Last updated:
Privacy Policy
This policy explains which personal data Roni Yazılım Hizmetleri Limited Şirketi (“Roni”, “we”) processes when you use our project and task management application at app.roni.so (the “Service”), why and for how long we keep it, who we share it with, and how you can exercise your rights. Details required by the Turkish Personal Data Protection Law No. 6698 (“KVKK”) are in the KVKK Privacy Notice.
Contents
1. Scope and our role
We are the data controller for data about your account, sign-in, billing and the security of the Service.
Projects, tasks, comments, files and any personal data inside a workspace are processed on behalf of the customer who owns that workspace. For that content the customer is the controller and Roni acts as a processor on their instructions. For requests about a workspace’s content, please contact the workspace owner first; we will work with them to help you.
2. Data we collect
- Account data: first and last name, email address, an irreversible hash of your password; your Google account ID if you sign in with Google.
- Profile and preferences: profile photo or emoji avatar, colour, optional phone number, language, time zone, time format, theme and notification preferences.
- Workspace content: projects, tasks, subtasks, descriptions, comments, mentions, uploaded files, status history and notifications you create or are assigned to.
- Security and usage records: last sign-in time, session data, IP address and browser information in server access logs, a log of workspace administration actions (e.g. inviting a member, deleting a project), and Roni AI usage counts and token amounts. While the app is open, your current view and cursor position are shown live to other members of the same workspace but are not stored.
- Integration data: if you connect Google Calendar, Slack, Trello or Asana, the access tokens for those services (encrypted) and the events, boards or tasks you import.
- Payment data: plan, subscription status and payment transaction records. Your card details never reach Roni; payments are collected by Paddle as the Merchant of Record.
- Support requests: the subject, message and attachments you send through the support form.
3. How we use data
- To create your account, verify your sign-in and provide the Service;
- To enable collaboration with workspace members (assignments, comments, live updates, share links);
- To send in-app, email and Slack notifications according to your preferences;
- To run the integrations you request and provide Roni AI features;
- To manage paid plans and meet legal invoicing obligations;
- To keep the Service secure, prevent abuse (e.g. brute-force sign-in attempts) and fix errors;
- To answer your support requests and protect our legal rights.
4. Roni AI
When you use Roni AI features such as generating a project plan or suggesting subtasks and titles, your request and the content needed for it (e.g. a task’s title and description) are sent to Anthropic to generate a response. Roni does not use this content to train AI models, and Anthropic’s commercial API terms provide that data sent through the API is not used for model training. If you do not use Roni AI, no such transfer takes place.
6. International transfers
Some of the providers above are located outside Türkiye, so your data is transferred abroad. These transfers are made in line with Article 9 of the KVKK using the standard contractual clauses published by the Turkish Personal Data Protection Board and the other safeguards provided by law; for users in the European Economic Area, transfers outside the EEA rely on the European Commission’s standard contractual clauses or adequacy decisions. See the KVKK Privacy Notice for details.
7. Retention
- Account and profile data is kept for as long as your account is open.
- Deleted tasks and projects stay in the trash for 30 days and are then permanently deleted. A deleted workspace is permanently deleted with all its content after 30 days.
- When you permanently delete your account, your email address, password, Google link and integration tokens are deleted immediately, together with workspaces where you are the only member. Comments and task history you wrote in workspaces with other members may remain under your name to keep that team’s records intact.
- Invoices and payment records are kept for the period required by tax and commercial law (up to 10 years); security logs for as long as the law requires and security needs.
- When a period ends, data is deleted, destroyed or anonymised.
8. Security
All connections are encrypted with HTTPS. Passwords are stored irreversibly (scrypt); integration tokens and share links are encrypted with AES-256-GCM. Files are kept in private storage and served through short-lived signed links. Access to data is limited to authorised staff. No system is risk-free, but in the event of a data breach we will make the notifications required by law.
9. Your rights
You have the right to access your data, ask for it to be corrected or deleted, object to processing and the other rights listed in Article 11 of the KVKK. You can correct your profile and delete your account in your account settings.
If you are in the European Economic Area or the UK, you also have the rights of access, rectification, erasure, restriction, data portability and objection under the GDPR, and the right to lodge a complaint with your local supervisory authority. Our legal bases are performance of a contract (providing the Service), legal obligations (invoicing) and legitimate interests (security, abuse prevention). How to submit a request is described in the KVKK Privacy Notice.
11. Children
The Service is not intended for people under 16 and we do not knowingly collect data from them.
12. Changes
We may update this policy to reflect changes to the Service or the law. The current version is published on this page; we will announce significant changes by email or in-app notification.
13. Contact
For privacy questions: [KVKK başvuru e-postası] · Roni Yazılım Hizmetleri Limited Şirketi, [Adres]