KionelLAB WORKFLOWS

Privacy Notice

Effective date: 2026-10-18 Version: 2.0

This notice explains what personal data Kionel collects when you use its website, and what we do with it. The Turkish-language notice on the policies page covers the same processing under Turkish data protection law (KVKK).

1. Who is responsible

Taha Bayar, a sole proprietorship registered in Türkiye, trading as Kionel ("we"), is the controller for the processing described here.

Postal address: Bademli 259. Cad., Kırkkonaklar, Çankaya / Ankara, Türkiye Privacy contact: privacy@kionel.com Security reports: security@kionel.com

2. What the software does not send us

The transfer application and the sample comparison tool run entirely in your browser. File contents, sample lists, camera frames, microphone audio and encryption keys are never uploaded to us and never leave your device. The microphone is used only after you press "Listen for the receiver" to pair two devices by sound, or "Listen for the delivery receipt" to receive a signed receipt by sound: the audio is decoded in memory on that page, is not recorded or stored, and the microphone is switched off when the sound has been heard or you stop it. Keys and preferences are stored in your own browser storage. Clearing your browser data removes them.

Import Check processes selected CSV files, rules and expected lists in memory in the current tab without uploading their contents to Kionel. It does not automatically save them. In its Excel task-pane version, Microsoft supplies Office.js from its CDN; the tool reads the formatted selection only when you press its read button and does not write to the workbook. Microsoft controls the Office host and its own runtime. Downloads remain on your device.

We use no analytics scripts, no advertising and no tracking cookies. We see only aggregate traffic counts that our hosting provider derives from the request metadata described below; they identify no one.

3. What we do collect

When you send the contact form: your name, email address, organisation (if you fill it in) and your message. We also store a salted hash of your IP address to detect flooding; the address itself is not stored. Purpose: replying to you and preventing abuse. Legal basis: our legitimate interest in answering enquiries and keeping the form usable. Retention: deleted automatically after 12 months.

Records from the earlier sales period: Kionel no longer sells licences. Order, checkout and subscription records left from the period when it did (organisation name, provider order identifier, licence file) are deleted automatically 13 months after their last update. Legal basis: our legal obligation to keep sales records for that period.

When trusted timestamps are switched on (an option on the receiving device): for each delivery receipt, its SHA-256 fingerprint — 32 bytes that reveal nothing about the file or its name — passes through our server to DigiCert's public timestamp service, which returns it signed with the time. DigiCert receives the request from our server, not from your device. We store nothing about it. Purpose: independent proof of when a receipt existed. Legal basis: your request, given by switching the option on.

Technical logs: our hosting provider processes standard request metadata (such as IP address and user agent) to deliver and protect the site. Our own error logs deliberately record no payloads, tokens, names or file contents.

4. Who else processes the data

messages and the remaining order records.

fingerprint and no personal data.

We do not sell personal data and do not share it for advertising.

5. International transfers

We are established in Türkiye and our providers operate globally, so your data may be processed outside your country, including in the United States. Where GDPR applies, such transfers rely on the European Commission's Standard Contractual Clauses concluded with those providers.

6. Your rights

Where GDPR or UK GDPR applies you may ask for access to your data, correction, erasure, restriction, objection and portability, and you may complain to your supervisory authority. Under KVKK you have equivalent rights and may apply to the Turkish Data Protection Authority.

Write to privacy@kionel.com. We answer within 30 days. We may ask for information to confirm who you are, but only what is needed for that.

7. Security

The site is served over HTTPS with a strict content security policy. Signing keys live in server-side secret storage and are never sent to browsers. No customer file content is processed on our servers, because it never reaches them.

We publish a vulnerability disclosure policy; please report security issues to security@kionel.com rather than through the contact form.

8. Children

Kionel is sold to organisations. The site is not directed at children and we do not knowingly collect their data.

9. Changes

We may update this notice. Material changes are announced on this page at least thirty days before they take effect.