Legal
Privacy policy
Bu belge artık yalnızca İngilizcedir; Türkçe çeviri sunulmamaktadır. Belgenin önceki Türkçe sürümünün yerini aşağıdaki İngilizce sürüm almıştır. Anlamadığınız bir nokta olursa meskora.com'daki iletişim bilgilerinden Meskora'ya sorabilirsiniz.
Version 2.0 · Effective date: 1 November 2026
This Privacy Policy explains how Sefki Huseyin trading as Meskora ("Meskora", "we", "us" or "our"), handles personal information in connection with meskora.com, app.meskora.com, the Meskora mobile apps, demonstrations, sales, support and the Meskora property-operations software service (the "Service").
1. Who we are
Legal operator: Sefki Huseyin, a sole trader in the United Kingdom, trading as Meskora.
Business address: Suite RA01, 195-197 Wood Street, London E17 3NU.
Privacy contact: privacy@meskora.com. General contact: contact@meskora.com.
ICO registration number: ZC255598.
2. When Meskora is controller and when it is processor
We act as a data controller when we decide why and how personal information is used for our own business purposes, including website enquiries, account administration, billing records, security, product improvement, direct sales and legal compliance.
For personal information that a customer uploads to or creates in its Meskora workspace about owners, residents, tenants, guests, contractors, staff or other people ("Customer Content"), the customer will generally be the controller and Meskora will generally act as its processor. We process that Customer Content to provide the Service and in accordance with the customer’s documented instructions and our Data Processing Addendum.
A person’s role may vary by processing activity. This policy does not replace a customer’s own privacy notice to the people whose data the customer places in Meskora.
3. Personal information we may collect
| Category | Examples |
|---|---|
| Account and identity data | Name, business name, role, username, account identifiers, preferred language and authentication information. |
| Contact data | Business email, telephone number, postal address and communication preferences. |
| Subscription and billing data | Plan, unit count, invoices, payment status, transaction references, tax/VAT information and billing contact details. Payment-card details are normally handled by the payment provider rather than stored by Meskora. |
| Usage and device data | IP address, browser/device information, timestamps, login activity, audit events, feature usage and diagnostic information. |
| Sales and support data | Demo requests, correspondence, support tickets, call notes, feedback and attachments you send us. |
| Customer Content | Property, property location or map position, arrival information, owner, resident, tenant, guest, reservation, maintenance, housekeeping, document, finance, contractor and communication information entered or generated by customers. The precise content is controlled by the customer. |
| Security data | Authentication events, MFA/passkey status, recovery events, administrative actions, access grants and security logs. |
| Cookie/device storage data | Cookie identifiers, consent choices and similar storage/access information as described in our Cookie Notice. |
| Shared-link access data | Shared-link identifier, date and time of access, IP address, browser and device information, pages or information accessed through the link, and actions taken through it, including information, photographs or files submitted where applicable. |
4. How we collect information
- You provide it directly when you book a demo, create an account, subscribe, contact us, use support or configure the Service.
- Your organisation provides it when an administrator creates your account or adds you to a workspace.
- It is generated automatically when you use the website or Service, for example security and audit logs.
- Customers upload or generate Customer Content in their workspaces.
- Payment, security, communications and other service providers may provide us with transaction or technical information needed to operate the Service.
- We may obtain business contact information from public business sources for proportionate business-to-business outreach, subject to applicable direct-marketing rules.
- A customer may provide you with a shared Meskora link relating to a property, stay, request, job or other operational matter. When you open or use such a link, technical information about that access is generated automatically and we receive any information or files that you submit through it.
Shared-link access
Customers may use Meskora to share information with residents, guests, contractors and other people without creating an account for them.
The information available through a shared link is selected or controlled by the relevant customer and may include, for example, property information, arrival instructions, access information, Wi-Fi information, property guidance, work instructions or information relating to a request or job.
A shared link remains available for the period configured by the customer or by the Service for that type of link and may stop working when it expires, is revoked or the relevant stay, job or other operational purpose ends.
When a shared link is used, we may record technical and security information including the link identifier, date and time, IP address, browser or device information and actions taken through the page. If the link allows information, photographs or files to be submitted, we process those submissions on behalf of the customer.
The customer is generally the controller of the property, guest, resident, contractor and operational information made available through the link. Meskora generally processes that information on the customer's behalf. We may separately process limited technical and security records as controller where necessary to secure, administer and protect the Service.
5. Why we use personal information and our lawful bases
| Purpose | Typical lawful basis (where Meskora is controller) |
|---|---|
| Provide accounts, subscriptions, demos, support and requested services | Contract; steps at your request before entering a contract. |
| Operate authentication, tenant isolation, audit trails, fraud prevention and platform security | Legitimate interests in protecting customers, users and the Service; legal obligation where applicable. |
| Billing, accounting, tax and business records | Contract; legal obligation; legitimate interests in managing our business. |
| Respond to enquiries and manage customer relationships | Contract / pre-contract steps; legitimate interests. |
| Improve reliability, usability and features using appropriately minimised operational data | Legitimate interests, balanced against users’ rights; consent where required for optional device storage/analytics. |
| Send service messages | Contract and legitimate interests. |
| Send marketing or sales communications | Legitimate interests for appropriate B2B communications, or consent where required. You can opt out at any time. |
| Establish, exercise or defend legal claims and comply with law | Legal obligation and legitimate interests. |
| Operate and secure shared-link access, investigate misuse and maintain relevant technical and security records | Legitimate interests in providing, securing and protecting the Service; legal obligation where applicable. |
Where we rely on legitimate interests, we consider the necessity of the processing, our interests and the impact on individuals. Where consent is the appropriate basis, you may withdraw it at any time without affecting prior lawful processing.
