Privacy Policy

Effective: 31 October 2026 · Version: 3.8 · pr@premate.gg

Language. This is a translation of the Turkish Privacy Policy (Gizlilik Politikası). The Turkish version is authoritative; if the two conflict, the Turkish text applies.

Version 3.8 note: In the Android application installed from Google Play, the Micup Plus subscription is sold through Google Play; for these sales, the seller is Asim Abdullazade, the holder of the Google Play developer account. Google (Google Play) and the seller have been added as recipients; Google Play purchase and subscription records are kept. Your name, email address and user ID are not sent to Google (2.7, 3, 5, 7).

Version 3.7 note: You can optionally link your Steam, Twitch or Kick account to your Micup account. When you do, your account ID and name on that service are stored and shown on your profile to the audience you choose. The access token the service issues is not stored (2.2, 3, 5, 7, 9).

Version 3.6 note: When a YouTube video is shared on the TV in a 3D room, the browsers of everyone in that room load the video from Google (YouTube); Google then receives your IP address and browser/device information (2.4, 4, 5).

Version 3.5 note: An automatically renewing Micup Plus subscription through Paddle has been added. Where you subscribe, subscription and period records and a record of your subscription consent are kept; the personal data sent to Paddle does not change (2.7, 3, 7).

Version 3.4 note: The digital-delivery consent at Paddle checkout is only for immediate delivery of the product; it does not affect your right to a full refund within 14 days of the purchase date (see the Refund Policy). The data collected is unchanged (2.7, 3).

Version 3.3 note: Usage measurement with Google Analytics is now on by default; the cookie notice (Accept / Reject) was removed. The measurement is carried out under section 5.6 of the Terms of Service and can be turned off at any time: in Settings › Privacy › Analytics cookies when signed in, or with the link at the bottom of the sign-in and registration pages when not. If you chose Reject earlier, your choice is kept and no measurement takes place. The data sent and not sent is unchanged (2.6, 3, 4, 6, 7). The statements “only if you allow it” and “the only legal basis is explicit consent” in the 3.2 note below no longer apply from this version.

Version 3.2 note: Optional usage measurement was added: only if you allow it, Google Analytics cookies are used to measure which kinds of pages are opened and which features are used; your messages, username, email, server and channel details are not sent. The only legal basis for this measurement is explicit consent (legitimate interests was removed); you can withdraw it at any time. Google LLC was added as a processor (2.6, 3, 4, 5, 6, 7).

Version 3.1 note: For purchases made through Paddle, payments are collected by Paddle in its capacity as Merchant of Record; during the transition period some payments continue to be collected through Payriff (2.7, 5, 6). This version adds a processing purpose: once payment with Paddle is opened, when you make a purchase, the country inferred from your IP address is used to select the payment provider and the currency, and is written to Paddle orders as a country code. For payments with Paddle, the time of your digital-delivery consent and the version of the text you consented to are recorded on the order (2.7, 2.8, 3, 7). The trade name and address were added to the controller details (1).

Version 3.0 note: “Now playing” (game activity) has changed. In the Windows desktop application, game detection and sharing are now on by default for accounts aged 15 and over. For existing accounts, the default starts after you have seen a notice that is shown once in the application (including for those who had previously turned it off); until then your previous setting applies. New accounts start at registration with the “Everyone” option. The game you are playing is now shown by default not only to your friends but also to members who are in a server you share: in the member list, in the direct message list and on your profile card. In Settings › Privacy › Show my game activity you can choose Friends or Off at any time; if your profile is set to “Only me”, your game is not shown to anyone. The legal basis for this processing changed from performance of a contract (Article 5(2)(c) of Law No. 6698 on the Protection of Personal Data (KVKK)) to legitimate interests (Article 5(2)(f) KVKK). Details are in 2.9, 2.11, 3, 5, 7 and 9.1. The statement “initially off” in the version 2.7 note below ceases to be valid with this version.

Version 2.8 note: This version does not add a new processing purpose. It updates the way in which running programs are read for “Now playing” (2.11): no separate command is run; the Windows process list interface is used. The information read and the information leaving the device do not change.

Version 2.7 note: This version adds a new processing purpose: “Now playing” (game activity) in the desktop application. The feature is initially off; it runs only if you turn it on. We explain what stays on your device, what is shown to whom and how long it is kept in 2.11, 3 and 7.

Version 2.6 note: New official community bots were added: Micup Mod, Micup Rol, Micup Destek, Micup Çekiliş and Micup Seviye. The data processed by these bots and the related ways of deleting it are explained in 2.12, 3, 5, 7, 9, 10 and 13.

Version 2.5 note: The operator information was updated.

Version 2.4 note: The subscription was renamed Micup Plus.

Version 2.3 note: This version adds a new processing purpose: automated inappropriate content scanning of uploaded images, of video frames and, in places where adult content is not permitted, of images and videos attached to chats (including some direct messages). It also adds a new role for our existing data processor bunny.net: storing, encoding at different resolutions and playing the videos you upload to the feed (Bunny Stream). We describe where the scanning is done, what it covers and whether its result is stored in 2.3, 5, 7, 10 and 13. It also adds the purposes of running community bots (MicupBOT, Micup Roster) and of community moderation (2.12, 3, 5, 7, 10, 13).

Version 2.2 note: This version does not add a new processing purpose. It clarifies when the desktop application's keyboard and mouse hook is installed and what it reads (2.11), and that the running process check is performed only for streamer mode.

Version 2.1 note: This version does not add a new processing purpose. It clarifies the delivery, in the mobile application, of the existing purpose of sending notifications (FCM on Android, APNs on iOS; encrypted package), the status of message attachments on account deletion, and the name of the GIF search provider (Klipy).

