Croptrove — KVKK Information Notice (courtesy English translation)
Courtesy translation of
kvkk.tr.md; the Turkish text is the legally binding version. Prepared under Turkish Personal Data Protection Law No. 6698 (KVKK) art. 10, based on primary legal sources (mevzuat.gov.tr, kvkk.gov.tr). Not a substitute for legal advice.Version: 5 · 3 October 2026
1. Data controller
Name: Moontra Software Yazılım ve İnovasyon Ticaret Limited Şirketi (Moontra Software Ltd.; "Moontra Software") · Address: HALKALI MERKEZ MAH. HALKALI CAD. TEKNO PARK İDARE BİNASI NO: 281/23 İÇ KAPI NO: 2 KÜÇÜKÇEKMECE/İSTANBUL, Türkiye · Tax ID: 6222607413 (tax office: Halkalı Tax Office) · Contact: info@moontrasoftware.com · Phone: +90 507 009 69 84 · VERBİS: We fall within the exemption set by Personal Data Protection Board decisions 2018/87 and 2023/1154 (fewer than 50 employees a year and an annual balance-sheet total below TRY 100 million; processing special-category data is not our main activity), so we are not required to register with the Data Controllers' Registry. If we exceed either threshold, we will register.
2. The Croptrove app does not process personal data
Your capture history in the Croptrove app is kept only on your device; as controller we do not access, collect or transfer it. Your screenshots and recordings stay on your Mac only; they are never sent to, or kept on, any server. The app uses the network only for actions you start (activating or removing a Mac, update checks, the payment page) and, after an update check, for a licence verification at most once a day, all with the shared Moontra licence service (account.moontrasoftware.com); what these send is listed in the table below. No screenshot, recording, clipboard content, computer name or user name is ever sent. The trial period is kept only on your Mac. This notice concerns only the data below.
3. Personal data processed, purpose and legal basis
| Data | Source | Purpose | Legal basis (KVKK art. 5) |
|---|---|---|---|
| Email, interface language, sign-up time | Waitlist form | An email when Pro is released | Explicit consent (art. 5/1; form checkbox) |
| One optional answer (Pro feature of interest) | Waitlist form | Product planning (anonymous statistics) | Explicit consent |
| Name, email, country, order no./amount (limited data from Paddle) | Purchase (Paddle) | Delivering the licence key, support, accounting/tax duties | Contract (art. 5/2-c); legal obligation (art. 5/2-ç); legitimate interest (art. 5/2-f — support) |
| Support correspondence | Answering your request | Contract (art. 5/2-c); legitimate interest (art. 5/2-f) | |
| Server logs (IP address, request time, requested path, response code) | Website and Moontra licence service (reverse-proxy/access log) | Security, preventing abuse, operating the service | Legitimate interest (art. 5/2-f) |
| Licence record: Paddle transaction ID, Paddle customer ID, licence ID, package or single product (1 or 3 Macs) and the Moontra apps it covers (product rights), update-entitlement end date per app, payment type/amount/currency/date, refund status | Purchase (Paddle notification) and the Moontra licence service | Delivering the licence key, tracking update entitlement, renewals and upgrades, showing payment history in the account panel, marking refund status | Contract (art. 5/2-c); legal obligation (art. 5/2-ç — commercial record keeping) |
Irreversible device digest (SHA-256 of a hardware identifier; derived separately for each app, croptrove-device-v1 for Croptrove), the product ID of the app being activated, device model name (e.g. MacBookPro18,1) or a short name you type, activation date | App (when you activate) | Enforcing the seat count (1 or 3 Macs), showing your Macs in the account panel, preventing abuse | Contract (art. 5/2-c); legitimate interest (art. 5/2-f — abuse prevention) |
| Licence verification: activation confirmation (contains the licence ID, the product ID and the device digest) | App — together with the update check if automatic update checks are on (asked on first use; turned on only with your consent) (at most once a day; a separate request from the update request), otherwise only when you run a check yourself | Enforcing the licence terms (turning Pro off on a removed or fully refunded Mac, the 60/75-day verification rule, the seat count) | Contract (art. 5/2-c); legitimate interest (art. 5/2-f — abuse prevention) |
| Account panel sign-in and session: your email address, a single-use sign-in link (only its hash is stored; valid 15 minutes), hash of the session token, licence ID, expiry (7 days); count and dates of Mac removals made in the panel | Account panel (account.moontrasoftware.com, when you sign in) | Keeping you signed in, applying the Mac removal limit (3 in 30 days) | Contract (art. 5/2-c); legitimate interest (art. 5/2-f — abuse prevention) |
Collection method: web form (automated, electronic) and via Paddle. The site uses no analytics/advertising cookies or trackers; no tracking data is kept in your browser. The waitlist form does not record your IP address or browser details. The DMG is served by GitHub Releases; GitHub may log the request under its own policy, and this site does not track downloads.
