Privacy policy
The short version: we collect as little as we can, use it only to do what you asked for, never sell it, and delete it when we no longer need it. You can ask us to see, fix or delete your data at any time by emailing hello@milokits.com.
Who we are
Milo Kits (milokits.com) is run by Erhan Civelek, an individual based in Istanbul, Turkey, trading as Milo Kits. There's no registered company. Erhan is the data controller (veri sorumlusu) for the personal data described here. Contact: hello@milokits.com.
What we collect
- Free mini-check requests, plan reservations and Launch Check orders: your email address, the URL of the app you want checked, the plan you picked, and your confirmation that you own it or are authorized to have it tested. For a Deep Check, also anything you choose to send us, such as Supabase policies or Firebase rules.
- Newsletter signups (Ship It Safe): your email address and the page you signed up from (for example "homepage" or a guide), so we know which pages are useful.
- Emails you send us: your address and whatever you write.
- Purchases: Lemon Squeezy is the merchant of record for our sales. It collects your payment details, handles card data, taxes and receipts, and shares your name, email, country and order details with us. We never see your full card number.
- Check results: the findings about your app that go into your report.
- Basic technical logs: our host, Netlify, processes standard request data (such as IP address, browser and pages requested) to serve the site and keep it secure. We don't run analytics or advertising trackers.
What we deliberately don't keep
Our checks are passive and only run on sites you've confirmed you own or are authorized to test. If a check shows that a database or API answers anonymous requests, we read at most one record to confirm it and don't store its contents. Your report says that something was readable and which fields appeared, never your users' actual data. Any secret keys we spot are masked in the report (for example sk-…a1b2). Please never send us passwords, private keys or service-role keys.
Why we use it (and the legal basis)
- To run your check and deliver your report, answer your questions and handle refunds. This is needed to perform our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
- To send the newsletter, only because you asked for it (consent: GDPR Art. 6(1)(a); KVKK explicit consent). You can withdraw consent at any time.
- To keep records we're legally required to keep, such as sales and tax records (legal obligation: GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
- To keep the site and service secure and working, and to prevent abuse such as checks on sites someone doesn't own (legitimate interests: GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
AI assistance
Reports are prepared with help from an AI assistant and reviewed by the operator before they're sent. To do that, the URL you submit, the public information collected during the check, and the resulting findings are processed by the AI service we use. We don't send it your users' data (we don't keep any), and we don't use your data to train AI models.
Who we share it with
Only the service providers that help us run Milo Kits, and only what each one needs:
- Netlify (USA): website hosting and form handling (Netlify Forms stores mini-check requests and newsletter signups).
- Google (Gmail) (USA): form notifications and our email are delivered to the operator's Gmail inbox.
- Porkbun (USA): domain and email forwarding for hello@milokits.com.
- Lemon Squeezy (USA): checkout, payments, taxes and receipts, as merchant of record. See Lemon Squeezy's privacy policy.
- AI service provider: helps prepare reports, as described above.
- Newsletter sending platform: to be added here before the first issue is sent.
We don't sell or rent your personal data, and we don't share it for advertising. We'll only disclose it to authorities if the law requires us to.
International transfers
Several of these providers are based in, or store data in, the United States, so your data may be transferred outside Turkey and the EU. We rely on the safeguards these providers offer for international transfers (such as standard contractual clauses) and, where Turkish law (KVKK Art. 9) requires it, on the legal mechanisms it provides, including your explicit consent when you submit a form.
How long we keep it
- Form data (mini-check requests, plan reservations, Launch Check details): deleted within 12 months, unless you're a customer and we need it for an ongoing relationship (for example a re-check or a question about your report).
- Reports and check notes: kept for up to 12 months after delivery so we can answer questions and run re-checks, then deleted. You can ask us to delete them sooner.
- Newsletter: until you unsubscribe. After that, we delete your address from our lists.
- Sales and tax records: as long as the law requires. Lemon Squeezy keeps its own records under its policy.
The newsletter
If you sign up for Ship It Safe, we store your email address and the page you signed up from. We use them only to send you the newsletter and to understand which pages bring readers. You can unsubscribe at any time, using the link in any issue or by emailing hello@milokits.com.
Cookies
We don't use analytics, advertising or tracking cookies. Our host (Netlify) and our checkout provider (Lemon Squeezy) may set strictly necessary cookies, for example for security or to complete a purchase. Because these are essential, they don't need a consent banner.
Your rights
Wherever you are, you can email hello@milokits.com to:
- find out whether we hold data about you, and get a copy of it (access)
- have inaccurate data corrected
- have your data deleted
- object to, or ask us to restrict, how we use it
- get your data in a portable format
- withdraw consent (for example to the newsletter) at any time
Under KVKK (Turkish Law No. 6698, Article 11), you also have the right to learn whether your data is processed and for what purpose, to know the third parties (in Turkey or abroad) it's transferred to, to ask for it to be corrected or deleted and for those third parties to be notified, to object to outcomes that are to your detriment and based solely on automated processing, and to claim compensation for damage caused by unlawful processing. Under the GDPR, if you're in the EU/EEA, you have the rights listed above.
We'll reply within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU/EEA, your local data protection authority. We'd appreciate the chance to fix things first.
Security
We use reputable providers, HTTPS everywhere, and keep access to your data limited to the operator. No system is perfectly secure, but we take reasonable steps to protect what you share with us.
Children
Milo Kits isn't aimed at children, and we don't knowingly collect data from anyone under 16.
Changes
If we change this policy, we'll update it here and change the effective date. For significant changes, we'll let customers and subscribers know by email.
Contact
Erhan Civelek, trading as Milo Kits, Istanbul, Turkey · hello@milokits.com · X: @milokits