This text explains which of your personal data we process when you use the micup.gg service, for what purpose and on what legal basis; with whom we share your data, how long we keep it and how you can exercise your rights. It also constitutes an information notice under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK).

1. Controller

The micup.gg service is operated by O Group MMC (Aslanbayli Village, Qazax, AZ3500, Azerbaijan), registered in Azerbaijan (hereinafter “Micup”, “we”). The controller is this company that operates the service.

• Contact channel: email — pr@premate.gg

2. Categories of personal data we process

2.1. Account and identity data

• Email address
• Password — stored not as plain text but as an irreversible hashed digest
• Username and display name
• Date of birth — solely to enforce the age limit and the restrictions applied to minors. This date, collected at registration, is evaluated on the server side: accounts under 18 cannot enter channels marked “adult” and cannot post content there. The decision is made in the database, not by hiding things in the interface.
• If you use two-step verification, the verification data relating to it

2.2. Profile data

• Avatar and banner images, biography
• Optional fields such as region, games you play, availability status and microphone information
• Badges, linked accounts, follow and friendship relationships
• Server and channel memberships, roles

Linked accounts. In Settings › Connections you can optionally link your Steam, Twitch or Kick account to your Micup account. When you link one, you are sent to that service's own page and give your permission there; your password for that service never reaches Micup. Once the link is made, Micup stores:

• the name of the service;
• your account ID on it (your SteamID on Steam, your user ID on Twitch and Kick);
• your username or display name there;
• the date the link was verified;
• your visibility choice and the link's position on your profile.

On Steam the display name is read from Steam's public player information. The access token the service issues is used once, at the time of linking, to read this information, and is not stored; any other fields the service returns are not saved either. Micup does not access your posts, friend list, game library or streams on these services. A linked account is visible to everyone on your profile by default; you can limit it to your friends or to members of servers you share, and you can remove the link at any time.

2.3. Content and message data

• Posts, comments, polls, reactions
• Channel messages and direct messages (DMs)
• Images, videos, clips and files you upload
• Read cursors, drafts, notification preferences

Important: text messages are stored on our servers so that we can provide the service and are not end-to-end encrypted by default. This means that messages can be accessed in cases of moderation review, security incident investigation and duly made legal requests.

Feed videos. A video you upload to the feed is uploaded from your device directly to our video infrastructure provider bunny.net (Bunny Stream); the file itself does not come to our servers. Bunny converts the video into copies playable at different resolutions (encoding) and generates thumbnails from the video: a cover image and preview frames shown while seeking back and forth. The original file you upload is used only for encoding and is not stored permanently; the encoded copies and thumbnails are stored. File metadata such as location is removed from the fallback MP4 copies. Our servers hold not the video itself but its identifier, processing status, size, duration, aspect ratio information and the file digest Bunny provides to recognise the upload. Videos are played only through time-limited, signed links, and a link is generated after your right to view the post has been checked. When you delete a post, its video is also deleted from Bunny. A playback link that has already been opened, however, may continue to work from the delivery network's cache until it expires (at most approximately 7 hours).

2.4. Voice and video chat

We do not record conversations in voice rooms and video calls. Audio and video data is transmitted live between participants; its content is not stored on our servers. Only connection information is stored: who was in which room, the time of joining and leaving, technical quality measurements. For some rooms there is an optional media protection mode; this mode protects only the audio and video stream, not chat messages.

Microphone, camera and screen access. The application does not turn these devices on by itself:

• The microphone and camera are turned on only when you enter a voice or video room and approve your browser's or operating system's permission prompt. Access ends when you leave the room.
• Audio and video are transmitted in real time through our room server (LiveKit, Germany); they are not recorded, written to a file, stored or analysed on the server.
• For screen sharing, a picker opens first and you choose which window or screen to share. No image is captured until you select a source; you can stop sharing at any time.
• You can withdraw the permissions you have given at any time in your browser settings or your operating system's privacy settings; without permission the application cannot turn the device on at all.

The TV in 3D rooms and YouTube. When a member shares a YouTube video by link on the TV in a 3D room, the browser of everyone in that room loads the video from Google's (YouTube's) privacy-enhanced embed address (youtube-nocookie.com); the thumbnail comes from Google's image server (i.ytimg.com). Google therefore receives your IP address and browser and device information; while the video plays, YouTube's own cookies or similar technologies may be used. This happens only while you are in a room where a video is shared on the TV; with no video, no request goes to Google. The member who shared the video, and moderators in the room who may mute or move members and whose role is above the sharing member's (only the server owner for the server owner's video), can stop it at any time. How Google processes this data is explained in the Google Privacy Policy.

2.5. Technical and transaction security data

• IP address and connection timestamps (the moments of registration, login and posting content)
• Browser and device information, operating system, application version
• Session records and list of active devices
• Notification subscription: the browser's push subscription or, in the mobile application, your device's notification token (push token)
• Rate limit counters, abuse and security records
• Moderation decisions, report records, ban records
• Error and access records (server logs)

2.6. Cookies and analytics

Session cookies and preference cookies are strictly necessary. In addition, unless you turn them off, Google Analytics cookies are used to measure: which kinds of pages are opened (for example "channel", "feed", "settings", "profile"; not channel, server or person names and not ids), which features are used (such as sending a message or joining a voice room; not content), browser, operating system, device type, language, the country Google infers from your IP address, app version, web or desktop, only the domain of the site you came from and campaign link tags (utm). Your messages, username, email, server and channel details are not sent. For how to turn the measurement off, see section 4.

