Legal information

KVKK privacy notice

Last updated: 7 October 2026 · 18 min read

This notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how your personal data is processed when you use Loop and supplements the Privacy Policy for users resident in Turkey; both documents apply together. If this notice differs from the Privacy Policy in relation to data subjects resident in Turkey, this notice prevails on matters concerning the KVKK.

Loop is a task management and no-code automation service for small and medium-sized businesses, provided by MercanWorks OÜ under the N-XPLUS brand. This notice covers all data categories and transfers involved in the product's current operation. If a new category, purpose or recipient is added, the notice is updated and the dated change is published on this page.

1. Data controller

As MercanWorks OÜ (N-XPLUS — Loop), we process your personal data as controller under the KVKK and GDPR for your account, subscription and technical records. Your company is the controller for the business data it enters into the service; this distinction is explained in section 13.

MercanWorks OÜ is incorporated under the laws of the Republic of Estonia and is established in the European Union. Processing of your personal data is therefore subject to the General Data Protection Regulation (GDPR), wherever you live; Turkish Law No. 6698 on the Protection of Personal Data (KVKK) also applies to data subjects resident in Türkiye. You can use the contact details below for any questions or requests concerning your personal data.

2. Personal data processed

We process the following categories of personal data. Each category specifies the source and purpose of processing; the legal grounds are listed in section 5. This list covers all current product operations and will be updated if a new category is added.

2.1. Account and identity details

Source: registration, sign-in and settings screens. Purpose: creating your account, verifying sign-in and identifying you within the company. Accounts are personal; the person who creates the company becomes its owner, and ownership can be transferred.

Your name and a verified email address are required to create an account; without them, an account cannot be created. Preferences are optional. When upgrading to a paid plan, the billing details requested by Stripe are necessary to enter into the contract.

Employee details are collected at your company's discretion; your company determines which fields are requested and who can see them. Loop does not process these fields for its own purposes or include them in notifications, logs or exports. Fields restricted to administrators are not visible to other people in the company. These details are deleted when your account is removed from the company.

• The name
• Email address (sign-in identifier; verification required)
• Password — stored only by the authentication provider as a one-way hash; Loop never sees or stores your password in plain text
• Session token — stored in your browser while you are signed in and sent to the authentication provider with each request to verify your identity; deleted when you sign out
• Your role within the company: owner, administrator or member; your team membership and role within the team
• Display choices (theme, light or dark mode, background and accent colour), notification preferences, dashboard layout and the language of your emails and notifications (stored in your account); card surface, other display preferences and interface language remain only on your device
• Employee details: fields requested by your company. Loop starts with three fields (date of birth, work phone and personal phone); your company administrator can add or remove fields. Your company determines who can complete and view each field; this is shown next to the field in Settings

2.2. Your company's business data

Source: your company's members and people completing its publicly shared forms. Purpose: providing the service itself — work tracking, automation and performance measurement. These records may include personal data of third parties (customers, suppliers or form respondents); for this data, your company is the controller and Loop is the processor (section 13).

Values in fields marked confidential are stored in a separate database column and read only by people authorised by your company, through a single controlled access point. They are not sent to the AI setup assistant or publicly shared forms.

• Tasks, subtasks and interpretations of tasks
• Projects and project chat messages
• Attachments (files added to tasks and chats)
• Form definitions and responses (in-app forms and forms shared externally by link)
• Values of fields defined for task types
• Automation rules
• Activity history (who changed what and when) and assignment history

2.3. Notification records

Source: the operation of the service itself. Purpose: preventing duplicate notifications and showing you delivery status. Loop does not send email notifications per task; its channels are in-app notifications and, if you enable them, browser notifications and phone notifications in the mobile app. Company owners and administrators may also receive an email summarising the company’s work status at the frequency they choose. In-app notifications are deleted after 12 months; browser and phone notification delivery records are deleted 30 days after sending.

• Who received a notification, when it was sent and through which channel (in-app, browser or phone notification)
• Delivery status

2.4. Browser and phone notification subscription

Source: your browser or the mobile app, only when you enable notifications. Purpose: delivering notifications to your device even when the app is closed. You can disable the browser subscription at any time in the app settings or your browser's site permissions, and phone notifications in your phone's notification settings; the phone's token is deleted when you sign out of the mobile app. Unused subscriptions and the tokens of phones not opened for 12 months are deleted.

