Privacy Policy

1. Scope

This policy explains how the personal data of renters using the KO Client app and of visitors to koclient.com is processed under Turkish Personal Data Protection Law no. 6698 (KVKK), and also serves as the privacy notice required by that law.

Data controller: KO Client (sole proprietorship). E-mail: destek@koclient.com. The data controller's identity details are provided at this address on request.

2. Data we process

• Account data: the e-mail address from your Google account, and the identifier used to match your account. The name on your Google account is not stored.
• Optional declaration: date of birth. You do not have to enter it. If you do, it is stored on your account. It is not verified, and you can delete it at any time.
• Rental records: which game and machine type you rented, when, for how long, how the rental ended and what it cost. The name you give a rental, and the internet address (IP) you started the rental and connected to the machine from.
• Invite records: whom you invited or whose invite you joined, the guest's permission and the time of joining.
• Payment records: top-up amount and time. For card top-ups, the payment institution's transaction reference, the payment status, and refund and dispute details. Your card number and card details never reach KO Client and stay with the payment institution. For bank transfers, the full name you declare during payment, the name of the sending bank account's holder and its IBAN, the payment description and the bank's transaction reference. These are used to verify the payment, to check that the sender matches the account owner, to refund to the right card or account and to issue invoices.
• Support correspondence: the messages you write on the support screen and the replies you receive.
• Access and traffic records: sign-in/sign-out events and rental start, end and join events, together with your connection address (IP), device/browser information and app version.
• Agreement acceptance records: the version and integrity digest of the text you accepted, the moment and language of acceptance, your connection address, device information and app version.
• Technical records: app and connection events, error reports, and log bundles sent for fault diagnosis. Logs taken from the machine contain your connection address (IP).
• Ad click identifier. If you allowed advertising cookies on the website and opened your account after clicking a Google ad, the identifier Google gave that click (gclid) is stored with your account.
• Referral source. If you opened your account in a browser, where you came to the website from is stored with your account. This is only the name of the site that referred you (e.g. google.com) or the campaign tags in the link you clicked. It does not include the pages you visited or anything that identifies you.

3. Data we do not process

• Your bank password and online banking sign-in details are never requested or stored. You enter your card details only in the payment institution's form, KO Client neither sees nor stores them.
• National identity numbers are not requested from renters and are not stored.
• Video and audio during a rental do not pass through KO Client's application servers and are not recorded. No screenshots are taken.
• What you type on the machine you rent is not monitored or stored.

4. Purposes and legal grounds

• Formation and performance of the contract: opening your account, starting rentals, billing and collection (KVKK art. 5/2-c).
• Legal obligation: retention of financial and commercial records, and keeping the traffic/access records required by law (KVKK art. 5/2-ç).
• Legitimate interest: preventing abuse, fraud and misuse of the service (including comparing the sender's name with the account owner), fault diagnosis and service-quality monitoring. Measuring which promotion channel account openings come from. Applying the limit on machines used at once for a game, by account and by connection address (IP) (KVKK art. 5/2-f).
• Establishment and protection of rights: using rental, payment, access and agreement acceptance records as evidence in a dispute (KVKK art. 5/2-e).
• Explicit consent. Advertising cookies, and reporting the ad click identifier together with your account opening and first top-up to Google, rely only on the consent you gave on the website (KVKK art. 5/1). You can withdraw it at any time with the Cookie preference link at the bottom of the page.

5. Transfers

• Payment institution (Stripe Payments Europe, Ireland): to take card payments, prevent fraud, and handle refunds and disputes. Your e-mail address, the payment amount and what you enter in the payment form go to the payment institution. This involves a transfer abroad and happens when you pay by card.
• Bank: to receive bank transfer payments and make refunds. When a refund is made, the details of the account the payment came from and the refund amount are passed to the bank.
• A renter you invite or whose invite you join: your e-mail address is shown partly hidden.
• Google: solely to verify sign-in. This involves a transfer abroad and happens when you sign in.
• Google Ads, to measure the results of our ads and only if you allowed it. Your visit and clicks on the website and, if you opened your account after clicking an ad, the time your account was opened and the amount of your first top-up are reported to Google together with the ad click identifier. Your name and e-mail address are not sent. This involves a transfer abroad.
• Infrastructure provider: the data-centre operator that hosts the machine you rent. Because your connection is made directly to the machine, your connection address (IP) passes through this provider's network. Your name and e-mail are not shared with the provider.
• Competent public authorities: where required by law.

The app's servers and database are hosted in Türkiye.

6. Retention periods

• Account data: while your account is open. Deleted or anonymised when the account is closed.
• Rental and payment records: retained for 10 years under financial legislation. These records are kept even though the rented machine is deleted.
• Access and traffic records: retained for 2 years and deleted when that period expires.
• Agreement acceptance records: retained for the duration of the contractual relationship and the related limitation periods — this record is the proof of which text you accepted.
• Fault logs: retained for 30 days. The summary record of a resolved error is kept for up to 180 days.
• Data on the machine: deleted together with the machine when the rental ends.
• Session tokens: invalidated when they expire or when you sign out.

7. Security

Session tokens are stored only in hashed form, the database is not exposed to the internet and all communication is encrypted.

The connection established between your device and the machine during a rental is end-to-end encrypted and open only for the duration of the rental.

To resolve a fault, a KO Client administrator may start only predefined operations on the machine. No free-form commands are run on the machine.

8. Your rights

Under KVKK art. 11 you have the right to learn whether your personal data is processed, to request information, to request rectification, erasure or destruction, to request restriction of processing, and to claim compensation for loss.

You can raise requests through the support screen in the app or at destek@koclient.com. They are answered within the period prescribed by law.

Where you request erasure, records that the law requires us to keep (financial records, traffic records) and records needed to establish a right are retained for their retention periods.

9. Local storage

The desktop app does not use cookies. Only data such as the token that keeps your session open, your language preference and the most recent copy of the legal texts (so they can be shown offline) is stored on your device. This is cleared when you sign out.

10. The website

koclient.com uses Cloudflare Web Analytics to count visits. It sets no cookies and does not track visitors as individuals. Your browser sends a request to Cloudflare for the measurement. This may involve a transfer abroad.

Where you came to the website from, that is the name of the referring site or the campaign tags in the link, is kept in your browser while the tab stays open and is added to the play-in-browser link. It is deleted when you close the tab and is not sent to Google.

If you allow it in the banner at the bottom of the page, the Google Ads tag is loaded and Google's advertising cookies are set in your browser. They are used to measure whether you came from an ad and pressed the download or play in browser button, and to show you relevant ads. The ad click identifier is kept in your browser for 90 days and added to the play in browser link. If you do not allow it, no request is sent to Google. You can change your choice with the Cookie preference link at the bottom of the page.

11. Changes

This policy may be updated. The current text is always available on this screen in the app. Updates that change its meaning require your acceptance again.