One shared service: licence records, product rights, device records and account records for Croptrove, Copytrove and every Moontra app added later are processed by one Moontra licence service; there is no separate account per app. The service keeps the email address from your purchase to deliver the key and to send the sign-in link; it does not keep your licence key itself (only the licence ID) and does not store your name. The only device-related data is the irreversible device digest and the model name above. The device digest is derived separately for each app (the same Mac has a different digest in Croptrove and in Copytrove), so records in different apps cannot be matched directly; it cannot be turned back into the Mac's hardware identifier, and your computer name and user name are not collected. The licence key and email address are not written to server logs. A bundle is one licence record with a separate product-right row per app; no new personal data is collected for these rows. The account panel's session cookie is strictly necessary for the sign-in you request; it is httpOnly and is not used for tracking.
4. Transfers (domestic / abroad)
- Hosting: the website, waitlist records and the one Moontra licence service (all Moontra apps; account panel
account.moontrasoftware.com) are kept on our company server run by Hetzner Online GmbH (Germany) in a data centre in Finland. Hetzner hosts this data as a data processor on our behalf. Finland is abroad, and the Board has not yet issued an adequacy decision for any country, so this hosting counts as a transfer abroad. - Support email: info@moontrasoftware.com is hosted on Google Workspace (Google). When you write to it, the correspondence is kept on Google's servers abroad. Google processes it as a data processor.
- Basis for transfers abroad (KVKK art. 9/4-c): the hosting and support-email transfers rely on the standard contract published by the Board. It is used without changes and notified to the Board within five business days of signature (KVKK art. 9/5; Regulation on the Procedures and Principles for Transferring Personal Data Abroad, art. 14). As these transfers are regular, we do not rely on the explicit-consent exception, which applies only to occasional transfers (art. 9/6-a).
- Paddle (payment provider / Merchant of Record, established in the UK and elsewhere) processes payment and invoicing data on its own behalf under its own privacy policy. You give this data directly to Paddle at checkout; this is not a transfer made by us (the Authority's Guide on Transferring Personal Data Abroad, Example 1). Paddle passes us only the limited purchase information above.
- Resend (email delivery service; sends licence, sign-in-link and reminder emails from
license@moontrasoftware.com) processes your email address and the email content on our behalf as a processor; this is a transfer abroad. Resend (Plus Five Five, Inc., San Francisco, USA) processes data mainly in the United States; the current list of its sub-processors is at https://resend.com/legal/subprocessors. Resend applies the EU Standard Contractual Clauses (2021/914) for transfers and states that it complies with the EU-U.S. Data Privacy Framework (Resend Data Processing Addendum, https://resend.com/legal/dpa). No clipboard data or device digest is sent to Resend. - Waitlist data is not passed to any other email or marketing service. If we start using one, we will update this notice first.
- Your data is not sold or shared with third parties for advertising.
5. Retention
- Server logs (including IP address; reverse-proxy/access logs of the website and the Moontra licence service): kept for 30 days, then deleted.
- Waitlist: 12 months after Pro goes on sale, or until you withdraw consent / ask for deletion (whichever comes first).
- Licence record and purchase records: 10 years from the end of the calendar year in which the record was created (Turkish Commercial Code art. 82).
- Seat records (device digest, model name, activation and removal dates): kept together with the licence record, for the same period, so that the seat count and the removal limit can be enforced.
- Account panel sessions: expire after 7 days.
- Support correspondence: after the request is closed, the same period as purchase records if it concerns a purchase; otherwise 2 years.
After that, data is deleted, destroyed or anonymised.
6. Your rights (KVKK art. 11)
By applying to the controller you may: (a) learn whether your data is processed; (b) request information if it is; (c) learn the purpose and whether it is used accordingly; (d) know the third parties it is transferred to, at home or abroad; (e) request correction of incomplete/incorrect data; (f) request deletion/destruction under art. 7; (g) request notice of (e) and (f) to third parties; (h) object to an outcome against you produced solely by automated analysis; (i) claim compensation for unlawful processing. You may withdraw explicit consent at any time (withdrawal does not affect earlier processing).
7. How to apply
Send your application in Turkish by one of these routes (Communiqué on the Procedures and Principles of Applying to the Data Controller, art. 5):
- a signed letter to the company address above, or through a notary;
- registered electronic mail (KEP), secure e-signature or mobile signature to info@moontrasoftware.com;
- from the email address you gave us earlier and that is registered in our system, to info@moontrasoftware.com.
Include: name, surname and (for written applications) signature; Turkish ID number (or, for foreigners, nationality and passport or ID number); address for notices; email and phone if available; the subject of your request and any supporting documents. Applications are free and answered within 30 days; for a written reply over 10 pages, TRY 1 per extra page may be charged, or the cost of the medium if given on a storage medium (Communiqué art. 6–7; KVKK art. 13). If you are not satisfied, or receive no reply in time, you may complain to the Personal Data Protection Board (KVKK art. 14).