• Endpoint address supplied by your browser
• Encryption keys generated by your browser to encrypt notification content end to end
• When you allow notifications in the mobile app, your phone's notification token and phone type (Android or iOS)

2.5. AI setup assistant conversations

Source: only when you run the assistant. Sequences of 10–11 digits (phone or identity numbers) and email addresses in the request and response are masked when the log is written; the log does not contain them in plain text. Masking applies only to the record stored in Loop; your request is sent to the model provider as you typed it (section 9). The purposes are quality and abuse monitoring and counting your plan's AI credits. The assistant's operation and international data transfers are detailed in section 9.

• Your request to the assistant
• Response summary; names and number of tools called, approval status and turn outcome

2.6. Public form security records

Source: requests from people completing a form your company has shared externally by link. Purpose: rate limiting and protection against abuse. The IP address itself is not stored; the hash is deleted after 7 days.

• One-way hash (SHA-256) of a public-form submitter's IP address

2.7. Payment and subscription details

Source: details you enter on Stripe's own page when upgrading to a paid plan, and subscription status notifications from Stripe. Purpose: setting up and billing subscriptions and enforcing plan capacity. Card numbers and bank details never reach Loop; they are entered and processed only on Stripe's own payment page.

• At Stripe: company name, owner's email address and billing details
• At Loop: plan, subscription status and Stripe customer/subscription IDs

2.8. Automation logs

Source: execution of rules set up by your company. Purpose: making automation traceable (so you can see which rule made each change) and counting usage towards your plan's monthly action allowance.

• Rule log: which rule ran, when and with what result
• Event queue: record of the triggering event (30 days)
• Monthly automation action counter

2.9. Invitation records

Source: invitations created by your company's owner or administrator. Purpose: enabling people to join the company and counting usage towards the plan's user capacity. Invitation records are deleted 30 days after acceptance, cancellation or expiry.

• The e-mail address of the person you invited
• Invitation status (pending, accepted, cancelled, expired)

2.10. Transaction security information and permitted advertising measurement

Source: each request you make to the website and application. Purpose: serving the website and protecting it against attacks. These records are subject to Cloudflare's own policy; Loop does not keep an additional access log.

Cloudflare Web Analytics is used for visit statistics. It uses no cookies, local storage or device fingerprints, creates no identifier for an individual and does not associate visits with individuals. It counts page views and their sources, such as search engines, AI assistants or direct visits, in aggregate. The legal basis is legitimate interests (KVKK Art.5/2-f, GDPR Art.6/1-f); no separate consent is requested because no cookies are used. Cloudflare's own retention period applies, and Loop does not obtain individual-level reports from these data.

Error records are kept to keep the service running and to fix errors; the legal basis is legitimate interest (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)). They do not track individuals, write nothing to your device and are visible only to Loop’s authorised operator. Repeated occurrences of the same error are counted in one record; the record of a resolved error is deleted automatically after 90 days and all others after at most 180 days.

The purpose of advertising measurement is to measure how our ads contribute to new company sign-ups; the legal basis is your explicit consent (KVKK Art. 5/1, GDPR Art. 6(1)(a)). If you do not give permission, the tag is not loaded, no cookie is written and no request is sent to Google; the website and the product work exactly the same. If you give permission, data is collected at two moments: when you arrive on the website by clicking an ad, a page view notification is sent to Google; when you create a company in Loop, a single “sign-up” event is sent to Google whether or not you arrived through an ad, and Google counts it as a conversion only if it can match it to an ad click. The tag runs in a separate frame rather than in the page itself; Loop does not give Google names, email addresses, phone numbers, company details or task content; enhanced conversions, the tag’s automatic collection of personal data from the page, personalisation and remarketing are not used. MercanWorks OÜ, which places the tag on the website and causes this data to be collected, is the controller. Google Ireland Limited (Ireland) and Google LLC (USA), which receive the data, process it for their own purposes and under their own terms as independent controllers; Google may also process the data on its servers in other countries. Giving permission therefore means that your data is transferred outside Turkey to the countries where Google has servers, in particular Ireland and the USA. The Turkish Personal Data Protection Board has not issued an adequacy decision for these countries; they may not offer protection and legal remedies equivalent to those in Turkey, public authorities there may access the data under their own law, and it may be harder for you to exercise your rights against Google. The cookies written by the tag are kept for at most 90 days; Google’s own retention periods are described in section 7. You can withdraw your permission at any time using the “Cookie preferences” link in the website footer; the advertising cookies are then deleted and no further data is sent to Google. Withdrawal does not affect the lawfulness of processing carried out before it. Details are in section 5 of the Cookie Policy.