2.7. Payment data

When you purchase Micup Plus or a cosmetic item, the order identifier, amount, currency, payment status, payment date and the start and end dates of the Plus period are recorded. Card number, expiry date and security code never reach our servers. For purchases made through Paddle, payments are collected by Paddle in its capacity as Merchant of Record; Paddle processes this data on its own behalf as an independent controller (see 5), and card and billing information is collected directly by Paddle. Micup sends Paddle only the product, amount, currency, order number and, for a subscription, the renewal period; it does not send your name, email address, user ID or IP address. On the payment screen you provide your information directly to Paddle; Paddle's privacy notice applies to it. For payments made through Payriff during the transition period, this data is collected and processed directly by the payment institution Payriff.

Once payment with Paddle is opened, the following is also written to Paddle orders:

• Country code: the country inferred from your IP address when the order is opened (see 2.8). The IP address itself is not written to the order.
• Digital-delivery consent: for payments with Paddle, before the order is opened you are asked to consent to immediate delivery of the digital product. This consent is only for immediate delivery; your right to a full refund within 14 days of the purchase date (Terms of Service 11.5 and the Refund Policy) is reserved. The moment the consent is given (the moment the order is opened) and the version of the text you consented to are recorded on the order.

When you buy an automatically renewing subscription, the following is also recorded:

• Subscription consent: the moment you tick the consent box and open the order, and the period amount, currency, renewal period and terms version you agreed to.
• Subscription records: the subscription ID and customer ID given by Paddle, the subscription status (pending, active, payment problem, paused, cancelled), the reason for a cancellation Micup started, the end of the last paid period, the next charge date, the scheduled cancellation date, and for each subscription payment its transaction ID, period start and end dates, amount and status (paid, refunded, chargeback).

We receive this information from the signed payment and subscription notifications Paddle sends to our server and from the subscription lookups we make at Paddle; we do not store your email address, postal address or card details from them. We pass your requests to cancel, undo a cancellation or update your payment method to Paddle with the subscription ID only; the payment method is entered on Paddle's own screen. Your subscription and payment records are included in your data export file.

Google Play. In the Android application installed from Google Play, the payment for the Micup Plus subscription is taken by Google Play. You provide your payment information directly to Google; Google processes this data on its own behalf as an independent controller (see 5), and the Google Privacy Policy applies to it. For these purchases, the seller is Asim Abdullazade, the holder of the Google Play developer account (see Terms of Service 11.3). For sales, refunds and taxes, Google shows the order details (order number, product, amount, status, country; in countries where the seller is the merchant of record, also city, region and postal code) in the seller's Google Play developer account; the seller can also look the order up by your email address. Your payment method, name and email address do not reach Micup. To tie the purchase to the right Micup account, the application passes Google Play, at the time of purchase, a random account key we generate for your account; this key does not contain your user ID, name or email address. For each Google Play purchase we record:

• the purchase token and order number (starting with GPA) given by Google Play, the application package name, the product and the plan (monthly or yearly)
• the subscription status (active, grace period, on hold, cancelled, expired, revoked), the start, end and grace period end dates, whether automatic renewal is on, whether the purchase has been acknowledged, and the revocation date and reason (for example, a refund)
• the country code reported by Google Play, the moment the purchase was tied to the account, and the account key

We receive this information from the lookups we make at Google Play and from the notifications Google sends to our server, whose source is verified. To acknowledge a purchase, to cancel a subscription when an account is deleted or closed, and to issue a refund, we pass Google Play only the application package name, the product, the purchase token or the order number. Your Google Play purchases (product, status, end date, renewal) are included in your data export file.

2.8. Location

We do not collect GPS or precise location data. An approximate location at country/city level may be inferred from your IP address; this inference is used for security (detection of unusual logins), geographic restriction obligations and aggregate statistics.

Once payment with Paddle is opened, on the purchase screen and when the order is opened, only the country is inferred from your IP address and is used to select the payment provider (Paddle or, during the transition period, Payriff) and the currency; the country code is written to the Paddle order (see 2.7). The inference is made using a database on our own server; your IP address is not sent to any third party for this purpose. If the country cannot be determined, the default payment option is shown.

This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

2.9. Children's data

The service is not directed at persons under 15. The data of users aged 15–17 is subject, in addition to the rules in this text, to the protective defaults in the Child Safety Policy (Turkish). The only exception is “Now playing”: game activity also starts on by default for ages 15–17 and is shown to the Everyone audience (see 2.11); choosing Friends or Off is possible at any time.

2.10. Special categories of data

We do not request special categories of personal data such as health, religion, political opinion or biometrics. Writing such information in your profile or messages of your own accord does not mean that you have thereby made it public; who can see it depends on the content's sharing and visibility settings. Information in a direct message does not become public merely because of that message. We do not additionally use this data for profiling purposes.

2.11. Desktop application

The Windows desktop application runs the same micup.gg site in a window; everything above applies there as well. For five things a browser cannot do, it has additional interactions with the operating system, and each of them is kept narrow:

