This text is a draft and not yet final. Highlighted fields in square brackets (e.g. company name and address) must be filled in and the text must be reviewed by a lawyer before publication.
Privacy Policy
What data RintUp collects and why, how we protect it and how long we keep it.
1. In short
- We collect the minimum data needed to provide the service; we do not process data for advertising or profiling and we do not sell data.
- Our database and application servers are located in Türkiye.
- We use no analytics or marketing cookies; only strictly necessary ones.
- Your card details never reach us; payments are collected by Paynkolay.
- Header and credential secrets you enter for your monitors are stored encrypted and only shown masked in the panel.
This policy applies to the RintUp service (rintup.com, the panel, the API and status pages) provided by [COMPANY NAME]. The statutory notice under KVKK is the KVKK Privacy Notice; if the two conflict, the notice prevails.
2. Information we collect
- Account: name, e-mail, password hash (Argon2id), language preference, two-factor setting.
- Session and security: IP address, browser information, sign-in times, API key usage, audit records.
- Workspace: name, members and their roles, invitations, plan and billing details.
- Monitoring data: monitor targets and settings, check results (status, response time, HTTP code, error summary), incidents, maintenance windows. The content of monitored pages is not stored.
- Alert channels: e-mail addresses and phone numbers that receive alerts, webhook and chat integration addresses (addresses and tokens are stored encrypted).
- Status pages: components and announcements you publish; subscribers' e-mail addresses if subscriptions are enabled.
3. How we use information
- To open your account, authenticate you and run the service
- To check your targets, send alerts on outages and publish your status page
- To manage subscriptions and invoices
- To protect your account and our infrastructure against abuse and attacks
- To meet our legal obligations
- To send product news only if you have given permission
Service messages (verification, password reset, security warnings, invoices, notices of service changes) are not commercial messages and are sent regardless of that permission.
6. Security
- All traffic is encrypted with TLS; the panel session cookie is httpOnly, Secure and SameSite=Lax.
- Customer secrets are stored with envelope encryption (key management service + data key); secrets are never written to logs or error records.
- Workspaces are isolated from each other in the database with row-level security (RLS).
- Passwords are hashed with Argon2id; two-factor authentication (TOTP) is supported.
- Audit records are append-only; backups are encrypted.
- Checks against external addresses are restricted so that they cannot reach internal networks or cloud metadata addresses.
If we become aware of a security breach, we notify affected people and the Personal Data Protection Board within the period required by law (at the latest 72 hours under the Board's decision).
7. Retention
Raw check results are kept for 90 days and summaries for at most 3 years. Account data is kept for the life of the account and deleted within 30 days of a deletion request; invoice records are kept for the statutory period (10 years). Full table: KVKK Privacy Notice — Retention periods.
8. Children
RintUp is a service for businesses and professionals; it is not intended for people under 18 to open accounts.
9. Your rights
You can exercise your rights under KVKK Article 11 (information, correction, deletion, objection etc.) by writing to kvkk@rintup.com. You can also correct your account details yourself in the panel's Settings.
10. Changes and contact
When we update this policy we change its date and notify significant changes by e-mail. Questions: kvkk@rintup.com · [ADDRESS]