• Request headers (IP address) — temporarily on the Cloudflare network serving the website and application
• Visit statistics — Cloudflare Web Analytics: pages viewed, referral source (referring website or app), browser type and country; as aggregate counts
• Error records: when an error occurs in the app or on the website, a technical summary of the error (error message, the page where it occurred, app version, browser type and, where applicable, your company); values such as email addresses, phone and ID numbers are masked before they are recorded
• Advertising measurement (only if you allow it in the banner on the website): data sent to Google through the Google Ads conversion tag, namely the address of the Loop page you visit (without the query part of the address), a random identifier assigned to your browser, the ad click identifier (gclid, gbraid, wbraid) and the cookie that stores it, a random transaction number created when a company is set up, the IP address, the page title, browser, screen and device information, the consent status and the time of the event. The page address is sent to Google with the query part removed; information added to the address and the address of the external page that referred you to the Site are not sent to Google. The ad click identifier is taken from the address separately, and only this identifier is transmitted

2.11. Data we do not process

• No analytics, tracking or advertising cookies are written without your permission; no third-party tracking scripts run other than permitted advertising measurement; there is no usage telemetry; the only advertising identifiers are the ad click identifier and the random identifier assigned to your browser, used only for permitted advertising measurement (2.10). Error records hold only a technical summary of the error (2.10).
• Location, screenshots, keyboard and mouse activity, availability and time online are not monitored. Changes made in the app are recorded by person in the activity history. Performance measurements use only task status and timing; they do not assess the quality of work.
• Card numbers and bank details never reach Loop.
• Loop does not send marketing emails. Your email address is used for sign-in identification, account verification and password reset messages, the invitation message sent when you are invited to a company, the summary email you choose if you are a company owner or administrator, and responses to your requests.
• Message content and access tokens for Gmail or Outlook accounts connected in Mail never reach Loop's servers and are not processed outside your device (section 8).
• Confidential field values are not sent to the AI setup assistant or publicly shared forms.

2.12. Rights requests and support correspondence

Source: your message or written request. Purposes: responding to your request, completing the procedure and retaining evidence. This correspondence is held in the company's email and correspondence systems, not the product database; retention periods are set out in section 7.

• Messages sent to [email protected] and [email protected]: sender address, your name, message content and attachments
• Written requests sent by post and documents provided to verify your identity
• The ‘Chat with us on WhatsApp’ button on the website starts a conversation with us on WhatsApp; if you write to us, your phone number, the name shown on your WhatsApp profile and your messages are processed to reply to that conversation, and the conversation is also subject to WhatsApp’s own terms.

3. Purposes of processing personal data

Your personal data is processed for, and only for, the following purposes:

• Opening an account, verifying an email address and providing login
• Company setup, invited membership and role/access enforcement
• Providing and operating the service: task tracking, project chat and attachments, forms, execution of automation rules and delivery of notifications
• Performance measurement: at your company's instruction as controller, calculating each employee's on-time completion score solely from task completion timing and showing it to the company administrator. The score is only a report, not an automated decision with legal effects; decisions always remain with the company administrator
• Measuring aggregate website and app visits without cookies or linking them to individuals
• Running the AI setup assistant only on request and counting credits
• Fulfilling contractual obligations; setting up and billing paid subscriptions and enforcing plan capacity
• Handling and resolving support requests and applications
• Fulfilling legal obligations and responding to written requests from competent authorities
• Ensuring information security and preventing unauthorised access, rate-limit violations and abuse
• Making automation and notifications traceable; detecting errors and improving the service
• Evidence and defence in potential disputes
• Measuring, only with your explicit consent, how our ads contribute to new company sign-ups through Google Ads conversion measurement (2.10)

4. Methods of collecting personal data

Your personal data is collected by the following methods:

