Privacy Notice
Last updated: 17 October 2026
This notice explains how Arsbias L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("we", "Denizplain") handles personal data on denizplain.com and on the sites the platform hosts. It is written to meet the Turkish Personal Data Protection Law (KVKK, Law No. 6698), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), which applies to us as a company in the United Arab Emirates, and, for people in the European Economic Area and the United Kingdom, the GDPR. Where they differ, the stricter rule is applied.
1. Two roles
For your account, we are the data controller. When you sign up, pay, write to support or receive our messages, we decide why and how your data is used.
For your site's visitors and buyers, you are the controller and we are the processor. The forms, orders, bookings, memberships and visits your site records belong to you. We store and process them only to run your site as the platform's features define, and on your instructions. Your visitors should read your privacy notice; the platform provides a text you can adapt, and you are responsible for it.
2. What we collect, and why
2a. Account holders and team members (we are the controller)
| Data | Why | Legal basis |
|---|---|---|
| Name, e-mail, password (hashed), language, time zone | to create and secure your account, sign you in, show the interface in your language | performance of the contract (KVKK art. 5/2-c; GDPR art. 6/1-b) |
| Workspace, sites, members and roles, what you edit and publish | to provide the Service | contract |
| Billing: your plan and its lines, invoices, payment dates and amounts, the Stripe customer and subscription ids | to charge you, show your bill, send invoices, chase a missed payment | contract; legal obligation (bookkeeping) |
| Contact person, phone or WhatsApp number — if you give one | to remind you of a payment due, to reach you about your service | contract; your consent for WhatsApp, which you may withdraw |
| Support correspondence | to help you | contract; legitimate interest in keeping a record |
| Technical logs: IP address, browser, pages requested, errors, timestamps | security, abuse prevention, keeping the Service working | legitimate interest (KVKK art. 5/2-f; GDPR art. 6/1-f) |
We do not store your full card number: Stripe holds it. We do not sell personal data and we do not show advertising.
2b. Visitors and buyers of hosted sites (you are the controller)
On your instruction the platform records what your site's features need: form submissions, orders and their delivery details, booking requests, member records and messages, newsletter sign-ups, and first-party visit statistics (page views and events your site records itself). If you add a third-party tag to your site — an advertising pixel, for example — that tag and its disclosure to your visitors are yours. What is collected depends on the features you switch on. We use this data for nothing of our own, other than aggregated, anonymous service statistics.
3. Cookies
denizplain.com sets only essential cookies: your sign-in session, your language, and interface preferences. No advertising or third-party analytics cookies run on our pages. A hosted site's cookies are the site owner's; the platform gives them a consent bar and a cookie notice to configure.
4. Who else sees the data (sub-processors)
We use providers that process data on our behalf, under contracts that bind them to protect it:
| Provider | What for | Where |
|---|---|---|
| Supabase | database, authentication, file storage | EU — Ireland |
| Vercel | hosting and delivery of the application and the hosted sites | EU — Germany (Frankfurt); delivered worldwide through Vercel's edge network |
| Stripe | subscription billing and card payments to us | EU / US (Stripe's own notice applies) |
| Hostinger | background jobs and the job queue | EU — Germany (Frankfurt) |
| ImprovMX | sending e-mail (sign-in, invitations, notifications, invoices) | EU — France |
| n8n, on Hostinger | WhatsApp reminders to customers who gave a number | EU — Germany (Frankfurt) |
We disclose personal data to authorities only when the law requires it, and we tell you where we may.
5. International transfers
Some of these providers process data outside Turkey and outside the EEA. For people in Turkey, transfers abroad rest on the safeguards KVKK art. 9 allows (your explicit consent where we ask for it, or an adequacy decision or standard contract registered as the law requires). For people in the EEA/UK, transfers rest on adequacy decisions or the EU standard contractual clauses our providers have signed.
6. How long we keep data
- Account and workspace data: while your account exists, then deleted 12 months after the workspace's last activity, or earlier on your request.
- Billing records: as long as the bookkeeping law of the United Arab Emirates requires (typically 10 years).
- Support correspondence: 3 years after the last message.
- Technical logs: 90 days, except where kept longer to investigate an incident.
- Your site's visitor and buyer data: as you, its controller, decide; deleted with the site or the workspace.
7. Your rights
Under KVKK art. 11 and GDPR arts. 15–22 you may ask us: whether we process your data; for a copy of it; to correct, complete or delete it; to restrict or object to processing; to receive it in a portable form; and to withdraw a consent you gave. Where we are the processor (your site's visitors), we pass the request to the site owner and help them answer it.
Write to support@denizplain.com or to Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. We answer within 30 days (KVKK) and in any case within the time the GDPR allows. You may also complain to the Turkish Personal Data Protection Authority (KVKK Kurumu) or to the supervisory authority of your EEA country.
8. Security
Data is encrypted in transit and at rest by our providers; access to production data is limited to the people who run the Service and is logged; passwords are hashed; payments never touch our servers. No system is perfectly secure; if a breach affects you, we notify you and the authorities as the law requires.
9. Children
The Service is for businesses and adults. We do not knowingly collect data from anyone under 18 as an account holder. A hosted site's audience is its owner's responsibility.
10. Changes
We may update this notice. The date at the top changes; for a material change we e-mail account owners.
11. Contact
Arsbias L.L.C-FZ · Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates · support@denizplain.com · +971 52 293 9031