Privacy Policy

Last updated: 9 October 2026

This policy explains how we handle personal data when you visit our website, use our software (including Switchat) or buy from us. It is written to meet Turkey's Personal Data Protection Law No. 6698 (KVKK) and, for visitors in the European Union and the UK, the GDPR.

1. Who we are

Fatih Yılmaz – Fame Sosyal Medya, a sole proprietorship in Bodrum, Türkiye (tax no. 9691143061), is the data controller.
Contact: famesosyalmedya@gmail.com · +90 850 346 77 30

2. What we collect

When	Data
You visit the website	IP address, browser details and time of visit (server logs). We use no advertising or tracking cookies. How often each page is viewed, which site a visit came from and how often the installer is downloaded are kept only as daily totals; this counting uses no cookies and nothing that identifies you.
You buy a license	Name, email, phone, billing address, city, country and buyer type (individual or company); for individuals, optionally a Turkish ID number (TCKN); for companies, the company name, tax office and tax number (VKN); the product and license period, amount, payment date, order number, and your IP address at the time of purchase, which the payment institution PayTR requires for the payment. Your card details are never stored by us and never reach us: you enter them on PayTR's secure payment page and PayTR processes them.
You activate a license	A hash of the license key (not the key itself), a one-way device identifier derived from your computer, your computer's name, the app version and the activation time.
You create an account with e-mail and password	Your e-mail address, optionally your name, the site language, a one-way hash of your password (the password itself is never stored and we cannot see it), when your address was confirmed, account and session times; only one-way hashes of confirmation and password reset links; and, for security, the number and time of failed sign-in attempts.
You sign in with Google (on the website or in the app)	Your Google account's email address, name, a link to your profile picture and the ID Google gives your account; your open sessions (a one-way hash of the session, when it was opened and last used). We never get your Google password or anything else in your Google account. Licenses you bought are shown in your account by matching the email address on the order.
You use the Switchat app	At most twice a day the app sends an anonymous usage count: a random install number created at installation, the app version, where it was installed from (website/Microsoft Store), the app language and whether Premium is on. This count does not identify you, your computer or your WhatsApp accounts, and your IP address is not stored.
You join a launch waitlist	Your email address, the product you signed up for, the site language (English/Turkish) and the time you signed up. Your IP address is not stored with it.
You write to us or open a support request	Your email address, your name, the subject and topic of the request, the conversation, optionally your order number; for requests opened in the app, your app and Windows version if you tick that option.

3. Your data inside the app

Switchat opens WhatsApp's web version on your computer. Your messages, contacts and session data are stored only on your own computer and travel straight to WhatsApp's servers; they never pass through our servers and we cannot see them. The app's error and diagnostic logs also stay on your computer unless you send them to us.

4. Why we use it (legal bases)

To answer your support requests and notify you by e-mail — performance of a contract and legitimate interests (KVKK art. 5/2-c, 5/2-f; GDPR art. 6(1)(b), 6(1)(f)).
To take your payment, deliver your license and support you — performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
To send purchase notifications by email and, for Turkish mobile numbers, by SMS — performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)). These SMS messages are informational only and contain no marketing.
To issue invoices and keep accounting records — legal obligation (KVKK art. 5/2-ç; GDPR art. 6(1)(c)).
To create an account with e-mail and password, confirm the address, send password reset e-mails and prevent unauthorised access to your account — performance of a contract and legitimate interests (KVKK art. 5/2-c, 5/2-f; GDPR art. 6(1)(b), 6(1)(f)).
To create your account when you sign in with Google and show you your licenses and orders — performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
To count how many installs are active and which versions are in use (anonymous usage count) — legitimate interests (KVKK art. 5/2-f; GDPR art. 6(1)(f)).
To prevent license abuse and keep our systems secure — legitimate interests (KVKK art. 5/2-f; GDPR art. 6(1)(f)).
To email you when a product you joined the waitlist for launches — your consent (KVKK art. 5/1; GDPR art. 6(1)(a)). You can withdraw it at any time by writing to famesosyalmedya@gmail.com or using the link in our email.

5. Who we share it with

PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. — to take payments (including the order and contact details needed for the payment and your IP address at purchase).
NetGSM, our SMS provider — to send informational purchase SMS messages to Turkish mobile numbers.
Our email service provider — to send license key, order and invoice emails.
Our e-invoice provider — to issue e-Arşiv invoices.
Our hosting provider — data is stored on servers in Türkiye.
Google (USA) — only when you choose "Sign in with Google", to verify your sign-in. Google sends us your email address, name and profile picture during sign-in; we send Google nothing about you.
Authorities, when the law requires it.

Our support email runs on Google's infrastructure (USA), so emails you send us may be stored there. Your other data is not transferred outside Türkiye. If you are in the EU or UK, your data is therefore processed in Türkiye.

6. How long we keep it

Invoices and accounting records: as long as tax and commercial law requires (up to 10 years in Türkiye).
License and device records: for the life of the license and 2 years after it ends.
Server access logs: 1 year.
Unconfirmed accounts: deleted after 7 days. Confirmation and password reset links stop working after 24 hours / 1 hour.
Support requests: 2 years after the request is closed.
Account details: until you delete your account. You can delete it yourself under My account → Account settings; purchase and invoice records are kept for the legally required periods. Sessions are deleted when you sign out or when they expire.
Anonymous usage count: an install's record is deleted if the app sends no count for 1 year.
Launch waitlist: until 6 months after the product launches, or until you withdraw your consent, whichever comes first.

7. Your rights

You can ask to access, correct or delete your data, object to its use, restrict it, or receive a copy (KVKK art. 11; GDPR arts. 15–21). Write to famesosyalmedya@gmail.com; we reply within 30 days. You can also complain to the Turkish Personal Data Protection Authority or, in the EU/UK, to your local data protection authority.

8. Changes

When we update this policy we change the date above, and we email customers about significant changes.