KVKK Clarification Text

A. Platform Customers (Server Owners / License Holders)

• Identity Data: Full name, username.
• Contact Data: Email address, phone number, billing address, city, country, postal code.
• Financial and KYC Verification Data (CrafterPayments): National ID Number (encrypted via AES-256-GCM), IBAN (encrypted via AES-256-GCM), bank account holder name, payout history.
• Billing and Tax Info: Company title, tax office, tax registration number (for BirFatura integration).
• Account Security Data: Bcrypt password hashes, JWT session tokens, 2FA TOTP secrets and recovery codes, login history.
• Security and System Logs: IP addresses, User-Agent strings, and Audit Log records as per Law No. 5651.
• External Integration Data: Discord ID, username, avatar (via OAuth2 connection).

B. End Users (Players / Store Customers)

• Identity and Profile Data: Username, Minecraft in-game username (IGN/UUID), profile wall messages.
• Contact Data: Email address, password reset and verification emails.
• In-Game and Plugin Data: AuthMe registration date and IP (regIp), playtime metrics, online status, LuckPerms groups/permissions.
• Store and Chest Data: Purchased digital goods, virtual chest deliveries, store balance, player-to-player transfers, coupon usage history.
• Payment and Billing Data: Name, address, phone, merchant_oid, order amount, payment IP (credit card numbers are NEVER stored).
• Community and Moderation Data: Support tickets, forum posts, reports, and punishment logs (LiteBans / AdvancedBan).
• Marketing and Newsletter Data: Email open tracking (1x1 pixel) and link click analytics.

1. Providing continuous Crafter CMS, store, and server management infrastructure,
2. Processing transactions, fraud prevention, and bank payout requests on CrafterPayments,
3. Issuing legal e-invoices/e-archives under Tax Procedural Law,
4. Instant command delivery to Minecraft servers with two-way AuthMe and LuckPerms synchronization,
5. Maintaining statutory traffic and access logs under Law No. 5651,
6. Preventing automated bot and brute-force attacks via Cloudflare Turnstile,
7. Handling support tickets, player reports, and server moderation procedures,
8. Sending service announcements and measuring communication delivery rates.

• Payment Service Providers (PayTR, İyzico, Shopier, Stripe, Kuveyt Türk, Tosla, Xsolla): Secure payment processing, fraud prevention, and chargeback handling.
• Official / Tax Integrators (BirFatura & Revenue Administration): Legal invoicing and tax reporting requirements.
• Infrastructure and Security Providers (Cloudflare Inc.): DNS routing, SSL certification, DDoS mitigation, and Turnstile bot protection.
• Email Infrastructure (Postal / Corporate SMTP): Sending transactional notifications, verification codes, and announcements.
• Discord Inc.: Providing Discord OAuth2 login, webhook notifications, and role synchronization.
• Judicial and Regulatory Authorities: Upon mandatory statutory requests or ongoing legal proceedings.

• Learn whether your personal data is being processed,
• Request information if it has been processed,
• Inquire into the purpose of processing and verify proper usage,
• Know the third parties to whom data is transferred nationally or abroad,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction of your personal data under statutory conditions,
• Object to outcomes resulting solely from automated processing,
• Claim compensation for damages arising from unlawful processing.