• Registration/sign-in forms and email verification
• Company setup wizard, settings and invitation screens
• Tasks, comments, chat messages, attachments, form responses and field values you enter in the app
• Responses submitted by people completing forms your company has shared externally by link
• Requests to the AI setup assistant
• Subscription information generated by your browser, or your phone's notification token, when you permit browser or phone notifications
• Information entered on Stripe's payment page when upgrading to a paid plan, and subscription status notifications from Stripe
• Support requests, applications and security reports sent to [email protected] and [email protected], and written requests sent by post
• Records generated automatically during operation: activity history, notification and rule logs, the event queue and the public-form request counter
• Your browser's local storage — preferences and, if you connect a mail account, its tokens remain on your device and are not sent to the server; your session token is sent only to the authentication provider with each request to verify your identity (Cookie Policy)
• Mobile app — your session is kept in the phone's secure storage (Keystore on Android, Keychain on iPhone) and is deleted when you sign out; the interface language you choose is kept in the same storage; temporary copies of files you open to share are also deleted when you sign out
• Only if you give permission in the banner on the website: the Google Ads conversion tag running in a separate frame, the cookies it writes and its browser storage record; data collected this way goes directly to Google (2.10, Cookie Policy section 5)

4.1. Nature of collection

Data is collected wholly or partly by automated means during service operation, and by non-automated means in requests and support correspondence. The legal basis for each category is given in section 5.

Cookie policy →

5. Legal bases for processing personal data

Your personal data is processed on the following legal bases listed in Article 5 of the KVKK. The corresponding basis in Article 6 of the GDPR is shown beside each heading.

5.1. Necessary to enter into or perform a contract — KVKK Art.5/2-c · GDPR Art.6/1-b

Creating accounts and verifying sign-in; joining a company by accepting an invitation; providing account, role and access functions; when you run the AI setup assistant, sending your request, your company's configuration names and, if you search for existing work, matching task titles to the model provider; setting up and billing paid subscriptions and enforcing plan capacity; handling your applications and support requests.

5.2. Compliance with the controller's legal obligations — KVKK Art.5/2-ç · GDPR Art.6/1-c

Responding to written, specifically scoped requests from competent authorities; invoicing and record-keeping duties under financial legislation (invoices are kept by payment provider Stripe); notification duties in the event of a data breach; handling data subject requests within the applicable deadline.

5.3. Necessary to establish, exercise or defend a right — KVKK Art.5/2-e · GDPR Art.6/1-f

Establishing evidence and defending claims in potential disputes; protecting rights arising from the Terms of Use.

5.4. Necessary for the controller's legitimate interests — KVKK Art.5/2-f · GDPR Art.6/1-f

Provided your fundamental rights and freedoms are not harmed: keeping notification records (preventing duplicates and showing delivery), rule execution logs, the event queue and automation action counter (traceability and quotas), masked AI assistant conversation summaries (quality and abuse checks and credit counting), one-way IP address hashes for public forms (rate limiting and abuse prevention), invitees' email addresses until acceptance in accordance with your company's invitation instructions; ensuring information security and detecting errors.

5.5. Your explicit consent — KVKK Art.5/1 · GDPR Art.6/1-a

Where the conditions above do not apply, we rely on your explicit consent: Google Ads advertising measurement on the website runs only if you choose “Accept all” in the banner or the panel, or turn on advertising measurement in the “Cookie preferences” panel, and you can withdraw this permission using the “Cookie preferences” link in the website footer (2.10); browser notification subscriptions and phone notifications are created only with your permission and can be removed at any time in your browser, your phone's notification settings or the app settings. Authorisation when connecting Gmail or Outlook in Mail is an OAuth permission granted to Google or Microsoft, not explicit consent given to Loop; MercanWorks OÜ cannot access this data (section 8). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. Transfers of personal data

Your personal data is transferred to the infrastructure providers operating the service and the other recipients listed below, as necessary and within the stated scope. If you permit advertising measurement on the website, your data is also transferred to Google (6.2 and 2.10).

6.1. Transfers to competent authorities

Loop has no subprocessor established in Türkiye. Transfers to competent public bodies (in Türkiye, Estonia or elsewhere in the European Union) occur only in response to written, specifically scoped requests and are limited to that scope.

6.2. International transfers: subprocessors and other recipients

MercanWorks OÜ is an Estonian (European Union) company. Database and authentication infrastructure is hosted within the European Union in Frankfurt (Germany, AWS eu-central-1). The providers used, their roles and the data sent to each are listed below:

6.3. Legal status of transfers and limits

As the service is provided by MercanWorks OÜ, established in the European Union, your data is sent to EU servers in Frankfurt when you open an account. For data subjects resident in Turkey, this transmission and transmissions to the providers listed in 6.2 are transfers abroad under Article 9 of the KVKK. The Turkish Personal Data Protection Board has not issued an adequacy decision for these countries; details are in section 6 of the Privacy Policy. When you use the AI setup assistant, your text is sent to OpenAI in the USA, payment details go to Stripe, and the content of file attachments goes to Cloudflare R2. These transfers occur only when you use the relevant part of the service. Information for users in the European Union is in 6.4 of the Privacy Policy.

