Who we are
Meplis (“Meplis”, “we”, “us”) is the data controller for the personal data described in this policy, within the meaning of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”).
Contact: [email protected]
This policy also serves as the information notice (aydınlatma metni) required under Article 10 of KVKK.
Scope
This policy applies to:
- the website meplis.dev and its subdomains;
- mobile applications published by Meplis on Google Play and the Apple App Store (“Apps”);
- devices running Meplis firmware and the backend services they connect to, such as MQTT brokers and the firmware update (OTA) server (“Services”).
Where we build a product for a customer who operates it under their own brand, that customer is usually the data controller and their privacy policy applies; we act as their processor.
Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, phone number, hashed password, sign-in timestamps | You, when you register or sign in to an App |
| Device and connection data | Device identifiers and serial numbers, firmware version, IP address, network type, Wi-Fi network name used during setup | Apps and connected devices |
| Device telemetry | Sensor readings, status and error logs, energy and usage data, events detected by on-device processing (for example anomaly alerts) | Connected devices, via the Services |
| Location data | Approximate or precise location, only where a feature needs it (see App permissions) | Your phone, with your permission |
| Usage and diagnostics | App screens used, feature events, crash reports, phone model, operating system and App version | Apps, via analytics and crash-reporting tools |
| Website logs | IP address, browser user agent, requested page, date and time | Our web server, automatically |
| Correspondence | Content of emails and support requests | You |
The website does not use advertising or tracking cookies and does not run analytics. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.
Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|
| Creating and managing your account, providing App and device features | Performance of a contract (KVKK 5/2-c, GDPR 6/1-b) |
| Pairing and configuring devices, delivering telemetry, alerts and firmware updates | Performance of a contract (KVKK 5/2-c, GDPR 6/1-b) |
| Keeping systems secure, preventing abuse, diagnosing faults and crashes | Legitimate interest (KVKK 5/2-f, GDPR 6/1-f) |
| Improving products through aggregated usage statistics | Legitimate interest, or your consent where required by law (KVKK 5/1, GDPR 6/1-a) |
| Accessing location, Bluetooth and similar phone features | Your permission, which you can withdraw in phone settings at any time |
| Meeting legal obligations and responding to authorities | Legal obligation (KVKK 5/2-ç, GDPR 6/1-c) |
We do not sell personal data and we do not use it for advertising.
App permissions
Apps ask for permissions only when a feature needs them. You can refuse or revoke any permission in your phone settings; the related feature will then not work.
- Bluetooth and nearby devices: to find and pair Meplis devices.
- Location: Android requires location permission to scan for Bluetooth and Wi-Fi devices. Some features, such as showing devices on a map, may also use your location. We do not track your location in the background unless a feature clearly says so and you enable it.
- Wi-Fi: to connect a device to your network during setup. The Wi-Fi password is sent to the device and is not stored on our servers.
- Notifications: to deliver device alerts.
- Camera: where offered, to scan a device QR code. Images are not uploaded.
International transfers
Some of our service providers process data on servers outside Turkey or the European Economic Area. Where this happens, we rely on the transfer mechanisms permitted under KVKK Article 9 and GDPR Chapter V, such as standard contractual clauses, and on your explicit consent where the law requires it.
Retention
We keep personal data only as long as needed for the purposes above:
- Account data: while your account is active, and deleted after you close it, except where we must keep records by law.
- Device telemetry: for as long as the device is registered to you or as agreed with the device operator.
- Crash reports, diagnostics and web server logs: for a limited period, then deleted or anonymised.
When retention ends, data is deleted, destroyed or anonymised in line with KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
Security
We use technical and organisational measures appropriate to the risk, including encrypted connections (TLS) between Apps, devices and servers, signed firmware updates, access control on our systems and secure storage of credentials. No system is completely secure; if a breach affects your data we will notify you and the authorities as required by law.
Your rights
Under KVKK Article 11 and GDPR Articles 15–22 you have the right to:
- learn whether we process your personal data and request information about it;
- learn the purpose of processing and whether data is used for that purpose;
- know the third parties in Turkey or abroad to whom data is transferred;
- ask for incomplete or inaccurate data to be corrected;
- ask for data to be deleted or destroyed;
- ask that corrections and deletions be notified to third parties who received the data;
- object to a result against you arising from analysis solely by automated systems;
- claim compensation for damage caused by unlawful processing;
- receive your data in a portable format, restrict processing, and withdraw consent at any time (GDPR).
Send requests to [email protected] from the email address linked to your account. We answer within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU, to your local data protection authority.
Account and data deletion
You can delete your account and the associated personal data at any time:
- in the App, from the account settings screen where available; or
- by emailing [email protected] with the subject “Delete my account” from your registered email address.
We delete account data within 30 days. Data we must keep by law is retained only for the required period. Anonymised statistics that no longer identify you may be kept.
Children
The website, Apps and Services are not directed at children under 13, or under 16 in the EU. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
Changes
We may update this policy when our products or legal requirements change. The effective date at the top shows the latest version. For significant changes we will notify you in the App or by email.
Contact
Questions about this policy or your data: [email protected]