Legal

Privacy Policy

Last updated: Oct 15, 2026

This policy explains what personal data is processed as part of the Revoop service, why and on what legal basis, who it is shared with, how it is protected, and your rights under Turkish Personal Data Protection Law No. 6698 ("KVKK"). We act in two roles: we are the data controller for the account data of merchant staff, and a data processor for end-customer data handled in the returns flow on behalf of merchants, where the merchant is the data controller.

Data controller and our roles

The Revoop service is provided by TİDU TEKSTİL YAZILIM TİCARET LİMİTED ŞİRKETİ ("Revoop", "we"). Address: FATİH MAH. 258. SK. EMANET APT. NO: 30 İÇ KAPI NO: 11 ESENLER/ İSTANBUL. Contact: [email protected].

Merchant account data: Revoop is the data controller for the account and security data of store team members (owners, admins, viewers) who use the merchant panel.
End-customer data: We process the data of customers who bought from a store and use its returns portal on behalf of, and on the instructions of, that store. The merchant is the data controller for this data; Revoop is the data processor.

If you are a store's customer and want information about, or to exercise your rights over, data related to your return, please contact the store you bought from first. If such a request reaches us, we forward it to the merchant and support them on their instructions.

What data we process

Merchant team members (data we control)

Identity and contact: name and e-mail address.
Account security: never your password itself, only a form of it that cannot be turned back into the password (an argon2id hash); if two-step verification with an authenticator app (TOTP) is enabled, the encrypted authenticator key and only irreversible hashes of the recovery codes.
Account and access: the stores you belong to and your roles, your last sign-in time.
Session and activity security: session cookies, an irreversible hash of the session renewal key (refresh token), and audit records of security-relevant actions (action, time, IP address and browser information).
Store and integrations: store settings, return rules and connected e-commerce platform or marketplace details. Platform access credentials are stored encrypted.
Communication: e-mails and support requests you send us.

End customers (data we process for merchants)

Order details: order number, order date, items, variants and amounts; only the fields needed for the return are taken from the merchant's platform.
Contact details: name, e-mail address, phone number and shipping address.
Return details: returned items, the selected return reason, an optional note written by the customer, the offers shown and the customer's choice (exchange, store credit or standard return).
Photos: product photos, only when an item arrived defective, wrong, with missing parts or damaged in shipping, and only if the customer chooses to upload them.
Messages: verification codes and notifications about the return; button choices and message records for return steps handled over WhatsApp.
Consent records: whether and when the customer agreed to be informed via WhatsApp, and requests to stop receiving messages.
Security: signals such as the number of returns to prevent abuse, and IP addresses to limit repeated attempts (rate limiting).

Why we process data

To open merchant accounts, authenticate sessions and keep accounts secure.
To provide the service: verify the order, take the return request, generate exchange or store credit offers based on the merchant's rules and live stock, and pass the customer's choice to the merchant's platform.
To send customers transactional messages about their return (verification codes, status updates). We do not send marketing or campaign messages.
To give merchants return and recovered revenue reports and to calculate the success fee.
To prevent abuse, unauthorised access and attacks, and to keep audit records.
To answer support requests and improve the service.
To meet our legal obligations and protect our rights in a dispute.

Legal bases

We process personal data on the following legal bases under Article 5 of the KVKK:

Entering into or performing a contract (Art. 5(2)(c)): opening the merchant account and providing the service.
Legal obligation (Art. 5(2)(ç)): retention and disclosure obligations under applicable law.
Establishing, exercising or defending a right (Art. 5(2)(e)): records used as evidence in disputes.
Legitimate interest (Art. 5(2)(f)): account and system security, abuse prevention and service improvement, provided this does not harm your fundamental rights and freedoms.
Explicit consent (Art. 5(1)): only where actually needed. For example, a customer is messaged on WhatsApp only if they have explicitly opted in, and they can withdraw that consent at any time.

For end-customer data, the merchant as data controller determines the legal basis; we process that data only on the merchant's instructions and to the extent the service requires.

AI-assisted features

AI-assisted helpers are off by default and can only be turned on by the store owner. When enabled:

A language model only makes suggestions; it never decides offers or returns. Decisions are made by the merchant's rules.
The customer's name, contact details, address and order details are never sent to the model. Only the customer's return note is sent, after e-mail addresses, phone numbers, IBANs, card numbers, Turkish ID numbers and address fragments have been masked.
Summaries written for merchants are generated only from numerical and categorical facts and contain no customer data. Customers are never shown AI-written text.
To group similar return notes and let you search them, a numeric representation of each note (a semantic vector) is computed. This runs on our own servers, and these records are deleted when the feature is turned off.
The text sent to the AI and its replies are not stored; we only record which feature was used, its outcome, how long it took and how much it was used.