• Global shortcuts and push-to-talk (keyboard and mouse hook). So that push-to-talk and global shortcuts (e.g. mute microphone: Ctrl+Shift+M, deafen: Ctrl+Shift+D) work while Micup is in the background, for example while a game is in the foreground, the application installs an operating-system-level keyboard and mouse hook. The hook is installed while at least one global shortcut or push-to-talk key is defined. Because the mute and deafen shortcuts are global by default, the hook remains installed while you are logged in to the desktop application; if you turn off the global option for your shortcuts in the shortcut settings, the hook is not installed. From each incoming event only the code of the pressed key, modifier keys such as Ctrl, Shift and Alt, and the pressed mouse button (so that you can assign push-to-talk to a mouse side button) are read; mouse movement is not read. This information is compared on your computer, inside the application with the shortcuts you have defined and immediately discarded: no keystroke is recorded, counted, accumulated, or sent to our server or anywhere else. What you type is not read as text and is not transmitted. When a shortcut matches, only that shortcut's action is performed (e.g. your microphone is unmuted or muted).
• Streamer mode (running process check). So that your personal information does not appear on screen while you stream, the application uses Windows' tasklist command to ask whether only the OBS and XSplit streaming programs are open. This query is limited to the names of these programs; for streamer mode no other program name is read, stored or transmitted, and the result is not sent to the server. While game detection is on (the default for accounts aged 15 and over), running programs are read within the limits described in the “Now playing” item below.
• Screen sharing source. When sharing is started, the application generates a list of open windows and screens only at that moment and once so that you can choose which one to share. No image is captured until you select a source, and no window other than the source you selected is viewed. Micup's own window is removed from the list.
• In-game overlay. While the in-game overlay is on, the application draws its own small window over your game (profile pictures of the people in the voice room, who is speaking, notifications). The in-game overlay writes nothing into the game, reads nothing from the game and does not take screenshots; it shows only the content it draws itself. It can be turned off in Settings › In-Game Overlay.
• “Now playing” (game detection). This feature is on by default for accounts aged 15 and over; you do not need to go into the settings for it to work. Existing accounts: the default starts when you see a notice shown once in the application (pressing either of the two buttons in the notice is recorded on your account as “seen”); even if you had previously turned the feature off, from that moment on it starts on with the Everyone option. Until you see the notice, your previous setting applies. New accounts: if you are 15 or over at registration, it starts with the Everyone option; this text is presented to you during registration. Where it works: games are detected only in the Windows desktop application; they are not detected in the web browser or in the mobile application. Game activity is shown on the website and in the desktop application; the mobile application does not show other people's games and does not show the notice. What is read, what is sent: while it is on, the application uses the Windows process list interface roughly every 15 seconds to read the file names and process numbers of running programs and compares them on your computer, inside the application with the game list in the application. The program list, process numbers and file paths do not leave your device; they are not stored and are not sent to the server. Only the catalogue ID (or name) of the matching game and the start time of the game go to the server. The game icon is shown from the catalogue inside the application. Who sees it: in Settings › Privacy › Show my game activity there are three options. Everyone (default): your friends and members who are in at least one server you share and can see at least one channel there that you can also see. Friends: only your friends see it. Off: your game activity is not shown to anyone and game detection stops on this device. “Everyone” does not mean open to the internet: it is not shown to visitors who are not logged in, to people who share no server with you and are not your friends, to bot accounts, or on your public profile page. People with permission to see it see the game's name and icon below your name in the member list and in the direct message list, and on your profile card together with the elapsed time. Relationship with profile privacy: if your profile is set to “Only me”, your game activity is not shown to anyone, including your friends. Under your profile's other privacy options, your game activity is shown only according to your choice in this section; like your name in the member list and your custom status, it is visible to members in a shared server independently of your profile privacy. When it is not shown: it is not shown to people you have blocked or who have blocked you. If you are invisible or offline, your game activity is not shared. If you are under 15 or your date of birth is unknown or invalid, games are not detected and not shared. When you or the other person leaves, is kicked from or is banned from a server, or when no shared channel remains between you in that server, showing through that server stops; when a friendship ends, showing through the friendship also stops. If another connection between you continues, showing continues through that connection. Where preferences are kept: your visibility preference and the record that you have seen the notice are stored on your account and apply on all your devices; your local game mappings, if any, are stored only on this device. Turning it off: you can change your choice at any time in the same place. When you turn it off or narrow the audience, new sharing stops and clearing of the activity from the screens of people who no longer have permission to see it is started; this clearing may be delayed because of a connection interruption or a device in sleep mode. We cannot retract information that has already been seen or saved by others. This feature writes nothing into the game, reads nothing from the game and does not take screenshots.

Updates. The version installed from the Microsoft Store is updated by the Microsoft Store; Microsoft's own privacy principles apply to the update check. The version installed with the installer file checks via GitHub whether a new version is available, and the information sent to the server in this check consists of a version query only.

While offline. The application loads content through micup.gg: without a connection, chat, voice and the feed do not work. The only things kept on your device while offline are your session information and local settings such as window/audio preferences; these stay on your computer. When the connection returns, the application continues to work as usual.

The desktop application does not scan your files, does not read your browser history and does not collect any data other than what is listed in this text.

2.12. Community bots

MicupBOT (community bot) and Micup Roster (event bot) are Micup's own official bots. They run on our own servers; no data is sent to a separate provider for this work, and Micup is also the controller for this data (see 1). Unless a community (server) administrator adds the bot to the community and turns on the relevant feature in the Community settings, no data is processed by these two bots.

MicupBOT:

• Level (XP). In a community where the level system is on, you earn XP when you write a message (at most once per minute) and, if the community has turned it on, while you are in a voice room (at most 12 hours per day). For each community, your user number, your total XP and the time of the last update are stored; your level is calculated from these. When you reach certain levels you may be given an automatic role. For voice room XP, only which voice room you are in, whether you have deafened yourself or a moderator has deafened you, and whether at least one other person who can earn XP is in the room are checked; whether your microphone is on is not checked; your conversations are not listened to or recorded. Every member of the community can see the leaderboard (the top 1,000 people; including those who have left the community), your name there and your XP. If commands are on, any member can use #rank to have your level and XP progress posted to the channel, even if you are not on the leaderboard. When you level up, a congratulation message mentioning you may be posted to the channel.
• Warnings. When a moderator gives you a warning with the #warn command, the user number of the moderator who gave the warning, the reason (at most 512 characters) and the time are stored; at most 100 warnings are kept per person in a community. When a warning is given, your name and your total number of warnings are posted to the channel; the #warn message written by the moderator who gave the warning mentions you or contains your user number, contains the reason and remains in the channel as an ordinary message. Warning records can be seen and deleted only by moderators who have the "Time out members" permission in that community. If a moderator uses the #warnings command in a channel, the reason and time of your last 10 warnings are visible to everyone who can read that channel; the identity of the person who gave the warning is not shown. There is no automatic sanction based on the number of warnings.
• Automatic moderation (automod). If the community turns it on, MicupBOT deletes messages that do not comply with the rules set by the community administrator; depending on the rule, it also posts a warning message or mutes you for a limited time (see 13). Automod reads the content of a message only to check the rules and does not separately copy the content of a deleted message anywhere. The warning message posted by automod is not added to the warning records above.
• Welcome message, automatic role and reaction roles. These settings (channel, message template, roles) belong to the community and are stored with the user number of the administrator who saved the setting. When you join or leave the community, a welcome or farewell message with your name may be posted; you may be given a role automatically or according to your reaction on a panel.

