Privacy Policy

1. Who is responsible

For your account and for this website, coMinute is the data controller.

For the content a team puts into its workspace (projects, tasks, comments, files and time logs), the organisation that owns the workspace decides what goes in and why. For that content coMinute acts as a data processor on the organisation's behalf, and requests about it are best sent to the workspace owner first.

2. What we collect

• Account data: your name, email address, a hash of your password (never the password itself), your Google account identifier if you sign in with Google, your timezone, and your preferences such as notification and theme settings.
• Workspace content: whatever you and your team write or upload, including task titles and descriptions, comments, files, images and time logs.
• Security data: a random identifier kept in a cookie in your browser, combined with your browser and operating system family, so we can tell a device you have used before from a new one. We do not store your IP address or your full browser string for this.
• Email records: a copy of each message we send you and its delivery status, kept while it is being delivered and for a short time after.
• Technical logs: the records our servers need to run and protect the service.

We do not use advertising or analytics trackers, and we do not buy data about you from anyone.

3. Why we use it

• To provide the service you signed up for: signing you in, storing your workspace and showing it to the people you share it with (performance of a contract).
• To send the mail the service depends on: invitations, password resets, address verification and security notices (performance of a contract and our legitimate interest in keeping accounts safe).
• To send notifications and the optional morning summary, in the channels you choose in Settings.
• To keep the service secure, for example by recognising new devices and limiting repeated requests (legitimate interest).
• To meet legal obligations that apply to us.

4. Cookies and browser storage

coMinute uses only cookies that are strictly necessary for the service: the cookies that keep you signed in, the cookie that recognises a device you have used before, and a short-lived cookie that protects a Google sign in. Your browser's local storage keeps small preferences such as the theme you picked. None of these are used for advertising or tracking across sites.

5. Who we share it with

We share personal data only with providers that help us run coMinute, and only as far as they need it:

• our hosting and infrastructure providers, who store and serve the service;
• our email delivery provider, which sends the messages described above;
• Google, when you choose to sign in with Google.

Some of these providers may process data outside Türkiye or the European Economic Area. Where they do, we rely on the safeguards the law requires for such transfers. We do not sell personal data.

6. How long we keep it

Account data and workspace content are kept for as long as the account or workspace exists. Records of delivered email are deleted after seven days. You can ask us to delete an account or a workspace; we then remove its data, except where the law requires us to keep something for longer.

7. Your rights

Under KVKK (Article 11) and the GDPR you may, among other things:

• learn whether we process your personal data and ask for information about it;
• learn the purpose of the processing and whether it is used for that purpose;
• know the third parties it is shared with, in Türkiye or abroad;
• ask for incomplete or inaccurate data to be corrected;
• ask for your data to be deleted or anonymised, or for its processing to be restricted;
• receive your data in a portable format, and object to processing based on legitimate interest;
• object to a result that goes against you and arises only from automated analysis, and claim compensation for damage caused by unlawful processing.

You can also complain to the Turkish Personal Data Protection Authority (KVKK) or to the data protection authority where you live or work.

8. Security

We protect personal data with technical and organisational measures appropriate to the risk. The security page describes the main ones.

9. Children

coMinute is a tool for work and is not intended for anyone under 16. We do not knowingly collect data about children.

10. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top of this page and, where appropriate, tell account holders by email.