Privacy Notice
Last updated:
This notice explains how MiniSurpriZZ handles personal data. It applies to everyone who buys from us, and covers your rights under the EU General Data Protection Regulation (GDPR) if you are in the European Union or European Economic Area. Buyers in Turkey are also covered by the Turkish KVKK Aydınlatma Metni.
1. Who we are
| Data controller | (sole proprietorship), trading as MiniSurpriZZ |
|---|---|
| Address | , Turkey |
2. What we collect
| What | Details | From |
|---|---|---|
| Billing details | Name, email, mobile phone, billing address; for company purchases, company name and tax number | You |
| Order | Order number, plan, amount, currency, payment result, invoice number | You, our payment provider |
| Your message | The names or nicknames you type, your question and message, the character and theme you pick | You |
| The receiver's answer | Whether the link was opened, and only whether an invitation got a “yes” or a “no” (not what they chose) | The receiver |
| Consent record | That you ticked the contract boxes, when, and your IP address at that moment | Automatic |
| Country | Your country (two letters, from your connection), for sales statistics; your IP address is not stored for this | Automatic |
| Reports | The reason and country given when someone reports a message; email addresses blocked for breaking our Terms of Use | The receiver; us |
| Email preference | Your email address, if you unsubscribe from follow-up emails | You |
We never see or store your card details. You pay on the secure page of PayTR, a licensed payment institution. We never collect the receiver's phone number or email: you share the link yourself, with your own app.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Taking your order, checking payment, creating and showing your surprise link, emailing you your link and receipt | (b) Performing our contract with you |
| Follow-up emails about what you bought (“your surprise was opened”, a reminder before pack links expire) | (b) Performing our contract. Every one has an “Unsubscribe” link. |
| Invoices, accounting and tax records | (c) Legal obligation (Turkish tax and commercial law) |
| Answering support requests and complaints | (b) Contract; (f) legitimate interest in handling claims |
| Preventing fraud and abuse, and removing messages that break our Terms of Use | (f) Legitimate interest in keeping the service safe |
We send no marketing emails or newsletters, and we never sell or share your data for advertising. We make no decisions about you by automated means alone.
4. Who receives it
| Recipient | Why | Where |
|---|---|---|
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | Taking your payment | Turkey |
| The Turkish Revenue Administration (GİB), through its e-Archive Portal | Issuing the legally required e-Archive invoice | Turkey |
| Vercel Inc. | Hosting the website | USA / EU |
| Supabase Inc. | The database for orders and messages | EU (Germany) |
| Cloudflare Inc. | Domain, security and email forwarding | USA / EU |
| Resend Inc. | Sending order and follow-up emails | USA |
| Authorities | Only when the law requires it | Turkey |
International transfers. We are based in Turkey, so your data is transferred to us outside the EU; this is necessary to perform the contract you ask us for (GDPR Art. 49(1)(b)). Transfers to our service providers in the USA rely on the EU Standard Contractual Clauses in their data processing terms, or on the EU–US Data Privacy Framework where the provider is certified.
5. How long we keep it
| Data | Kept for |
|---|---|
| Your message | Until the link expires (30 days after it is first opened, or 90 days after payment if never opened), then erased |
| The link's dates and yes/no answer (proof of delivery) | 13 months, then deleted |
| Invoices and accounting records | As long as Turkish law requires (usually 10 years) |
| Your IP address from checkout | 2 years, then deleted |
| Reports | 13 months, then deleted |
| Blocked email addresses | Until the block is lifted |
| The unsubscribe list | Until you ask us to remove you, so we can respect your choice |
6. Cookies
We use no advertising or tracking cookies, so there is nothing to accept. Your browser's local storage keeps your draft, sound setting, currency and links on your own device only; it is never sent to us.
7. Your rights
You can ask us to:
- tell you what data we hold about you and give you a copy (access),
- correct it (rectification),
- delete it, unless the law requires us to keep it, such as invoices (erasure),
- limit how we use it (restriction),
- send it to you or to another company in a common format (portability),
- stop using it where we rely on legitimate interest (objection).
Write to . We reply free of charge within one month. If you are not happy with our answer, you can complain to the data protection authority in the EU country where you live or work.
8. Age
You must be 18 or older to buy. We do not knowingly collect data from children.
9. Changes
If we change this notice, we update the date at the top. Important changes are announced on the website.