So that these records can be found on account deletion, a list of the communities in which you have XP or a warning is also kept. The copy prepared with Prepare my data contains your XP and level in each community and the reason and time of your warnings; the identity of the moderator who gave the warning is not included. Warnings you gave as a moderator or administrator, bot settings you saved and Micup Roster events you created are not included in this copy; for these you can contact pr@premate.gg.

Micup Roster:

• For an event created by the community administrator, a roster card is posted to the announcement channel at the 25th minute of every hour. The event settings (name, channels, roster size) belong to the community and are stored with the user number of the administrator who created the event.
• When you press the card's Join button or react with ✅, only your user number, your joining time (your position is determined from it) and whether you joined with the button are written to the roster; to prevent you from joining a second event at the same hour in that community, which event you joined is also kept. This record is temporary: it is deleted automatically 2 hours after the last change or after the roster closes. Those who joined are mentioned by name on the card; the card is visible to everyone who can see the announcement channel.
• When the event starts (the 35th minute of the hour), the voice room of each member of the main roster in that community is read at that moment and is not stored separately. If you are in another voice room of the community, you are moved to the event room; the move is written, together with your previous and new room, to the community's audit log with "Micup Roster" and the event name, and stays there for 45 days. If you are not in any voice room in that community or you have left the community, you are removed from the roster; you are not kicked from the community. If anyone cannot be moved, a warning containing only the number of people, without names, is posted to the announcement channel.
• The roster card, the ✅ reactions on it and the name mentions on the card remain as an ordinary channel message; the 2-hour period does not delete them.

New official bots: Micup Mod, Micup Rol, Micup Destek, Micup Çekiliş and Micup Seviye. These bots are also Micup's own bots; Micup is the controller for this data. The community administrator adds the bot to the community and configures the relevant settings. The bots run on a bot server separate from the Micup application, at our existing infrastructure provider Hetzner (Germany). Each bot's data is kept on that server in its own local database; for data processor and international transfer information, see 5 and 6. The rules below are for these five bots; they are not the same as the MicupBOT and Micup Roster records above.

• Micup Mod. The user numbers of the warned person and of the staff member who gave the warning, the reason and the time; the end times of timed bans and mutes, the numbers of the persons and staff members concerned and the reasons; the user number of the registering staff member and the number of registrations; and the community's registration, protection and channel lock settings are kept. Protection event counters are kept only in memory; event numbers that prevent the same event from being processed again are written to the database for a short time. In the registration command, the name and age entered by the community's registrar are written by default in the format “Name | Age” to the community nickname in Micup; the administrator can change this format. The name and age are not separately written to the bot database. Warning details are sent to the authorised moderator by DM or, if that is not possible, only to a log channel verified to be open only to moderators; if there is no safe destination, they are not published.
• Micup Rol. Automatic role settings and the panel's message, channel, emoji and role mappings are kept. The bot database does not keep people's role or reaction history or the user number of the administrator who saved the setting. In role operations, the relevant user numbers are processed at that moment and the operation may be written to the log channel; these channel messages are separate from the settings in the bot database.
• Micup Destek. The user number of the person who opened the support request (ticket), the ticket's channel, the opening time and status; the user numbers of the people who claimed the ticket and who were added to it, and panel and delivery information are kept. On closure, the message texts, author and message numbers, times and attachment links are sent as a .txt transcript to the community's private log channel and, where possible, to the person who opened the ticket by DM. If DM delivery is blocked or fails, the copy in the log channel remains. Message content and the transcript itself are not written to the bot database; information about the delivery such as the file name, digest and message number is written. The transcript can be seen by those with access to the log channel and by the DM recipient.
• Micup Çekiliş. Giveaway settings, the creator's user number and the user numbers of the selected winners are kept. Participants are read from the 🎉 reactions on the giveaway message; community membership, role and participation duration conditions are checked. The participant pool is not kept permanently in the bot database. The reactions and the result message mentioning the winners are visible to those who can read the channel.
• Micup Seviye. For each community, the user number, XP earned from message and voice activity, total number of messages, time spent in voice rooms and the time of the last message are kept. Time intervals and counters are also kept for the statistics of the number of messages and voice time over the last 1, 7 and 30 days. The level is calculated from this XP; role rewards and level announcements depend on community settings. Responses to leaderboard, level and statistics commands are visible in the channel where they are used.

No message content is written to the database of any of these five bots. This does not delete the command responses the bots post to channels, the operation logs or the transcript files sent by Micup Destek; these remain in Micup as channel messages or DMs and their attachments. For retention and deletion, see 7, 9 and 10.

3. Processing purposes and legal bases

We process each data category on the legal basis stated opposite it (Article 5 KVKK; Article 6 GDPR):

For processing based on legitimate interests, we carry out a balancing test between our interest and your fundamental rights and freedoms; you have the right to object to this processing (see 9).

