This policy explains how BASE9 Bilişim Teknolojileri Ticaret A.Ş. ("nixscale", "we") processes the personal data of people who use our website and service. The formal notice required by Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is on the KVKK Notice page; this page covers the same ground in plainer language.
1. Scope
This policy applies to:
- visitors of nixscale.com and its subdomains;
- users who create an account and manage their organization or networks in the panel;
- people invited to an organization as members.
For data we collect about the other members of your organization and the devices in its networks, the organization owner is the data controller and we are the processor.
2. Data we collect
Provided by you
- Account: email address, name, identity-provider ID. Authentication is provided through Zitadel; we do not hold your password.
- Organization and network: organization name, network names, member emails, roles, network assignments, zone (label) and rule definitions.
- Billing: name, email, phone, address; for business customers, legal name, tax office and tax number.
- Support correspondence.
Generated by using the service
- Device records: device name, operating system, in-network IP address, last-seen time, routes advertised by the device.
- Audit log: who did what, in which network, and when (e.g. invited a member, changed a rule, deleted a device).
- Technical logs: request time, IP address, browser information; for debugging and security.
What we do not collect
- The contents of your network traffic. Data between your devices is end-to-end encrypted with WireGuard and does not cross our infrastructure. When relay servers are used they forward encrypted packets only; the contents cannot be seen.
- Card details. Payment happens on the payment institution iyzico's page; your card number never reaches us.
- Turkish ID number. The ID number required by the payment institution is passed to iyzico during checkout only; it is not stored on our systems.
3. Why we process data
| Purpose | Legal basis |
|---|---|
| Creating your account, provisioning and running your network | Formation and performance of a contract |
| Collecting payment and issuing invoices | Performance of a contract; legal obligation |
| Security, abuse prevention, audit log | Legitimate interest; legal obligation |
| Answering support requests | Performance of a contract |
| Notifying you of service changes | Performance of a contract |
| Product and campaign announcements | Consent (revocable at any time) |
We use no third-party analytics or advertising trackers.
4. Who we share data with
We do not sell your data. We share it only with providers needed to run the service, and only to the extent needed:
| Recipient | Purpose | Location |
|---|---|---|
| Zitadel (authentication) | Sign-in and account management | Türkiye (our own servers) |
| iyzico Ödeme Hizmetleri A.Ş. | Payment collection, subscription renewal | Türkiye |
| Codit (data centre) | Server hosting | Türkiye |
| Our email server | Service emails (invites, membership and device notices) | Abroad (our own server) |
Service emails are delivered through our own email server located outside Türkiye. To do this, the recipient's email address, name and the content of the email (e.g. organization and network names) are transferred abroad; the transfer is carried out in line with Article 9 of the KVKK. Emails never contain passwords, device keys or payment details.
Beyond these, we disclose data only where legally required or on the request of a competent authority, limited to the scope of the request.
5. How long we keep it
| Data | Period |
|---|---|
| Account and network data | While the account is open; deleted 30 days after closure |
| Expired or deleted device records | Until the network is deleted |
| Audit log | 1 year after the network is deleted (security and disputes) |
| Content of sent service emails | 30 days; after that only the recipient address and email type are kept |
| Invoices and payment records | 10 years, as required by tax law |
| Technical logs | 90 days |
6. Your rights
Under KVKK you have the right to learn whether your data is processed, to request information, to request correction or deletion, to object to processing and to claim compensation for damage. See the KVKK Notice page for how to apply.
Most of the data in your network (members, devices, rules) can be viewed, corrected and deleted by you directly in the panel.
7. Security
Access to our control systems is role-based and logged. Secrets are stored encrypted. The panel and API are served over TLS only. Each customer network is isolated with its own coordination server, database and IP block.
8. Cookies
We use one strictly necessary cookie to keep you signed in and browser storage to remember your theme preference. See the Cookie Policy.
9. Children
The service is not directed at people under 18; we do not knowingly collect data from children.
10. Changes
We may update this policy. We notify you of material changes at your registered email address. The date at the top of the page shows the last update.
11. Contact
For privacy questions: [email protected] — BASE9 Bilişim Teknolojileri Ticaret A.Ş., Yamanevler Mah. Ömer Faik Atakan Cad. Yılmaz Plaza No: 3 İç Kapı No: 2, Ümraniye / İstanbul.
This page is a translation; the Turkish version prevails.