MercanWorks OÜ never sells or rents your data for marketing, never transfers it to data brokers and never uses it to train artificial intelligence models. The only transfer to an advertising network is Google Ads conversion measurement, which runs on the website only with your explicit consent. Google processes this data under its own terms and for its own purposes as an independent controller; the countries and possible risks of this transfer are described in 2.10.

7. Retention periods — how long data is kept

The timed retention periods in the table below are defined in the product code and enforced automatically each night; expired data is deleted. Records that depend on deletion by you or your administrator, and actions taken on request, are identified separately.

7.1. File attachments

Attachment bytes are stored in Cloudflare R2; metadata (name, size and uploader) is stored in the database. Access is checked against the database on every request: anyone unable to view the metadata cannot access the bytes either. Deleting a file removes its bytes from storage. Each file can be up to 25 MB; total storage is subject to your plan's allowance. Uploaded files are losslessly compressed and their SHA-256 integrity hash is verified on download.

7.2. What happens when the period ends

Data is deleted at the end of the retention period. Records in your browser's local storage remain on your device until you delete them; see the Cookie Policy for details. You can export your task list and performance report as CSV from the app; this version does not offer a one-click full backup download.

7.3. Retention periods applied outside the product code

The following periods are enforced through the company's legal duties and request-handling process, rather than the nightly cleanup:

• Invoices are issued through Stripe; MercanWorks OÜ retains them as accounting records for 7 years from the end of the relevant financial year under the Estonian Accounting Act, including after company closure. The Loop subscription record (plan, status and Stripe identifiers) is deleted with company data.
• Request and support correspondence: up to 24 months after closure.
• Account deletion: deletion in the app takes effect immediately; email requests are completed within 30 days at the latest. After deletion, only financial records subject to statutory retention remain; your name continues to appear on the work records (tasks, comments, messages) of the companies you belonged to.

Cookie policy →

8. Mail: your Gmail and Outlook accounts

In Mail, you can connect your Gmail or Outlook / Microsoft 365 account to read and reply to messages, send new messages, delete messages (reversibly, not permanently), archive them and mark them as read or unread within Loop. This feature appears only if the provider is configured and does not work in the demo company. Gmail connections are not currently offered; the Google (Gmail) provisions in this section apply if that connection becomes available again.

Authorisation takes place in your browser using OAuth 2.0. Loop has no client secret or intermediary server; mail data flows directly and encrypted between your browser and Google or Microsoft servers only.

8.1. Permissions requested for Google (Gmail)

Full Gmail access is not requested. The connection uses the implicit flow: the access token is valid for about an hour; there is no refresh token or permanent access. On expiry, the connection renews silently if you are still signed in to Google; otherwise you are asked to reconnect.

• gmail.modify — read mail, change labels, trash and archive status, and send messages; permanent deletion is excluded
• openid and email — display the connected account's email address in Mail and identify which account is connected

8.2. Permissions requested for Microsoft (Outlook / Microsoft 365 / Hotmail)

Access to shared mailboxes and organisation-wide access (Mail.ReadWrite.All) are not requested.

• Mail.ReadWrite — read, move, delete and mark as read
• Mail.Send — send
• openid and email — display the connected account's email address in Mail and identify which account is connected
• offline_access — refresh token; the connection continues until you remove it or revoke access in your Microsoft account

8.3. Data stays on your device

Access and refresh tokens are kept in your browser's local storage (loop-posta-hesaplar). The connection flow's verification key (loop-posta-akis) and silent refresh timestamp (loop-posta-sessiz) are kept in session storage and deleted when the tab closes. Message content is processed in browser memory and is not stored permanently on your device.

Mail content and tokens are not sent to Loop's servers, database, logs, AI setup assistant or any other third party. Loop cannot view, store, sell, use for advertising or use this data for model training. As a result, you must reconnect the account on another device or browser; clearing browser data removes the connection.