Summary of the balancing test for “Now playing”. Interest: Micup is a community platform where players play together and voice chat; seeing what your friends and the members of your shared communities are playing makes it easier to join games and voice rooms together. This is both our interest in offering the service for this purpose and users' interest in finding each other. Data: it is not of a special category and is minimised: only the ID or name of the matching game and the start time; the program list does not leave your device; no game or time history is kept. Reasonable expectation: on game and voice chat platforms, showing the game being played to friends and shared community members is a common and well-known practice; in addition, for existing accounts the default does not start before the in-app notice has been seen. Safeguards: choosing Off or Friends in a single step; never shown for those whose profile is “Only me”; not shown to blocked people, to bot accounts, to those with no shared connection, on the public profile or on the internet; not shared while invisible; does not run at all for accounts under 15 or whose date of birth is unknown. According to this assessment, the processing does not have a disproportionate effect on your fundamental rights and freedoms. When you choose Off, the processing stops without any further justification being required.

4. Cookies and similar technologies

• Strictly necessary cookies: keeping your session open, security and storing preferences. Without these the service does not work; they cannot be turned off.
• Local storage: preferences such as theme, audio setting and draft text are stored in your browser. These are not sent to the server.
• Analytics cookies (can be turned off): Google Analytics' _ga and _ga_<measurement id> cookies. They are on by default; no separate cookie notice is shown. The cookies are kept only on the micup.gg domain and last at most 13 months from your last visit; they contain a random identifier for your browser (not your name or account). You can turn the measurement off with one tap in Settings › Privacy › Analytics cookies when signed in, or with the Turn off analytics cookies link at the bottom of the sign-in and registration pages when not; measurement then stops and these cookies are deleted. Your choice is stored on your device; signing out does not delete it. If you chose Reject in the earlier cookie notice, that choice is kept. Clearing your browser data also deletes your choice, and measurement starts again switched on.
• We do not use advertising cookies and we do not share data with advertising networks (in Google Analytics, ad storage, ad personalisation and Google signals are off).
• YouTube player on the room TV: while a YouTube video plays on the TV in a 3D room, YouTube may use its own cookies or similar technologies (see 2.4); with no video, no request goes to Google.

You can delete or block cookies in your browser settings; if you block strictly necessary cookies, you will not be able to log in.

5. Data sharing and data processors

We share your personal data with the parties below, only for the stated purpose:

• With other users: your profile, your posts and what you write in servers become visible according to the visibility settings you choose. Your online status and the voice room you are in are shown to other members according to your settings. While “Now playing” is on, the name and icon of the game you are playing are shown to the audience you choose (default Everyone: your friends and members who are in a server you share) (see 2.11). Who in the community sees the MicupBOT leaderboard, the warning records and the Micup Roster roster is set out in 2.12. The visibility of the new official bots' responses, operation logs and support transcripts is also explained in the same section; these bots are Micup's and are not data processors. Your linked accounts (the service name and your name on it) are shown according to the visibility you choose (see 2.2).
• With the services you link (Valve/Steam, Twitch, Kick): you start the link and give your permission on that service. Micup's server contacts the service only to verify your account: it sends the one-time authorisation code, or on Steam your SteamID. Your Micup email, messages and other personal data are not sent to these services. What the service does on its side is governed by its own privacy policy.
• With data processors: the infrastructure providers listed in the table below.
• With competent authorities: when a duly made request is received or in case of imminent danger (see 12). Where child abuse is suspected, if the incident is connected with Türkiye, we report it to the Chief Public Prosecutor's Office and to İhbar Web without waiting for a request.
• In case of transfer: in case of transfer of the service to another person or company, on condition that the acquiring party complies with the commitments in this text.

We do not sell your personal data and we do not share it with third parties for advertising purposes.

We enter into contracts with these providers that require them to process your data only on our instructions and for the purposes set out in this text.

6. International transfers

6.1. Our servers are in Germany; as shown in the table above, some services are located in the USA and the United Kingdom. For this reason your personal data is transferred abroad.

6.2. Legal framework. For users in Türkiye, the transfer is based on Article 9 KVKK. Since there is no adequacy decision of the Personal Data Protection Board regarding the countries to which data is transferred, the transfer is made under the standard contract announced by the Board as an appropriate safeguard pursuant to Article 9(4) KVKK; the standard contract is notified to the Personal Data Protection Authority within five business days of the date it is signed. Where a standard contract cannot be put in place, the transfer relies on the exceptional cases listed in Article 9(6) KVKK, provided that it is only incidental. For European Union data, the provisions of Chapter V of the GDPR apply; transfers outside the EU are based on standard contractual clauses.

6.3. The scope of the transfer is limited to what is necessary for the service to work. A provider sees the data transmitted to it only to the extent of that provider's role: for example, only the search word you type, your interface language and your approximate country go to the GIF search service, not who is searching. Transfers to Google Analytics carry only the usage data listed in 2.6 and stop when you turn the measurement off; they are also subject to the standard contract arrangement in 6.2.

6.4. We want you to know that the authorities of the countries where the data is located may request access to this data under their own laws. This is an unavoidable consequence of transfer abroad.

7. Retention periods

We keep your personal data for the period required by the processing purpose and for as long as legal retention obligations require:

When the period expires, the data is deleted, destroyed or irreversibly anonymised. Records that are the subject of an ongoing investigation, lawsuit or official evidence preservation request are kept until the process is concluded.

