Legal
Privacy Policy
The short version: our websites run no analytics or ads, and we never sell your data. We process what your visits, purchases and licenses need, and Paddle handles your payment.
Who we are
Burak Çalık, a sole proprietorship trading as Elcano (“Elcano”, “we” or “us”), is the data controller for the personal data this policy describes. Its registered address is Karaağaç Mah. Conkbayırı Cad. 5/433, Büyükçekmece, Istanbul, Turkey, and you can reach us at [email protected].
This policy is also our information notice under Article 10 of Turkey’s Law No. 6698 on the Protection of Personal Data (“KVKK”). It covers our websites: this one, our products’ websites, such as pacifico.elcano.app, and licenses.elcano.app, where you buy our products and manage your licenses. It also covers the products themselves, and the messages you send us. When we work with you as a client, our agreement covers the personal data we handle in that work.
What we collect, and why
When you visit our websites
Cloudflare delivers our websites through its network and protects them from attacks. Each request your browser makes reaches one of Cloudflare’s data centres first, which answers it from its cache or passes it on to our servers. From these requests, Cloudflare also shows us overall figures that don’t identify anyone, such as how many requests a website served and from which countries.
- What
- Your IP address, the date and time, the page or file requested, the page you came from, and the browser and device details your browser sends. If a connection to one of our websites fails, browsers that support it also report the failure to Cloudflare, with the address requested, the type of error and technical details of the connection
- Why
- To deliver our websites, keep them secure and find faults
- How
- Automatically, with each request your browser makes: Cloudflare receives every request, and our servers log those it passes on
- Legal basis
- Our legitimate interests, where they don’t override your rights (KVKK Article 5(2)(f))
- How long
- On our servers, only as long as security and troubleshooting need; at Cloudflare, as Cloudflare’s privacy policy sets out
This site’s fonts
This site’s typefaces come from Google Fonts, so your browser fetches them from Google. Our other websites serve their own.
- What
- Your IP address and browser details, which Google receives when it sends the fonts
- Why
- To show the site in its typefaces
- How
- Automatically, when your browser fetches the fonts
- Legal basis
- Our legitimate interests (KVKK Article 5(2)(f))
- How long
- As Google’s privacy policy sets out
When you buy a product
Our reseller, Paddle, runs the checkout on licenses.elcano.app. You give your payment details to Paddle, which handles them, with your billing address and any tax details, under its own privacy notice. Paddle sends us what we need to deliver your purchase.
- What
- Your name and email address, what you bought, its price, discount, tax and currency, the invoice number, and the payment details in Paddle’s messages to us, which can include the card’s type, its last four digits, its expiry date and the cardholder’s name. We never receive your full card number
- Why
- To issue your license and send it to you, keep a record of your purchase, make refunds and answer your questions
- How
- From Paddle, when you pay and when you’re refunded
- Legal basis
- To perform our contract with you (KVKK Article 5(2)(c)), and to keep the records the law requires (Article 5(2)(ç))
- How long
- As long as your account exists, since a license lasts for life; after that, only as long as the law requires us to keep business records
Your account at licenses.elcano.app
Your first purchase opens an account for you at licenses.elcano.app, under the email you bought with. You sign in with a link we email you, or with a password if you set one.
- What
- Your name and email address; your password, if you set one, stored only in a form that can’t be turned back into it; what two-factor sign-in or a passkey needs, if you turn them on, including the passkey’s name, such as “Chrome on Mac”; your licenses, their devices and your refund requests, in your own words; the IP address you ask for a sign-in link from; and notes our support staff write when they help you
- Why
- To let you sign in, see and move your licenses and ask for refunds, to help you, and to keep your account secure
- How
- From your purchase, from what you do in your account, and from your browser when you ask for a sign-in link
- Legal basis
- To perform our contract with you (KVKK Article 5(2)(c)), and our legitimate interests in keeping accounts secure (Article 5(2)(f))
- How long
- As long as your account exists. Ask us to close it, and we’ll delete or anonymise your personal data, except what the law requires us to keep
When a product checks its license
Our products check their license with our server when you activate one on a device, about once a day while you use it, and when you release the device. A product you use without a license, such as Pacifico’s free version, makes no license checks. If the license is already active on another device, a check with its key is told that device’s name and when it was activated, so that you can tell which one to release, and a product shows the license’s owner as a partly hidden email address, such as b***@example.com.
- What
- The license key; an identifier for the device, which the product derives from the device’s hardware ID with a one-way function, so that the hardware ID itself never leaves it; the device’s name, which often includes its owner’s name, such as “Ayşe’s MacBook”; the versions of its operating system and of the product; and the IP address the check comes from, with the technical details its connection sends
- Why
- To activate your license on one device at a time, keep it working and stop keys being shared
- How
- From the product, automatically
- Legal basis
- To perform our contract with you (KVKK Article 5(2)(c)), and our legitimate interests in preventing abuse (Article 5(2)(f))
- How long
- The record of each check, with its IP address, for 90 days. Each device’s details, with the address it last checked in from, and the record of activations and releases, as long as your account exists
When a product looks for updates
Pacifico looks for a new version once a day, unless you turn this off in its settings. It fetches a public list of versions from our server, without your key or any identifier, so our server sees only what any visit shows, such as your IP address and the app’s name and version.
Crash and performance reports
Pacifico sends Sentry a report each time it starts, and whenever it crashes or stops responding.
