Privacy and Your Data

1. Controller and Scope

Operator

MEHMET MELİH KOBA (sole proprietor)

Business address

Cevizli Mah. Zuhal Cad. A Blok No: 46 İç Kapı No: 50, Maltepe / İstanbul, Türkiye

Tax office

Kartal

Tax identification number (VKN)

5640347020

Telephone

+90 555 741 75 15

Support email

support@subtai.com

This notice covers the Subtai browser extension and subtai.com account service. Google, YouTube and Skool operate their own services. Subtai is not their official product. Subtai is currently in private beta; paid subscriptions and payment collection are not active.

2. Data and Purposes

• Account: Google sign-in provides your email, account identifier and basic profile information to our authentication provider. Subtai does not receive your Google password. Browser-stored session tokens keep you signed in.
• Captions: source subtitle text, languages and nearby sentences needed for context are sent through our backend to the translation provider. We do not upload the video or audio file or record your microphone.
• Translated viewing history: YouTube/Skool links, video or lesson titles, channel or community names, platform, usage dates and counted viewing time are saved locally and automatically synchronized to your signed-in Subtai account for display on the website. A random identifier distinguishes device snapshots.
• Usage: translated viewing time, platform totals, plan allowance, session and transaction records operate quotas, prevent duplicate requests and enforce one concurrent viewing session.
• Local preferences: language and subtitle appearance settings and cached translations are stored in your browser.
• Technical/support data: hosting and authentication providers may process connection information such as IP address, request time and errors. Information and attachments you send for support are processed to address that request.

We do not scan your entire browsing history. Translated viewing records do reveal the content you used Subtai with. Consider this before translating confidential content or captions containing personal information.

3. Providers and Transfers

• Google: sign-in; the landing page also requests Google Fonts, which involves connection information.
• Supabase: authentication, account/usage/history storage and backend translation requests.
• OpenAI API: translation of caption text, context and languages. Our translation payload does not add your email or Google profile.
• Titan Mail (through GoDaddy): receiving, storing and replying to support correspondence and attachments.
• Vercel: website hosting and associated request/security data; a private Blob store holds a one-way digest of the internal identifier and the deletion time for deleted-account restore protection.

These providers may process data outside Türkiye or your country. Our primary Supabase project is in Frankfurt, Germany. Under KVKK Article 9, routine transfers require an applicable processing ground and an adequacy decision or appropriate safeguards; the Board has not yet designated an adequate country. Occasional-transfer exceptions do not provide a general basis for a continuous service. Provider-specific safeguards and any required notification to the Board must be completed separately; this notice does not claim that standard contracts have been signed. Neither signing in nor reading this notice is blanket consent for a transfer.

Planned payment providers iyzico and Paddle do not receive payment data from the current beta.

4. Retention

Our temporary translation result text becomes eligible for clearing 24 hours after its job started; the normal cleanup interval is five minutes. Associated account, usage and job metadata are not removed by that task. Provider copies have separate retention: OpenAI documents standard API abuse-monitoring retention of up to 30 days, subject to its stated exceptions. See OpenAI data controls.

The extension prunes local history when reading/updating it to 90 days and at most 500 videos per device. The website displays the last 90 days. A daily server task removes device snapshots not updated for 90 days; this is not a guarantee that each individual entry is physically erased on day 90. Local translation cache has no automatic expiry; you can clear it in advanced extension settings.

For free-beta accounts, technical translation job records older than 30 days and expired viewing sessions older than 30 days (including their receipts) are eligible for daily cleanup. Monthly usage summaries retain the current UTC month and the previous two months. Active viewing leases are preserved; busy accounts may wait until the next cleanup. This task excludes paid accounts, payment/invoice records and backups.

To prevent a deleted account returning from an older restore, a one-way SHA-256 digest of the internal account identifier and the deletion time is retained for 45 days in a private technical ledger. It contains no email, Google profile, viewing history or content; a copy is held in a private store outside the primary database and removed after 45 days by a daily task.

5. Your Controls

Disable the extension to stop translation. Delete entries in extension History and clear the translation cache separately. History deletion reaches that device’s server snapshot after a successful sync. Another device may still have its own entry. Website history is currently read-only. Deleting history does not restore spent allowance. Signing out or uninstalling does not automatically delete your server account. You can permanently delete your free-beta account from the account page after verifying again with Google and giving separate final confirmation. Your server account, history, usage and translation job records are removed together, including unused free allowance. A different selected account or expired verification prevents deletion. Device copies and existing backups are not immediately erased; clear local copies separately in the extension. Previously sent provider requests cannot be recalled. Contact support for paid accounts and other data requests; applicable retention obligations are assessed separately.

6. Collection and Legal Grounds

Data is collected electronically through Google sign-in, supported page functions, browser storage, service requests and your support correspondence. Proposed KVKK grounds are performance of the requested account, translation and history service (Article 5/2-c); necessary security and abuse prevention subject to balancing your rights (5/2-f); applicable legal obligations (5/2-ç); and establishment, exercise or defence of rights (5/2-e). A new consent-based purpose requires a separate choice before processing.

7. Rights and Requests

Subject to KVKK Article 11, you may ask whether data is processed, obtain information about purposes and recipients, request correction, request erasure/destruction where conditions are met and notification to recipients, object to adverse results arising solely from automated analysis, and seek compensation for unlawful processing. Other mandatory rights apply where relevant.

You can send a written request to MEHMET MELİH KOBA at the business address above. We request only information necessary to verify identity and respond within the applicable legal period; KVKK requests must be answered within 30 days at the latest.

8. Google Data and Limited Use

Subtai complies with the Google API Services User Data Policy for Google API data and the Chrome Web Store Limited Use requirements for extension data.

Data is used for the disclosed user-facing functions and their secure operation, not sold or used for ad targeting or credit decisions. Human review of personal content is restricted to permitted circumstances, such as your explicit consent for specific content, security/abuse investigations or legal obligations. Routine support access must respect these limits.

9. Changes

We update this notice when processing changes and explain material changes before the affected feature is used. A changed date alone does not authorize a new processing purpose.