8. Security measures

• All data transmission is encrypted with TLS; traffic between servers runs over a private network.
• Passwords are stored with an irreversible hashing algorithm.
• Data access is restricted on every request by authorisation checks in the application layer: a user sees only the data they have a right to access.
• Administrative access must be held by a limited number of people and protected with two-step verification.
• Access to file storage and feed videos is granted through time-limited signed links; the video provider's own player and its unsigned direct links are disabled.
• Rate limits, abuse detection and DDoS protection are applied.
• Regular backups are taken and backups are deleted after 35 days.

No system is completely secure. If a security breach affecting your personal data occurs, we will inform the affected users and, where required, the competent boards within the periods provided for in the legislation.

9. Your rights

Under Article 11 KVKK, you can exercise the following rights by applying to the controller:

• To learn whether your personal data is processed
• If it has been processed, to request information about it
• To learn the purpose of processing and whether it is used in accordance with its purpose
• To know the third parties to whom it has been transferred within the country or abroad
• To request its correction if it has been processed incompletely or inaccurately
• To request its deletion or destruction under the conditions provided for by the Law
• To request that the correction, deletion and destruction operations be notified to the third parties to whom it has been transferred
• To object to a result to your detriment arising from analysis exclusively by automated systems
• To request compensation for damage if you suffer damage due to unlawful processing

For users within the scope of the GDPR, the following rights also apply: access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of the explicit consent you have given. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

9.1. How to apply. You can exercise some rights directly in the application:

• A copy of your data: Settings › Account › Prepare my data. The prepared file can be downloaded for 7 days. Your linked accounts (the service name, your account ID and name on that service, your visibility choice and the dates) are included in this file.
• Correction: you can update your profile and account information in the settings.
• Deletion: Settings › Account › delete account.
• Data in the new bots: by giving Micup Seviye the !verilerimisil command, you can delete your own XP and statistics in all communities in that bot. In Micup Destek, after you close your open ticket, the same command deletes your local personal ticket records; in Micup Çekiliş it removes your own winner and creator number from the bot database. ! is the default command prefix; if the community administrator has changed it, use that prefix. Micup Mod warnings and the registering staff member's registration counts are not deleted with this command; to delete a warning you can apply to the community's authorised moderator, and for your other personal data requests to the contact address below (see 10.5).
• Consent to notifications: you can turn off browser and application notifications in the settings.
• Objection to game activity: Settings › Privacy › Show my game activity › Off. The moment you choose it, new sharing and game detection on this device stop; if you only want to narrow the audience, you can choose Friends (see 2.11).

For your other requests, write to pr@premate.gg with information sufficient for us to verify your identity (account name and sending from the account's registered email address). We will conclude your application free of charge within 30 days at the latest. If the request requires a separate cost, we may charge the fee in the tariff provided for in the legislation.

9.2. Right to complain. If your application is rejected, you find our answer insufficient or you do not receive an answer in time, you can file a complaint with the Personal Data Protection Board in Türkiye. If you are in the European Union, you can apply to the data protection authority of your own country.

10. Account deletion and what is not deleted

10.1. When you delete your account: your profile, your avatar and banner images, your biography, your linked accounts, your follow relationships, your sessions and your notification records are deleted. Your profile images and the media you saved are deleted from storage; files you attached to messages remain together with the message as described in 10.2. Your feed posts are deleted together with their images and videos, and with your feed comments and likes; videos are deleted from Bunny, including your videos that have not yet been published. If Bunny cannot be reached at that moment, the deletion is retried until it succeeds. Your level (XP) records, leaderboard entries and warnings about you in MicupBOT are deleted in all communities, including the communities you have left.

10.2. Anonymisation. So as not to make a conversation unreadable, your channel and direct messages are not deleted together with the files in their attachments; they are anonymised by severing the author link. If you want these to be deleted as well, you can use the Delete my messages tool in the Privacy settings before deleting your account. The copies held by others of the direct messages you sent them remain, because they are the other party's own correspondence record.

10.3. What is not deleted. The following continue to be kept for the periods in section 7: traffic and access records (Law No. 5651), payment and accounting records (tax legislation), moderation and ban records (the reasons for the decision and prevention of ban evasion), evidence copies (attachments in reported messages and in the surrounding messages within the context window, including those of other authors; feed images and videos that were reported or removed by a moderator; videos removed automatically after publication), records that are the subject of an ongoing investigation. In addition, your user number remains as audit information (legitimate interests, Article 5(2)(f) KVKK) in MicupBOT warnings you gave to others as a moderator, in community bot settings you saved and in Micup Roster events you created: until the warning, panel or event is deleted or, for other settings, until another administrator saves the setting again. The welcome/farewell and level messages and command responses (such as warning, mute, kick, ban, role, nickname, move, leaderboard and user information) that MicupBOT posts to channels are ordinary channel messages; your name may appear in them as plain text and they remain even if you delete your account; the community's moderators can delete them.

10.4. For servers you own, the option to transfer or close them is offered before deletion.

10.5. New official bots. For the local databases of Micup Mod, Micup Rol, Micup Destek, Micup Çekiliş and Micup Seviye, the 30-day community removal rule in section 7 and the bot commands in 9.1 apply. Micup Mod warnings are a community moderation record; they are not deleted with !verilerimisil; the community's authorised moderator can delete them. The registering staff member's registration counts are also preserved under this command. The responses and logs that the bots post to channels, giveaway reactions and result messages, and the copies of support transcripts in the log channel and in DMs are not affected by deletion in the bot database. The name and age written by Micup Mod are a community nickname; when the bot database is deleted, this nickname is not removed automatically. It should not be assumed that the account deletion and Prepare my data operations in the application also apply to these separate bot databases; you can send your requests relating to these records to pr@premate.gg.

11. Children's privacy

11.1. The service is not directed at persons under 15; we do not knowingly collect data from persons below this age.

11.2. If we learn that an account belongs to someone under 15, we close the account and delete its data except as required by legal retention obligations.

