Privacy Notice

Version: 2026-10-12

Effective date: 2026-10-12

This notice explains how JESTERS BOX YAZILIM DİJİTAL OYUN VE BİLİŞİM TİCARET ANONİM ŞİRKETİ handles personal data for Jesters’ Box accounts, cloud workspaces, support and the desktop app. It includes our Türkiye/KVKK notice, retention/deletion information and desktop app cookie and local storage disclosures.

Controller

Controller: JESTERS BOX YAZILIM DİJİTAL OYUN VE BİLİŞİM TİCARET ANONİM ŞİRKETİ

Address: ALİBAHADIR MAH. ÇAYIRLAR CAD. NO: 9 İÇ KAPI NO: 1, 34829 BEYKOZ / İSTANBUL, Türkiye

Privacy contact: legal@jestersbox.com

Privacy requests are handled through the contact above.

Personal Data We Process

We may process the following categories:

• Account data: email address, display name, account identifiers, authentication provider identifiers, email verification state, sign-in timestamps. Agreement records include the accepted document versions and hashes, acceptance statement, server-recorded timestamp and, where applicable, the organization name and authority declaration.
• Authentication data: access, ID, and refresh tokens stored locally by the app; token metadata; password reset and verification delivery metadata. We do not store your password in the desktop app.
• Workspace data: workspace name, workspace ID, plan, role, region, storage mode, status, creation time, quota, bootstrap status.
• Local app data: asset names, local file paths, file types, MIME types, file sizes, dimensions, durations, preview paths, tags, notes, dependency links, version labels, settings, Trash metadata, and backup/export metadata. In a device workspace, this data is stored on your device or configured storage path.
• User content: original asset files and associated workspace information, including previews, thumbnails, audio waveforms, asset-analysis results such as model statistics, names, notes, tags, collections, dependency links and other asset relationships, versions and snapshots, and copies, caches, exports and backups of that material. This includes representations generated by the app from your content, as well as material you import, upload or create. Device-workspace content is stored on your device or configured storage path; cloud-workspace content is stored through the product's remote storage architecture. Authorized workspace members can access content according to their roles; downloaded copies remain under the recipient’s control.
• Contact and support data: name, email, message, request details and any files, screenshots, recordings or diagnostic logs you choose to send.
• Technical data: IP address, device type, operating system, app version, API request metadata, logs, security events, and diagnostics if collected.
• Payment data: billing details, plan, transaction IDs, invoice details, and limited payment status if paid plans are enabled. Paddle handles payment credentials. We receive subscription, transaction, invoice, and entitlement records used to operate paid cloud access.

We receive data from you, from workspace owners or members who invite you or include information in their content, from authentication and payment services, and from operation of the service. An invitation may include your email before you create an account. We use it to deliver and manage the invitation; you can contact us if it is unwanted or incorrect.

Purposes and Legal Bases

For processing where we determine the purposes, the following describes our EU GDPR bases. Where we process business customer content on instructions, that customer determines the lawful basis and our DPA applies. Local-only processing does not mean we receive a copy of your files.

Purpose	Data	Legal basis
Provide local desktop app features	Local app data and User Content on your device	Contract or legitimate interests
Create and manage accounts	Account, authentication, workspace data	Contract
Record and administer agreement acceptance	Account identifiers, accepted document versions, acceptance timestamp and organization/authority declaration where applicable	Contract and legitimate interests in demonstrating agreement acceptance
Administer cloud access	Account, workspace and entitlement records	Contract with you, or legitimate interests in providing an organization’s service to its authorized users
Send verification, password reset, and service messages	Account and authentication data	Contract or legal obligation
Provide support	Contact, support, technical, workspace data	Contract or legitimate interests
Improve safety, reliability, and abuse prevention	Technical, log, account, and workspace data	Legitimate interests
Send optional marketing you request	Email, name and consent records	Consent; you may unsubscribe at any time
Process payments and invoices	Billing and transaction data	Contract and legal obligation
Comply with law and enforce rights	Relevant account, logs, billing, and content metadata	Legal obligation and legitimate interests

Our legitimate interests include operating a reliable service, helping users, securing accounts and preventing abuse. We assess these interests against your rights. Required account or transaction information is needed to provide the corresponding feature; optional submissions and marketing choices are not required for Local Free. Withdrawing consent does not affect processing already lawfully carried out.

Our limited content license does not authorize unrelated advertising use or general-purpose model training. The Türkiye/KVKK section below describes the collection methods and legal grounds for processing subject to that law.

Local-First Processing

Device workspace data is stored locally by default. We generally cannot access local device workspace files unless you send them to us, enable cloud upload, use support tooling that transmits them, or otherwise choose to share them.