- What
- Technical details of the crash or hang; how long the app took to start; its version; the Mac’s model, processor, memory, macOS version, language and screen size; a random identifier the app creates when it’s installed; and the IP address the report comes from. Reports don’t include your license key, your Spotify account or what you play
- Why
- To find and fix faults in the app
- How
- From the app, automatically
- Legal basis
- Our legitimate interests (KVKK Article 5(2)(f))
- How long
- Up to 90 days, at Sentry
Spotify and your speakers
Pacifico connects your Mac directly to Spotify, under your own Spotify account, and to your AirPlay speakers over your own network. Your Spotify sign-in and your speakers’ pairing stay on your Mac, and the music goes between Spotify, your Mac and your speakers: we never receive any of it. Spotify’s privacy policy covers what Spotify receives.
Emails we send
Postmark sends our emails, from [email protected]: your license key, sign-in links, reminders before your updates end, and notices about your licenses, such as a refund or a device being released.
- What
- Your name and email address, what the message says, and a record of each email we send you
- Why
- To deliver your license and keep you informed about it
- Legal basis
- To perform our contract with you (KVKK Article 5(2)(c))
- How long
- Postmark keeps each message for 45 days. We keep the record of what we sent as long as your account exists
When you email us
- What
- Your name and email address, what you write and anything you attach
- Why
- To reply, to help you with our products, and to discuss and prepare any work together
- How
- From the email you send us
- Legal basis
- Steps towards a contract you’re considering with us, or performing one (KVKK Article 5(2)(c)), and our legitimate interests (Article 5(2)(f))
- How long
- As long as the conversation, and any work that follows it, needs; after that, only as long as the law requires us to keep business records
Cookies
This site and our products’ websites set no cookies of their own. licenses.elcano.app sets the cookies it needs to work, and keeps a few of your choices in your browser:
- elcano-licenses-session keeps your visit going, and XSRF-TOKEN protects its forms from forgery. Both end two hours after you last use the site
- remember_web_… keeps you signed in for up to 400 days, when you ask to be remembered or sign in with an emailed link
- appearance remembers light or dark mode for a year, and sidebar_state whether its sidebar is open, for a week. Your browser’s storage also keeps the mode, and whether you dismissed the reminder to set a password
None of them tracks you. On the buy page, Paddle’s checkout loads from Paddle and may set cookies of its own, as Paddle’s privacy notice explains.
Cloudflare sets a cookie only for security. If it needs to confirm that a visitor is a person rather than a bot, for example during an attack, it may ask your browser to pass a check before showing a website, and then sets a cookie (cf_clearance) that remembers the check for a while.
What we don’t do
We don’t run analytics or advertising on our websites, track you across other sites or sell your data. We make no decisions about you by automated means alone: if a license is used on unusually many devices, it’s flagged for a person to look at.
Who receives it
- Google Cloud, which hosts our servers, database and backups in Belgium
- Cloudflare, which delivers our websites and protects them from attacks
- Google, which serves this site’s fonts
- Paddle, our reseller and the merchant of record for our orders, which takes your payment and makes refunds. When you ask for a refund, we pass on your reason
- Postmark, which sends our emails
- Sentry, which receives Pacifico’s crash and performance reports
- Our email provider, which stores the messages you send us
- Professional advisers, such as accountants and lawyers, when they need it to advise us
- Public authorities, when the law requires us to share it
When you follow a link to another site, such as LinkedIn, that site’s own privacy policy applies.
Transfers abroad
Our servers, database and backups are in Belgium, and Cloudflare handles each request in one of its data centres, which may be outside Turkey. Paddle is based in the United Kingdom, Postmark and Sentry keep data in the United States, and Cloudflare, Google and our email provider may also process data in other countries, including the United States. So your data leaves Turkey when you visit our websites, buy or use our products, or write to us. We transfer personal data abroad only as Article 9 of KVKK allows.
How we protect it
Our websites, and our products’ license checks, use only encrypted connections (HTTPS), and Cloudflare screens the websites’ traffic for attacks before it reaches our servers. We store license keys encrypted, and passwords and sign-in links only in a form that can’t be turned back. Your account can have two-factor sign-in or a passkey, and a new password is checked against known data breaches without being revealed. Payment details stay with Paddle, and our server checks that each message from Paddle is genuine.
Only the people who run our support can see your account, and every change they make to it is recorded. Access to our servers and our email is limited to the people who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
Your rights
Under Article 11 of KVKK, you can ask us:
- whether we process your personal data, and for information about it if we do
- why we process it, and whether we use it for that purpose
- who we’ve shared it with, in Turkey or abroad
- to correct it if it’s incomplete or wrong
- to delete or destroy it, under the conditions in Article 7 of KVKK
- to tell those we’ve shared it with about any correction or deletion
You can also object to an outcome against you that comes solely from automated analysis of your data, and claim compensation for damage caused by unlawful processing.
If you’re in the European Economic Area or the United Kingdom, the GDPR gives you similar rights, including to object to processing based on our legitimate interests and to receive your data in a portable form. You can also complain to your local data protection authority.
How to use them
Email [email protected] from the address you’ve used with us, or write to us at our registered address, saying who you are and what you’re asking for. We’ll answer within 30 days, free of charge, unless your request involves a cost that the Personal Data Protection Board’s tariff allows us to charge.
If we turn your request down, you find our answer inadequate or we don’t answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our answer, and in any case within 60 days of your request.
Children
Neither our websites nor our products are meant for children, and we don’t knowingly collect children’s data.
Changes to this policy
We’ll update this page when our practices change, and the date at the top shows the latest version. This policy is published in English and Turkish. If the two differ, the Turkish version prevails.
Contact
Write to us at [email protected] with any question about this policy or your data.