We do not sell personal data or share it for advertising. To provide the service, we share data only as far as necessary with the following recipients:

The merchant: end-customer data is shown in the panel of the merchant who is its data controller. Contact details are masked in the panel; the full value is shown only on an explicit request by an authorised user, and that action is logged.
E-commerce platforms and marketplaces: order and stock data is read from the platform the merchant connected; depending on the customer's choice, a coupon, exchange order or return record is created in the merchant's account.
Communication providers: e-mail delivery (Resend), SMS verification codes (Netgsm) and messaging through the WhatsApp Business account the merchant connected (Meta).
AI service providers: only if the store owner enabled the feature, and only with masked text as described above.
Infrastructure providers: the cloud infrastructure and server services where data is hosted.
Competent authorities: where required by law.

Some of our service providers may be located outside Turkey. Where a transfer abroad is needed, we carry it out in accordance with Article 9 of the KVKK.

Retention

We keep personal data for as long as the purpose of processing requires and for the retention periods set by law; after that, we delete, destroy or anonymise it. Some periods that follow from how the service works:

Portal verification codes: 1 day.
Customer photos never attached to a return: 24 hours.
Return photos: 90 days after the return is closed.
Raw content of notifications received from platforms: 90 days.
Records of messages sent to customers and to the store, and of actions passed to the store's platform on its behalf (coupons, exchange orders, marketplace return decisions): 30 days after sending.
Personal data attached to a return (the return note, names and contact details in messages, the delivery address): 2 years after the return is closed, then anonymised. A customer with no newer return or order in that time also has their name and contact details anonymised.

On the merchant's request, or when a deletion request arrives from the merchant's platform (for example Shopify's customer data redaction notice), the end customer's personal data is anonymised. Recovered revenue records and statistics are kept in a form that contains no personal data.

How we protect data

Encryption: the customer's name, e-mail address, phone number, address, return note and photos are stored with strong encryption (AES-256-GCM, at the application level). To find a record we use only irreversible keyed hashes of these details, never the details themselves (HMAC-SHA256).
Separation between stores: each store can reach only its own data; this boundary is enforced in our application and also in the database itself (row-level security), so one store's data cannot be read from another store's session.
Account security: passwords are stored in a form that cannot be reversed (argon2id); two-step verification with an authenticator app (TOTP) is available to every user and store owners can require it for the whole team. Session cookies cannot be read by code running on the page (browser scripts).
No personal data in system records: e-mail addresses, phone numbers, addresses, session and secret values are hidden in our system records (application logs).
Photos: only JPEG is accepted; details saved inside the photo, such as its GPS location (metadata), are removed; photos are viewable only through the merchant's signed-in session, never at a public address.
Access limits: permissions for each team member based on their role, limits on repeated sign-in and verification attempts (rate limits), and audit records for security-relevant actions.
Customer portal: no account is needed; the customer enters the order number with their e-mail address or phone number and confirms with a one-time code. When details do not match, we do not reveal whether the order exists.

Your rights

Under Article 11 of the KVKK, everyone has the right to apply to the data controller to:

Learn whether their personal data is processed,
Request information if it has been processed,
Learn the purpose of processing and whether it is used accordingly,
Know the third parties in Turkey or abroad to whom it is transferred,
Request correction if it is incomplete or inaccurate,
Request deletion or destruction under the conditions of Article 7 of the KVKK,
Request that correction, deletion or destruction be notified to third parties to whom the data was transferred,
Object to a result against them arising from analysis exclusively by automated systems,
Claim compensation for damage caused by unlawful processing.

How to apply

You can submit requests about your merchant account in writing, or by e-mail to [email protected] from the e-mail address registered with us, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Please state your name, contact details and your request clearly. We resolve requests free of charge as soon as possible and within 30 days at the latest, depending on their nature; if the action involves an additional cost, the fee set by the Personal Data Protection Board may apply.

If you are a store's customer, please apply to that store first. If you cannot reach the store, you can write to [email protected] and we will forward your request to the merchant.

If your request is rejected, you find the answer insufficient, or it is not answered in time, you may lodge a complaint with the Personal Data Protection Board (KVKK Kurulu).

Users in the European Union

Where the EU General Data Protection Regulation (GDPR) applies, you can also exercise your rights under it through the same contact channels.

Cookies

Our site and application use only cookies that are strictly necessary for the service to work. See the Cookie Policy for details.

Changes

We may update this policy as the service or the law changes. The current version is always published on this page, and we notify merchants of material changes separately.