Effective date: 30 October 2026
Controller and contact
Kerem Yılmaz Güney operates RKXBeta as an individual and is the data controller for the platform processing described here. Public location: Kartal, Istanbul, Türkiye. Privacy contact: info@rkxbeta.com. RKXDesign is a separate business and is not the RKXBeta operator.
Accounts and dashboard
Registration and authentication process your email, supplied name/display name, password hash, email verification and password-reset tokens, acceptance records and account/session identifiers. The customer dashboard displays your profile, orders, subscriptions, licenses, activated sites and support conversations. Session records include expiration and device/user-agent information for account access and session management.
Licenses, domains and installations
License activation and validation process the license identifier/status, product and edition, activation allowance, authoritative expiration date, installation identifier, website URL/normalized domain and activation/deactivation timestamps. These records associate a purchased entitlement with its authorized WordPress installations and enforce activation, expiration and package-access rules. Do not send full license keys in support messages.
Orders and subscriptions
We record product/plan and pricing snapshots, order status, customer association, transaction and subscription references, billing periods, payment/renewal/refund events and fulfillment links to entitlements and licenses. When enabled, Paddle processes checkout payment and billing information under its own notices; the application receives transaction and fulfillment data through its server integration and verified webhooks. RKXBeta does not request raw card details through its own account forms.
Support and attachments
Support tickets store messages, staff replies, ticket status/history, account associations and submitted attachments. Authorized staff access these records to provide assistance and administer support. Attachment downloads require authorization. Avoid uploading passwords, API secrets or unnecessary personal information.
Purposes and collection methods
Information is collected through account and support forms, authenticated dashboard actions, plugin licensing requests, payment integration events when enabled, and operational request/session records. We use it to register and authenticate accounts, verify email, reset passwords, display the dashboard, deliver eligible downloads, issue and validate licenses, manage subscriptions and site limits, handle support, send transactional notifications and protect the service against abuse.
Legal bases
Where applicable under Türkiye’s Law No. 6698 (KVKK), processing relies on necessity for establishing or performing the requested account/software service contract; applicable legal obligations for required records; establishing, exercising or protecting legal claims; and legitimate interests in necessary service security, subject to the individual’s fundamental rights and freedoms. Any processing requiring separate consent must have that consent; accepting website terms is not blanket consent to every use of personal data. Other applicable data-protection requirements remain unaffected.
Transactional email
The platform uses SMTP email infrastructure for account verification, password resets and applicable order, license and support notifications. Delivery and retry records support these operations. Our configured sender is info@rkxbeta.com. These service messages do not enroll you in a marketing mailing list.
Cookies and request metadata
The storefront uses the essential __Host-rkxbeta-customer authentication cookie with Secure, HttpOnly and SameSite=Lax protections. Login sessions last 12 hours, or 30 days when Remember me is selected. Logout invalidates the relevant session. Authorized staff use a separate CMS session. Request metadata and IP-derived rate-limit buckets help prevent abuse; hosting and proxy infrastructure may also produce access/security logs. The current RKXBeta website does not integrate optional advertising or analytics trackers. If Paddle Checkout is opened when purchases are enabled, Paddle’s own cookies, storage and notices apply.
Recipients, infrastructure and international processing
The platform is hosted on Hetzner infrastructure in Germany and uses a PostgreSQL database. Transactional email is sent through a self-managed mail server on Hetzner infrastructure. Private files are stored in Cloudflare R2. Infrastructure and storage services receive data needed for the functions they provide; authorized staff access records for administration and support. For Paddle transactions, Paddle receives payment/billing information and handles it under its own privacy notice: https://www.paddle.com/legal/privacy. RKXBeta receives transaction and fulfillment data for orders, subscriptions and licensing. We do not ask you to enter raw card details in our own account forms. Hosting in Germany involves processing outside Türkiye. Cloudflare R2 processing and storage locations depend on the actual service configuration; no particular R2 storage country is specified here. Any transfer abroad is subject to applicable data-protection requirements.
Retention and deletion
Account, licensing and activation records are retained for account and service administration; transaction records may also be needed for applicable legal obligations or claims. Support records and attachments are retained for handling and documenting support, and request/security metadata for abuse prevention and investigation. Retention depends on these purposes and applicable legal requirements; no single fixed period applies to all categories. Session or token expiration does not automatically delete related records or backup copies. Contact info@rkxbeta.com to request account closure, correction or deletion. Requests are reviewed against applicable rights and any lawful need to retain records. There is no self-service guarantee of immediate erasure of every database record, attachment and backup.
Security
Implemented safeguards include password hashing, encryption of stored license keys, authorized private downloads and attachments, signed internal requests, verification of payment-webhook signatures and role-based access controls. HTTPS and secure cookies protect account transport, and the configured SMTP connection uses TLS. No system guarantees absolute security.
Your privacy rights
Privacy requests are manually reviewed and processed through info@rkxbeta.com, with identity verification where appropriate. Contact this address to exercise applicable privacy rights. Under KVKK, these include learning whether data are processed, receiving information about their use and recipients, seeking correction or eligible erasure/destruction and notification to recipients, objecting to adverse results based solely on automated analysis, and seeking compensation for unlawful processing. Qualifying KVKK applications must be concluded as soon as possible and within 30 days. You may complain to the Personal Data Protection Board through the applicable statutory procedure after applying to the controller. Other applicable laws may provide additional rights. Identity verification may be needed; lawful retention requirements can affect deletion.