Mail data is processed only on your device and under your control, without access by MercanWorks OÜ; MercanWorks OÜ acts as neither controller nor processor for this processing. OAuth permissions granted to Google or Microsoft are governed by your relationship with that provider and can be revoked at any time (8.4).

8.4. Disconnecting an account

Removing a connection in Mail deletes its tokens and account details from your device. You can also revoke access on your Google account's permissions page or in the app permissions section of your Microsoft account's privacy settings. For Microsoft work or school accounts (Microsoft 365), permissions are removed through your organisation's My Apps portal or by its administrator; links are provided at the end of this section.

8.5. Displaying message content

Email bodies are rendered in a sandbox where scripts cannot run. Remote images load only in a separate, restricted frame; loading an image sends a request from your browser to the sender's image server, which can see your IP address — just as in the provider's own interface.

8.6. Google API Services User Data Policy — Limited Use

Loop's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Loop's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including Limited Use requirements. In practice, these principles mean:

• Gmail data is used only to provide the Mail features visible to you: reading, replying, sending, deleting, archiving and marking as read.
• Not used to serve or target advertising.
• Humans do not read the data except with your explicit permission, for security investigations or where legally required.
• Not transferred or sold to third parties.
• The data is not used to develop, improve or train general-purpose artificial intelligence or machine learning models.

Google API Services User Data Policy →

Google account — app permissions →

Microsoft account — privacy and app permissions →

Microsoft work account — My Apps →

9. AI setup assistant

The AI setup assistant, “Describe it, I'll set it up”, starts only when you run it and helps you configure your company: task types, stages, fields, work steps, tasks, forms and rules. For existing tasks, it can change only the assignee, due date, priority and stage; it cannot change task text or delete any record. On request, it can also add a person without an account to your company or create an invitation. The assistant never saves anything on its own: every proposed change is previewed and requires your approval.

When you run the assistant, your request, your company's type, field, stage and rule names, project and team names, and member names and roles are sent to the model provider (OpenAI, USA). If you ask it to find and update existing work, matching tasks' titles, numbers, stages, assignees and due dates are also sent. Task descriptions, comments, project chats, attachments, form responses, confidential field values and Mail data are not sent. MercanWorks OÜ sends only the data needed for that response and does not use it to train models on its own behalf. The provider's processing is governed by its API data policy: by default, API inputs and outputs are not used for model training, and abuse-monitoring logs are retained for up to 30 days.

Conversation records stored in Loop mask 10–11-digit sequences and email addresses and are deleted after 12 months. They are used for quality and abuse monitoring and credit counting. Each assistant interaction consumes one credit from your plan's annual AI allowance. The assistant is disabled on Free because that plan has no AI credits. The assistant makes no decisions about you; it only proposes a setup for your company.

10. Your rights under the KVKK

You have the following rights under Article 11 of the KVKK:

• Learn whether your personal data is processed
• Request information about processing
• Learn the purpose and whether data is used accordingly
• Identify recipients within the country or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction under the conditions in Article 7 of the KVKK (the company owner can close the company; all company data is permanently deleted after 30 days; you can delete your account yourself in the app or request it by email)
• Request that third parties to whom data was transferred be notified of corrections, deletion or destruction
• Object to an adverse outcome resulting solely from automated analysis of your data — Loop makes no such decisions; performance measurement is a report and does not generate automated decisions with legal effects for individuals
• Claim compensation for damage caused by unlawful processing
• In addition, withdraw your consent at any time for consent-based processing (advertising measurement, browser and phone notifications); you can withdraw permission for advertising measurement using the “Cookie preferences” link in the website footer, and withdrawal does not affect the lawfulness of earlier processing

10.1. Users resident in the European Union

Your rights of access, rectification, erasure, restriction of processing, data portability and objection under Articles 15–22 of the GDPR also remain unaffected. Data portability covers your account data for which MercanWorks OÜ is controller; a structured copy is provided on request. CSV export of task lists and performance reports is a product feature for your company's business data and is not a substitute for that right.

11. How to submit a request

You can exercise your rights through the methods below. Requests are received and handled in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller.

11.1. Request contents and identity verification

Include your name, the email address or company details relevant to your request, its subject and any supporting documents. To verify that the request is yours, we require it to come from your registered email address or ask for identity verification. Requests on another person's behalf require proof of authority.

If you do not have a Loop account (for example, you completed a company's public form or are its customer or supplier), that company is the controller of your data and you may apply directly to it. Requests of this kind sent to [email protected] are forwarded to the relevant company after identity verification, with the technical assistance needed for its response.