Local data may still include personal data if asset names, file paths, notes, tags, or imported files identify a person. You are responsible for using the app lawfully with personal data contained in your own assets.

Cloud Processing

We use Amazon Web Services (AWS) for account authentication, application hosting and processing, and storage of profiles, workspace records, memberships, invitations, quotas, deletion jobs and billing entitlements. Cloudflare stores uploaded asset files, previews, and versions. Selecting a cloud workspace transmits the content and metadata required for its remote features.

We act as a processor for personal data in business customers’ cloud content where the Data Processing Addendum applies. The customer determines the purposes of that content processing. We act as controller for our account, billing, security, and support administration. Requests concerning an organization’s content may need to be directed to its workspace owner.

Cloud content is not end-to-end encrypted with keys held only by you. Service processing and authorized support operations can access data needed for their duties.

Cookies and Tracking

See the Cookies and similar technologies section below for information about the desktop app. Website cookies are covered separately by the website’s own disclosures.

Sharing

We may share personal data with:

• Hosting, authentication, storage, and service providers identified in the Subprocessor List. Paddle separately processes buyer information as merchant of record under its Privacy Notice.
• Professional advisers such as lawyers, accountants, auditors, and insurers.
• Authorities, courts, or regulators where required by law or necessary to protect rights, safety, and security.
• Business transaction parties if we merge, sell assets, finance, or reorganize, subject to appropriate confidentiality and privacy protections.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising unless the app is later changed to do so and the required notices and opt-outs are implemented.

International Transfers

AWS account services, application processing and inspected database storage use Frankfurt, Germany. Our Cloudflare storage is configured for Eastern Europe (EEUR) with default jurisdiction; this is not an EU-only storage guarantee. The owner administers the service from Türkiye. Provider processing arrangements are described in Providers & Subprocessors.

For transfers subject to GDPR, we use the applicable adequacy decision or safeguards, including Standard Contractual Clauses and supplementary measures where required. The provider-specific arrangements are described in Providers & Subprocessors.

Transfers subject to KVKK Article 9 require an applicable adequacy decision or other lawful transfer arrangement. Routine overseas hosting is not based on blanket consent to this notice. You may request information about applicable safeguards from legal@jestersbox.com.

Retention

We keep personal data only as long as needed for the purposes described here, unless law requires longer retention.

Retention Schedule

Data	Retention and handling
Local device files, database, backups, and exports	Until you delete them. Uninstalling may leave workspace data and external backups behind. Deleting local app data does not delete cloud content.
Local Trash	User-configured period; default seven days. Local backups and exports may retain copies independently.
Desktop authentication tokens	Stored locally until sign-out, local deletion, or replacement; token validity is governed separately by expiry/revocation. Operating-system-backed encryption where available; tokens may be stored without encryption when it is unavailable.
Cloud Trash	Current default: seven days of customer-visible Trash, followed by fourteen additional days of support-only retention. Emptying Trash removes it from user access immediately while retaining the existing support deadline; legacy records without a valid deadline receive a fourteen-day support hold. Final object removal follows background deletion processing.
Explicit cloud workspace deletion	A 14-day recovery period. After that period, deletion from active systems begins at the next scheduled cleanup and is completed within seven days. Lawful erasure instructions are handled separately as explained below.
Agreement acceptance records	Kept with the account and removed during final account deletion, except where necessary lawful retention applies.
Explicit account deletion	A 90-day recovery period, followed by deletion or anonymization of account records and associated personal data from active systems within 30 days, except necessary lawful retention. Owners must transfer or delete workspaces they own first.
End of a paid cloud subscription	The owner has 30 days after paid access ends to export and clean up cloud content; uploads are disabled. Unless service is renewed, active cloud content is deleted within the following 30 days. Backup expiry and lawful holds are handled separately.
Operational/security logs	Routine logs are kept for up to 90 days. Necessary incident evidence may be retained separately for the investigation or applicable legal claim.
Database backups	Retained backup copies expire within 35 days of creation, except a documented lawful hold. This is an expiry limit, not a promise of 35 days of restore coverage.
Cloudflare asset recovery	Trash and recovery periods retain existing objects; they are not an independent backup and cannot restore physically deleted bytes.
Support records and attachments	Ordinary support tickets are anonymized no later than 12 months after the case closes. Identifying information is removed from retained ticket content and attachments; material that cannot be reliably anonymized is deleted. Unnecessary attachments are removed earlier. Records needed for an ongoing dispute or legal obligation are retained only for that purpose and anonymized or deleted when that need ends.
Optional marketing/consent records	Marketing use stops when you unsubscribe or the purpose ends. We retain only the consent evidence needed to demonstrate lawful processing and the minimum suppression information needed to honor your opt-out, reviewed while those purposes continue.
Billing, tax, and dispute records	Paddle retains its own buyer invoices and payment records under its separate obligations. For records Jesters' Box holds, such as payout statements, accounting evidence and necessary transaction or refund records, retention depends on the record type, the applicable tax or commercial recordkeeping requirement and its statutory starting date. Records needed for a dispute are retained only as necessary to establish, exercise or defend the relevant claim, taking account of applicable limitation periods and any lawful hold. We delete or anonymize personal data when these purposes and required periods end. These accounting and dispute exceptions do not extend retention of unrelated workspace content.

