Privacy Policy

Last updated: 20.07.2026 · Version v1.0 (draft)

This policy is provided for transparency and is not legal advice. Justonair is operated as a Turkish sole proprietorship (şahıs şirketi) but serves customers outside Turkey, so both KVKK (because the controller is based in Turkey) and GDPR (because the service is offered to people in the EU/UK) may apply at once; the legal bases and rights section below are written generically to cover both. It should be reviewed by a qualified lawyer before you rely on it, particularly once real payments or EU/UK customers are live.

1. Who we are

Service	Justonair Studio — justonair.com
Operating entity	Orhun Ceng Bozo, sole proprietor (şahıs şirketi) — Turkey.
Contact	[email protected] · support.plancode.net

2. Personal data we process

Category	Data	Source
Identity & contact	Email address, display/participant name	Account sign-up (Supabase)
Account & session	User ID, session/login data, language preference	Authentication
Payment & subscription	Plan, subscription status, billing period. Card details are never stored by us.	Polar (merchant of record)
Stream content	Camera/mic/screen streams, chat messages, scene and layout settings	Service use (LiveKit)
Uploaded media	Backgrounds, logos, video clips	Your uploads (Cloudflare R2)
Recordings	Cloud-recorded stream files, if you request them	Recording/egress (S3/R2)
Technical	IP address, device and browser information, server logs	Collected automatically
Early-access sign-ups	Email address and anything you type into the form on justonair.com	Netlify Forms

3. Why we process it, and on what basis

Providing the service (account, streaming, recording, media) — performance of a contract;
Payment and subscription management — performance of a contract / legal obligation;
Security, abuse prevention and logging — our legitimate interests / legal obligation;
Meeting statutory retention duties and responding to requests — legal obligation;
Early-access updates and product news — only with your explicit consent, which you can withdraw at any time.

4. How long we keep it

Uploaded backgrounds, logos and video clips: automatically deleted 24 hours after upload.
Cloud recording files: permanently deleted after 7 days.
Account and subscription data: for as long as the account is active, plus any statutory retention period.
Server logs: for a reasonable period for security and legal purposes.
Early-access sign-up emails: until launch, or until you ask us to remove you.

5. Processors and international transfers

The service is delivered with help from the following processors. Your data may be processed on their servers outside your own country.

Provider	Purpose
Supabase	Authentication and database
LiveKit Cloud	Real-time video and audio (WebRTC)
Cloudflare R2 / S3	Media and recording storage
Polar	Payments and billing (merchant of record)
Heroku / Netlify	Application and website hosting
Google (YouTube Data API)	Live comments panel — only if you connect YouTube. See §6.
Twitch	Live comments panel — only if you connect Twitch. See §6.
Meta (Facebook)	Live comments panel — only if you connect Facebook. See §6.

Where a processor is based outside the EEA/UK, we rely on the safeguard that processor itself provides under GDPR/UK GDPR — typically Standard Contractual Clauses, an applicable adequacy decision, or (for US-based providers) a Data Privacy Framework certification. Each processor's own data processing agreement is the authoritative source for its current safeguard; we do not independently certify it, and you should check directly with the provider if this matters for your own compliance.

6. YouTube and other platform data (live comments panel)

If you connect YouTube, Twitch or Facebook to show their live comments on screen, we access two kinds of data through each platform's API:

Your own account — your channel/page name and your live broadcast status, so we know which live chat to read. We store your access and refresh token for that platform so the connection keeps working between sessions.
Comments from your viewers — for each live chat message: the commenter's display name, profile photo and message text, timestamped.

Viewer comments are relayed straight to your own browser over a live connection so they can appear in your on-screen comments panel — we do not write them to a database. They exist only in transit, for the duration of your live session, and are gone once the connection ends. We never use this data for advertising and never sell or share it with anyone other than you, the account holder who connected the platform.

For YouTube specifically, we request the read-only youtube.readonly scope. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a platform at any time from your Studio settings, which deletes the stored token immediately. You can also revoke access directly from your Google Account permissions page.

7. Your rights

Depending on where you live, you have the right to ask us whether we process your data, to get a copy of it, and to have it corrected, deleted or ported. You may also object to processing, ask us to restrict it, and withdraw any consent you have given. Where local law provides one, you have the right to complain to your data protection authority.

To exercise any of these rights, email [email protected] or use support.plancode.net. We will respond within the period required by the law that applies to you.

8. Cookies

See the Cookie Policy.

9. Changes to this policy

If we change this policy we will update the date at the top of the page. Material changes will be communicated to account holders by email.