider account to Mindora, for payment link creation and status tracking. Funds flow directly to the therapist's account.
- Google: OAuth authentication, Google Calendar sync, and Google Meet integration.
- Resend: Email delivery service.
- Supabase: File storage (profile photos, receipts).
International data transfers are conducted with appropriate safeguards under Article 9 of the KVKK.
5. Data Collection Method and Legal Basis
Your personal data is collected electronically through our platform's web interface and APIs.
Legal bases:
- KVKK Art. 5/2(c): Necessity for the performance of a contract (account creation, service delivery).
- KVKK Art. 5/2(d): Legal obligation of the data controller (legal retention requirements).
- KVKK Art. 5/2(f): Legitimate interest (security measures, service improvement).
- KVKK Art. 6/2: Explicit consent for special categories of data (health data).
6. Processing Conditions for Special Categories
Health data is classified as special categories of personal data under Article 6 of the KVKK. Processing of such data:
- Is based on the explicit consent of the data subject.
- Data is protected with AES-256-GCM encryption; encryption keys are versioned and rotated periodically.
- Clinical content (notes, blog posts) is protected against injection attacks through server-side HTML sanitization.
- Access is restricted through multi-tenant architecture with organization-level isolation.
- All access and modifications are recorded in audit logs.
7. Data Retention Periods
| Data Category | Retention Period |
|---|---|
| Account data | While account is active |
| Deleted client data | 30 days from deletion request |
| Audit logs | 365 days |
| After account deletion | 30-day cancellation period, then permanent deletion |
| Payment history | Legal retention period |
8. Rights of the Data Subject (KVKK Art. 11)
Under Article 11 of the KVKK, you have the right to:
- Learn whether your personal data is being processed
- Request information about processing activities
- Learn the purpose of processing and whether data is used accordingly
- Know the third parties to whom your data is transferred domestically or internationally
- Request correction of incomplete or inaccurate data
- Request deletion or destruction under Article 7 of the KVKK
- Request notification of corrections, deletions, or destruction to third parties
- Object to outcomes arising from exclusively automated analysis
- Claim compensation for damages arising from unlawful processing
Submit your requests to support@usemindora.com. Requests will be resolved free of charge within 30 days.
9. Contact
Data Controller: Mindora
Email: support@usemindora.com
Website: usemindora.com