Deletion and Recovery

Local deletion, cloud item deletion, workspace deletion, account deletion, and cancellation are separate actions. Cancel a subscription through Billing/Paddle and verify the confirmed status; uninstalling the app is not cancellation. Export and check independent copies before requesting deletion.

Workspace deletion affects shared content. Account deletion must not silently delete a workspace still owned by the requester. Authorized requests and any restoration must be verified, including ownership and effects on other members.

The app’s recovery period is not an automatic justification to delay a valid statutory erasure request. Contact legal@jestersbox.com to exercise privacy rights. We assess the lawful basis for continued retention, remove data where required, and explain any permitted refusal, hold, or extension within the applicable response deadline.

Finalization, Backups, and Holds

Final erasure covers the affected files, previews, versions, associated records and applicable identity records. Removal from the app interface may precede final erasure. We verify completion and handle failed deletion jobs before treating a request as complete.

Retained backups are restricted to recovery and expire under the schedule above. If restored, relevant deletions are reapplied. Legal holds preserve only necessary records for a justified period, with access restricted. Where permitted, we explain relevant retained records and the reason to the requester.

Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, object, withdraw consent, receive a copy of your data, or complain to a regulator.

EU/EEA users may contact their local data protection authority. Turkey users may exercise KVKK Article 11 rights and, where applicable, complain to the Turkish Personal Data Protection Board. California users may have CCPA rights to know, delete, correct, opt out of sale/share, limit use of sensitive personal information, and non-discrimination if the CCPA applies to us.

Submit requests to legal@jestersbox.com. You can request access or a copy without deleting your account. We may verify identity and ask for enough information to locate the records. We provide applicable data through secure delivery in readable or commonly used electronic formats, protecting other people's information. We cannot supply local-only files that we never received.

For GDPR requests, we respond without undue delay and normally within one month; where a permitted extension is needed, we explain it within that initial period. KVKK requests follow the period below. Applicable exceptions, fees or refusals will be explained; ordinary requests do not require a paid plan. Requests about an organization's content may be routed to that organization, with our assistance where required.

Children

Jesters’ Box accounts and subscriptions are intended for people aged 18 or older. Our Terms require you to be at least 18 to create or use an account. We do not intentionally offer accounts to children or knowingly provide accounts to minors. If you believe a minor has created an account or sent us personal data, contact legal@jestersbox.com so we can investigate and take appropriate account and deletion action. We do not collect a separate age confirmation or Privacy Notice acknowledgement during signup, or ask for a date of birth or identity document to verify age. This notice explains our processing; accepting the Terms is not consent to optional tracking or marketing. Personal data concerning minors within customer-controlled content is also subject to the applicable privacy obligations and the customer’s lawful instructions.

Security

We use technical and organizational measures designed to protect personal data. Authentication tokens stored on your device are protected using operating-system-backed encryption where available. Protection depends on your operating system and device configuration. When this protection is unavailable, tokens may be stored locally without encryption. No security measure is perfect, and you are responsible for securing your device, account credentials, workspace backups, and imported assets.

Security reports

Report vulnerabilities to legal@jestersbox.com.

Please include:

• Affected version or URL.
• Steps to reproduce.
• Impact and exploitability.
• Your contact details.

We ask researchers not to access, modify, delete, or exfiltrate data that is not their own and not to disrupt services.

Changes

We may update this Policy. If changes are material, we will provide notice by email, in-product notice, or another reasonable method.

Contact

Privacy requests: legal@jestersbox.com

Security reports: legal@jestersbox.com

Legal notices: legal@jestersbox.com

Türkiye / KVKK

This section provides additional information for processing subject to Türkiye’s Personal Data Protection Law No. 6698. The controller and contact details are in the Controller section above; data categories, purposes and recipients are described in the corresponding sections of this notice.

The controller is the Türkiye company identified above. Send requests directly to its stated address or legal@jestersbox.com.

Collection Methods and Legal Grounds

We collect data electronically through the desktop app, account forms, support channels, API requests, and user-imported files, and through cookies or similar technologies where used as described below.

