Privacy Policy
Effective date: October 2026
This policy explains how Kavio Labs Software Limited ("Kavio Labs", "we") processes personal data when you:
- visit https://cs-cart.kaviolabs.com and its documentation;
- create an account or buy from us;
- contact support.
We are the data controller under the EU and UK General Data Protection Regulation ("GDPR") and the veri sorumlusu under Turkish Personal Data Protection Law No. 6698 ("KVKK").
How to reach us: Kavio Labs Software Limited, [REGISTERED_ADDRESS], e-mail [email protected]. If we have appointed an EU representative, it is: [EU_REPRESENTATIVE].
1. Data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6 / KVKK art. 5) |
|---|---|---|
| Account data: name, e-mail, password (hashed), company name | Your account, sign-in, order history | Contract |
| Billing data: billing country, company, VAT number, order contents, invoices | Selling, invoicing, tax compliance | Contract; legal obligation |
| Payment data: card payments are processed by Stripe; we receive only the payment status, the card brand and its last 4 digits. For bank transfers on request we receive the payer's name, bank and transfer reference | Taking payment, preventing fraud | Contract; legitimate interest (fraud prevention) |
| License data: license key, the domain you enter at checkout (or the first domain the license is checked on), the add-ons and editions you bought | Delivering downloads and updates, managing your licenses | Contract |
| License check data sent by our add-ons (see section 3): license key, add-on ID and version, storefront host names, CS-Cart version and edition; and the IP address of the server that sends the check | Verifying that the license is valid for the domain, showing your installations in My licenses, preventing misuse of license keys | Contract; legitimate interest (protecting our software against unlicensed use) |
| Support data: ticket contents, attachments, and temporary access details you choose to share | Answering your request | Contract; legitimate interest |
| Custom development requests: contact details, project details | Preparing a quote | Steps before a contract |
| Website usage data, only with your consent: pages viewed, device and browser data, collected by Google Analytics 4 | Measuring and improving the site | Consent (GDPR art. 6(1)(a); KVKK explicit consent) |
| Technical logs: IP address, user agent, time of request | Security, abuse prevention, troubleshooting | Legitimate interest |
| E-mail updates and offers, only if you opt in | Product news | Consent; you can withdraw at any time |
Order confirmations, license and renewal reminders, and help desk notifications are service messages, not marketing.
2. Access details you share in support
If you give us admin, FTP or hosting access to fix a problem:
- we use it only for that ticket;
- we never store it outside the ticket;
- we delete it from the ticket when the ticket is closed.
Please share access to a staging copy where possible, and change the credentials afterwards.
3. Our add-ons and your customers' data
The license check. Each add-on checks with our server (https://cs-cart.kaviolabs.com) that its license is valid for the domain it runs on. It checks when you save the license key and then about once every 24 hours, only from the admin panel or a cron job, never while customers browse your storefront. Each check sends exactly this, and nothing else:
| What is sent | Why |
|---|---|
The license key, for example KAVIO-AB12-CD34-EF56-GH78, or your CS-Cart Marketplace license number | To find your license |
The add-on ID and version, for example kv_product_videos 1.1.0 | To check that the key belongs to this add-on |
The host names of your storefronts, for example shop.example.com (no scheme, port, path or www; at most 20) | To check that the domain is covered by the license |
| Your CS-Cart version and edition, for example 4.21.2 Multi-Vendor | Compatibility and support |
| A random one-time value (32 hexadecimal characters) | Protection against replayed answers |
- The check sends no data about your customers, orders, administrators or store content, and no e-mail addresses or IP addresses of your customers.
- Our server sees the IP address of your web server, as part of the connection. We do not store it in clear text: it is kept only as a salted hash in hourly rate-limit counters, which are deleted after 2 days.
- We record each installation of a license: the host name and its base domain, the add-on and its version, the CS-Cart version and edition, the result, and the time of the first and the latest check. You see these records in My licenses. We keep them as described in section 6.
- The add-on stores the result of the check in your own store's database, or in a file on your server. It sends nothing else to us.
What our add-ons do not do. They contain no usage tracking and send us no data about your store's customers or orders. The license check is the only connection they make to our servers.
Add-ons that connect to third parties (for example Google, Meta, iyzico or PayTR):
- they send data from your store directly to that service, under your own account;
- for that processing, you are the controller and the service is your processor;
- we never receive that data.
4. Who receives your data
We share data only with service providers that process it for us under a contract:
- Stripe (payments);
- [HOSTING_PROVIDER] (hosting of the store and documentation);
- [EMAIL_PROVIDER] (e-mail delivery);
- Google (Google Analytics, only with consent).
Marketplace orders are processed by Bolide Network LLC, which operates the CS-Cart Marketplace. It passes the buyer's details to us so we can deliver the license and support.
We also share data with authorities when the law requires it. We never sell personal data.
5. International transfers
Some providers are located outside the EEA, the UK or Türkiye, for example in the United States. In those cases we rely on:
- adequacy decisions, including the EU-US Data Privacy Framework where the provider is certified;
- the European Commission's Standard Contractual Clauses;
- for transfers subject to KVKK, the standard contracts and other safeguards required by KVKK article 9.
6. How long we keep data
| Data | Retention |
|---|---|
| Account | Until you delete the account. Orders and licenses are kept as described below. |
| Invoices and order records | As long as tax law requires, usually up to 10 years |
| Licenses and their domains | For the life of the license, plus 2 years |
| License check: installation records (host name, add-on and CS-Cart version, result, first and latest check) | For the life of the license, plus 2 years |
| License check: IP address of the checking server (salted hash in rate-limit counters only) | 2 days |
| Support tickets | 3 years after the ticket is closed. Shared credentials are deleted at closing. |
| Analytics data | Up to 14 months, as set in Google Analytics |
| Custom development requests that did not lead to a project | 12 months |
7. Your rights
Under the GDPR and KVKK (article 11) you can:
- ask for access to your data and a copy of it;
- have it corrected or deleted;
- restrict or object to processing, including processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- object to purely automated decisions (we make none);
- under KVKK, learn whether your data is processed, who receives it, and claim compensation for unlawful processing.
To exercise a right, write to [email protected]. We answer within one month, or within 30 days for KVKK requests. You can also lodge a complaint:
- with your local data protection authority: [SUPERVISORY_AUTHORITY];
- in Türkiye, with the Kişisel Verileri Koruma Kurulu.
8. Security
- The whole site uses HTTPS.
- Passwords are stored hashed.
- Card data never reaches our servers.
- Access to personal data is limited to staff who need it.
- We back up our data and test the backups.
9. Cookies
See the Cookie Policy. Non-essential cookies are used only after you consent in the cookie banner. You can change your choice at any time.
10. Children
Our services are for businesses and are not directed at children under 16.
11. Changes
We may update this policy. The effective date at the top always shows the current version. We inform account holders of material changes by e-mail.