11.3. If you are a parent or guardian, you can request the closure of an account belonging to your child and the deletion of its data at pr@premate.gg. For the application procedure and further information, see the Child Safety Policy (Turkish).

12. Our principles for disclosing data to official authorities

• We process a data request only when it comes from a competent authority, through an official channel and in a verifiable form.
• We review the legal basis and scope of the request; we reject overly broad, unfounded or unauthorised requests or ask for them to be narrowed.
• Content data (message texts, direct messages, files) is provided only on a court order or a request from a prosecutor's office authorised by law.
• In cases of imminent danger (a life-threatening situation, child abuse) we may share information without waiting for an official request.
• Unless legally prohibited and unless it would jeopardise an investigation, we will notify you of a data request about you.
• We aim to publish request numbers in a transparency report every six months.

For the whole process, see the Legal Requests and Law Enforcement Guide (Turkish).

13. Automated decision-making

Some decisions are made by automated systems without human review and have consequences for you:

• Image review (inappropriate content scanning): the images below are evaluated for sexual content by an automated classifier running on our own servers; images are not sent to a third party for this purpose. The classifier gives a probability for each image; content above the threshold we have set is not published. Feed images: an image above the threshold is not published and this is reported to you as an error. If scanning cannot be done at that moment, the image post cannot be made either. Feed videos: at most 60 frames are scanned from the cover image generated by Bunny, the thumbnails and the preview frames spread across the whole video. If the cover image or at least two frames exceed the threshold, the video is not published and is deleted; a notification is sent to you in the application. Videos also go through Bunny's automated content tagging; if the video is tagged as adult content, the result is the same. If this tag arrives after publication, the post is removed, you are notified and an evidence copy of the video is kept (see 7). If scanning cannot be completed, the video is not published and scanning is retried; if it cannot be completed within 72 hours, the video is deleted and you are notified. Images and videos attached to chats: in places where adult content is not permitted they are scanned before being sent, and a file above the threshold is not sent. These places are: servers listed in Discover; servers with the "Explicit content filter" turned on (if "Filter members without roles" is selected, only the attachments of members without roles); group chats; direct messages with people who are not your friends ("Block" by default in the "Sensitive content" setting); direct messages where one of the parties has chosen "Block" for messages from friends. This scanning is not done in "Adults only" channels, in servers marked as "content suitable for adults", in servers with the explicit content filter turned off, or on the attachments of bot accounts. If the scanning system is temporarily not working, attachments may be delivered without being scanned, as files without a preview. Link previews: the image in a preview card is scanned in the same way in the feed and in the places where chat attachments are scanned. If an image above the threshold is found, the preview card is not shown in the message at all; in the feed a card without an image is shown. Images such as profile pictures, banners, server icons, emojis and stickers are not covered by this scanning. The scanning result is not stored as a separate record. For images, the probability is shown to you only at the moment of rejection and is not written to server records. For videos, the decision and the highest probability value appear together with the video ID in server records (logs). These records are deleted automatically on a rotating basis according to a size limit; they are not stored separately or archived. These decisions are made without human review. We do not keep a copy of videos and images rejected before publication: a rejected video is deleted, and the uploaded file of a rejected image stays in the temporary upload area for at most 7 days and is then deleted automatically. For this reason, in your appeal the content itself and the details of the decision often cannot be reviewed; the review is limited to the information you provide to us. We take reports of incorrect rejections into account when reviewing the threshold of the automated review. Appeals: pr@premate.gg.
• Prohibited link filter: an account that shares an adult content domain name is banned immediately and permanently; the IP addresses it used in the last 30 days are also banned.
• Name filter: religious, political, pornographic or hateful terms in server and channel names are rejected automatically and the account may be permanently banned.
• Spam and rate limit systems: unusual behaviour may lead to a temporary restriction.
• Community automatic moderation (MicupBOT automod): if a community administrator turns on automod and sets its rules, MicupBOT deletes a message that does not comply with these rules (very fast messages, invite links, disallowed links, prohibited words, too many mentions, too many capital letters) without human review. Depending on the rule, it also posts a warning mentioning you in the channel or mutes you for a period between 1 minute and 28 days. The action is written to the community's audit log with the reason "Automod" and the name of the rule. Automod is not applied to members who have the "Manage Messages" permission in the channel. The rules are set by the community, not by Micup: to have a mute lifted or a rule changed, first apply to that community's moderators; if you think automod acted outside these rules, the appeal route below is also open. Because automod does not keep a copy of the message it deleted, the message itself often cannot be reviewed in your appeal; the review is limited to the information you provide to us.

• Micup Mod protection: if the community administrator turns it on, it counts joins and destructive moderation events within a short period. If the threshold for verified destructive actions is exceeded, it may remove, to the extent the bot's permissions and the role hierarchy allow, the roles carrying dangerous permissions of the person concerned without human review; the action is written to the log channel and an attempt is made to send a DM to the community owner. To have the action corrected, you can apply to the community's administrators or, if you think the bot malfunctioned, to the appeal route below.

These systems can make mistakes. You can appeal every automated decision; your appeal is reviewed by a human independently of the system that made the decision. The appeal route and time limit are explained in the Community Guidelines (Turkish).

14. Changes

We may update this text. The current version and effective date are shown at the top of the page. We announce material changes within the Service before they take effect; when a new processing purpose or a new data processor is added, this text is updated.

15. Contact

• Personal data requests: pr@premate.gg
• Content reports: pr@premate.gg
• Legal notices: pr@premate.gg

See also the Terms of Service, Community Guidelines (Turkish), Child Safety Policy (Turkish) and Legal Requests Guide (Turkish).