Privacy Policy

1. Data controller

Adaptify Yazılım Danışmanlık Ticaret Limited Şirketi (Kartaltepe Mah. Çamlık Sokak C Blok 185 Kartal/İstanbul) is the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) with respect to the personal data processed within the scope of the Service. With respect to the customer organisation's own employee data, the customer organisation may act as the data controller and OffTracker as the data processor.

2. Data processed

• Slack profile information: name, email, Slack user ID, profile picture.
• Leave data: request dates, type, note/reason, approval status, balance and adjustments.
• Optional: birthday information (for celebration features).
• Technical records: session information and audit trails.

3. Purposes of processing and legal basis

Data is processed for the purposes of providing the leave management service (performance of the contract), sending notifications, security and audit obligations, and improving the service. No processing is carried out for marketing purposes.

4. Storage and security

• Personal data is stored encrypted at rest.
• Each customer workspace's data is isolated in a separate database.
• Access is restricted on a role basis, and important operations are recorded in an audit trail.

5. Transfers and sub-processors

Data is shared, only to the extent necessary, with sub-processors that are essential for the operation of the service, such as hosting, email delivery and messaging platform integration (Slack). The current list of sub-processors is provided upon request. Your data is not sold.

Our website (offtracker.app) is delivered through the Cloudflare network. When you visit the site, your IP address and the request information sent by your browser (such as the requested address and browser type) are processed by Cloudflare in order to deliver the content and to limit excessive or abusive requests. The application itself (dashboard.offtracker.app) is not served through this network.

6. Retention period

Data is kept for the duration of the subscription and for the duration of legal retention obligations. Cancelling or the end of a subscription does not delete data. When a workspace is closed, access is shut off without delay and the data is placed in an archived state that is closed to access. Our policy is that, after the closure is completed (if there is a linked subscription, after its period has ended), archived data is permanently deleted at the end of a 30-day archive period. After the closure is completed, deletion is scheduled automatically by our system; scheduling is carried out by an automated check that runs hourly, once the required pre-checks are met, and the 30-day archive period runs from the moment the deletion is scheduled. Once the period has ended, deletion is carried out only after it has been verified that a current backup has been taken and the required pre-checks have been completed; deletion may be postponed until these conditions are met. Therefore, deletion exactly on the 30th day is not guaranteed; this does not mean that the data will be kept indefinitely. Permanent deletion requests are handled through the privacy@offtracker.app channel. Personal data that is not subject to a legal retention obligation is deleted, destroyed or anonymised. Invoice, payment and mandatory audit records may be retained for a limited purpose for the duration of the relevant legal obligations.

Data is also contained in system backups. Rotating backups are deleted cyclically after a certain period; deleted data may remain in backups for some time.

7. Your rights under KVKK

Pursuant to Article 11 of KVKK, you may exercise your rights to access your data, to request its rectification or erasure, to object to processing, and your other rights by applying to privacy@offtracker.app. Applications are answered within 30 days at the latest.

8. Cookies

The application uses only the cookies necessary for the service to work: a session cookie that keeps you signed in, short-lived security cookies used while signing in with Slack and during setup, and the app_language cookie, which stores your language preference for one year. No marketing/tracking cookies are used. The payment screen is provided by Paddle and is subject to Paddle's own policies.

9. Contact

For privacy questions: privacy@offtracker.app