Legal grounds under KVKK may include:

• Processing is necessary for establishing or performing a contract.
• Processing is necessary for the data controller's legal obligations.
• Processing is necessary for establishing, exercising, or protecting a right.
• Processing is necessary for legitimate interests, provided that fundamental rights and freedoms are not harmed.
• Explicit consent where required for optional marketing or non-essential cookies. Special-category processing and international transfers require their own applicable legal conditions; ordinary service acceptance is not explicit consent.

Transfers

Personal data may be transferred to:

• Cloud hosting, authentication, email, storage, support, payment, analytics, security, and infrastructure providers.
• Professional advisers, auditors, insurers, and legal counsel.
• Authorities, courts, regulators, and law enforcement where required by law.
• Business transaction parties under appropriate confidentiality obligations.

Personal data may be transferred abroad where a lawful KVKK transfer mechanism applies. Routine cloud transfers must use an applicable adequacy decision or appropriate safeguard under Article 9. Explicit consent is not a general substitute for safeguards for ongoing transfers: Article 9 derogations are limited to incidental transfers under their statutory conditions. See the Subprocessor List for providers and the transfer arrangements requiring completion before publication.

Rights Under KVKK Article 11

You may request:

• To learn whether your personal data is processed.
• Information if your personal data has been processed.
• To learn the processing purpose and whether data is used in line with that purpose.
• To know third parties to whom data is transferred domestically or abroad.
• Correction of incomplete or inaccurate data.
• Deletion or destruction where the reasons for processing no longer exist.
• Notification of correction, deletion, or destruction to third parties to whom data was transferred.
• Objection to results arising solely from automated analysis.
• Compensation for damage caused by unlawful processing.

How to Apply

Send requests to legal@jestersbox.com or ALİBAHADIR MAH. ÇAYIRLAR CAD. NO: 9 İÇ KAPI NO: 1, 34829 BEYKOZ / İSTANBUL, Türkiye.

We will respond as soon as possible and no later than 30 days under KVKK Article 13. We may request information needed to verify identity and locate the relevant records.

Explicit Consent Notes

Where explicit consent is used, it must be freely given, specific, informed, and withdrawable. Refusing optional consent should not prevent use of core local desktop functionality unless the consent is necessary for the requested optional feature.

Cookies and similar technologies

This section covers cookies and similar technologies used in the Jesters’ Box desktop app. It does not describe the website’s cookies or browser storage; those are covered separately by the website’s own disclosures. Local workspace content and its retention are also described in the Local-first processing and Retention sections.

What Cookies Are

Cookies are small files or identifiers stored on a browser or device. Similar technologies include local storage, pixels, SDKs, and tags.

Current app cookies and local storage

The desktop app does not itself set first-party cookies or include our own analytics or advertising trackers. It does store information on your device to provide the features you use, including authentication sessions, settings, interface preferences, workspace databases, files and previews. This local storage is distinct from cookies used by sign-in and payment providers. The app should not be understood as using no device storage or as guaranteeing that third-party services use no cookies.

Storage	Purpose	Retention and controls
First-party cookies	The desktop app does not itself set first-party cookies	Not applicable
Authentication session and account settings	Keep your account signed in and connect to your cloud workspaces	Authentication tokens remain until sign-out, local deletion or replacement; token expiry and revocation apply separately. See Security for local token protection.
Temporary recovery state	Avoid repeated reloads if an application resource fails to load	Stored in session storage and normally removed after recovery; otherwise cleared when the renderer session ends.
Interface and navigation preferences	Remember sidebar layout, saved workspace views, quick-access choices and onboarding progress	Persistent preferences have no automatic time-based expiry in the inspected implementation. They remain until changed, reset where supported, or the relevant local app data is removed.
Local workspace databases, files and previews	Organize and display your assets, metadata, versions and other workspace content	Managed through workspace and file controls and the retention periods described in this notice. Independent backups and exports must be managed separately.

Signing out removes the app's saved authentication session; it does not erase your local workspaces or all saved preferences. Browser cookie controls do not clear the desktop app's local data. Uninstalling the app may leave local data behind. Removing application data can remove settings or content, so preserve any files you want to keep first.

Browser-based sign-in opens in your external browser. Amazon Cognito uses a session cookie for its hosted sign-in flow, and Google may use its own cookies when you choose Google sign-in. Their notices and your browser controls apply to those services.

The app loads Paddle’s payment integration when you open the pricing interface. Paddle operates the checkout and may use cookies or similar technologies for its payment services, including within the embedded checkout. See Paddle’s Privacy Policy. Website cookie choices do not automatically change desktop storage or cookies used by separately operated services.

Any optional analytics or marketing storage introduced in the app will be described separately, with consent obtained before use where required. Accepting the Terms does not by itself consent to optional tracking.

Contact

legal@jestersbox.com