11.2. Response time and fees

Depending on its nature, your request will be handled as soon as possible and within 30 days at the latest, free of charge. If additional costs are necessary, a fee under the tariff set by the Turkish Personal Data Protection Board may be charged. You will receive a written response at the email address used for your request or the postal address you provide.

11.3. Right to complain

If your request is rejected, the response is insufficient or no response arrives in time, you retain the right to complain to the Turkish Personal Data Protection Board within 30 days of learning of the response and in any event within 60 days of your request. If you reside in the European Union, you may contact the supervisory authority where you reside, work or where the alleged infringement occurred, or MercanWorks OÜ's lead supervisory authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Contact →

12. Data security measures

The following technical and organisational measures are applied under Article 12 of the KVKK to protect your personal data. No certification, audit or service level not stated here is promised.

12.1. Technical measures

• Each company sees only its own data; this is enforced through database row-level security and verified by live tests
• All connections are encrypted with TLS .
• Password stored only as a one-way hash by the authentication provider
• Confidential fields stored separately with controlled access
• A strict Content Security Policy (CSP) is enforced; no third-party scripts are loaded into the app, and permitted advertising measurement runs in a separate, restricted frame
• Secrets and keys are not sent to the client
• Email bodies in Mail are rendered in a sandbox where scripts cannot run
• Attachment integrity verified using SHA-256
• Dependencies are routinely scanned for vulnerabilities
• Database and authentication are hosted in the European Union (Frankfurt); attachment bytes are stored in Cloudflare R2 (6.2)

12.2. Organisational measures

• Minimum authority principle: access is granted only as long as the task requires it
• No experiments on production data; separate test accounts
• Retention periods are defined in code and enforced automatically; expired data is deleted without waiting for manual intervention

12.3. Vulnerability reports and data breaches

Report vulnerabilities to [email protected] with “security” in the subject line. If a breach affects your company's business data, MercanWorks OÜ, as processor, informs your company as controller without delay; your company is responsible for notifying supervisory authorities and affected individuals. For breaches affecting account and subscription data controlled by MercanWorks OÜ, notification is made within 72 hours of becoming aware to the Turkish Personal Data Protection Board and the Estonian Data Protection Inspectorate as lead supervisory authority under the GDPR. Affected users are informed within a reasonable time through the app, this page and, where necessary, their registered email address.

13. Your company's and customers' data — our role as processor

You are the controller of business data your company enters in Loop — tasks, comments, project chats, attachments, form responses, field values, rules, activity and assignment history. MercanWorks OÜ processes it on your behalf and instructions as processor. It may include personal data of public-form respondents, customers, suppliers and employees.

Your company, as controller, determines the legal basis for processing its business data. MercanWorks OÜ processes it only under the service agreement, which constitutes your company's written instructions, and does not rely on a legal basis of its own for that data.

This covers:

• You are responsible for informing your customers, employees and form respondents and obtaining explicit consent where required. Your own privacy notice must explain assessments of your employees, including performance measurement.
• Loop processes this data solely to operate the service for you; it does not use it for its own purposes, sell it, use it for advertising or train models with it.
• Company members can access data only within the roles and project permissions your company grants.
• The subprocessors for company data are Supabase, Cloudflare, Google Workspace for sending emails, Google Firebase Cloud Messaging and Apple for phone notifications, browser push services and OpenAI (when you run the assistant: type, field, stage, rule, project and team names, member names and roles, and matching task titles only if you search for existing work); the full list is in 6.2 of the Privacy Policy. New subprocessors are announced on this page and in the Privacy Policy, with an update date, at least 30 days before processing begins. If you disagree, you may object at [email protected] or terminate the agreement.
• To respond to data subject requests addressed to you as controller, you can correct and delete records in the app and export the task list as CSV. Closing the company permanently deletes all its data after 30 days.
• The data processing provisions required by GDPR Article 28/3 (subject matter, duration, nature and purpose; processing on instructions, confidentiality, security, subprocessors, deletion and return, and audits) and contractual terms governing use of the service are set out in the Terms of Use and apply alongside this notice.

Terms of use →

14. Updates to this privacy notice

This notice may be updated to reflect legal changes or changes to our processing activities. New versions are published on this page with an update date. Read it together with the Privacy Policy and Cookie Policy.

Privacy policy →

Cookie policy →

Terms of use →