6. Customer Content, sensitive information and customer legal duties
Meskora hosts Customer Content on the Customer's instructions and does not determine the Customer's tenancy, property, rent, screening or tax-compliance purposes. Customers must identify their own lawful bases, give required notices, apply relevant local data-protection laws, and avoid uploading unnecessary or prohibited information. Property and unit-level financial statements may identify a tenant indirectly even where the payer's name is omitted; customers must determine whether and to whom such statements may lawfully be disclosed.
The Service is not intended for intentional upload of special-category or criminal-offence data without prior written approval and appropriate safeguards. A sanctions-screening result about an identifiable tenant, including a possible match or even a clear result in some contexts, needs case-specific assessment and may constitute criminal-offence data. The Customer should not use the screening feature for Article 10 data unless it has first established the conditions and controls that the law requires for that data. No automatic eligibility or adverse decision should be inferred from an unverified match.
7. Sharing and service providers
Meskora may disclose personal information to infrastructure, backup, security, email, mobile notification, support, accounting and professional providers where necessary and subject to applicable data-protection duties, or to authorities where legally required. Our current identified operational providers include Cloudflare (network delivery and security, but not current inbound mail for meskora.com), SMTP2GO (transactional sending), AWS S3 London (encrypted off-site backups), Expo, Apple and Google (mobile push infrastructure where used), and Google Workspace (staff and inbound business email). Meskora's production systems, including its primary database and file storage, run on hardware that Meskora operates in the United Kingdom; no third-party hosting or colocation provider is used. Provider roles, processing locations and contract safeguards are recorded in our sub-processor register and supplier diligence records; some details remain subject to ongoing supplier due diligence.
The merchant of record shown at checkout (currently expected to be Paddle) is ordinarily an independent controller of the buyer transaction records it processes in its own capacity, not a sub-processor of Customer Content, provided the documented data-flow analysis confirms that it receives no Customer Content. For disclosures of business-contact or account information to the merchant of record, consult its notice at checkout. Professional advisers and authorities may separately act as independent controllers. Meskora may disclose relevant records for genuine corporate restructuring with appropriate protection.
Merchant-of-record payment data
Our current intended merchant of record is Paddle (the applicable legal entity is shown at checkout and on the receipt). Paddle and Meskora generally act as independent controllers for their respective payment-transaction activities. Paddle processes buyer identity, billing, payment, fraud-prevention and transaction-tax information under its own privacy notice at https://www.paddle.com/legal/privacy. Meskora receives the subscription, contact, payment-status and transaction-reference information needed to administer the Service. We do not intentionally provide tenant or property Customer Content to Paddle for ordinary subscription billing. If the merchant of record changes, we will update this notice and provide any material-change notice required under our Terms and applicable law.
8. International transfers
Meskora's application runs on Meskora's own hardware in the United Kingdom. The only off-site copy is an encrypted backup held in AWS S3 in the London region. Cloud delivery, support, email and push-notification providers may involve access to personal information from outside the UK. Each relevant transfer is assessed on its actual recipient, country, role and data flow. Where Meskora is responsible for initiating a restricted transfer under the UK GDPR, it will use applicable UK adequacy regulations, an appropriate transfer safeguard (such as the UK IDTA or UK Addendum, together with a data protection test/transfer risk assessment where required), or a legally available exception. Specific overseas locations and safeguards are not represented as verified until supplier due diligence is completed. Contact privacy@meskora.com for transfer information. The Customer is responsible for separate restrictions imposed by its own jurisdiction on disclosures or hosting it initiates, and Meskora remains responsible for laws that independently bind Meskora.
9. Retention
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements. Our intended retention approach is:
| Data | Typical retention approach |
|---|---|
| Account and contract records | For the customer relationship and then normally up to 6 years where needed for contract, tax or legal records. |
| Billing/tax records | As required by applicable tax and accounting law, commonly up to 6 years after the relevant period. |
| Support and sales correspondence | Normally up to 24 months after closure or last meaningful contact, unless required longer for an active customer or dispute. |
| Sign-in session records | Deleted 90 days after the session expires. |
| Security logs (sign-in events, IP addresses, device information) | 12 months. |
| Records of Meskora support and administrative access to workspaces | 24 months. |
| Activity history of a customer's own records | For the life of the workspace, then deleted with it. |
| Customer Content after termination | Unless the customer gives a different valid instruction under the Data Processing Addendum, a 30-day export window begins when the agreement ends; export may be self-service where available or assisted manually. After this window, Customer Content is scheduled for deletion from the live Service and deletion is confirmed after completion. Encrypted backups are kept out of ordinary use and expire on the documented cycle, targeted within 90 days after termination, subject to legally required retention, documented holds or technical exceptions requiring disclosure. The DPA governs controller choice of return or deletion. |
| Marketing suppression records | A minimal suppression record may be kept for as long as needed to honour an opt-out. |
Where records are needed for a security incident, investigation or legal dispute, we place them on hold and keep them until the matter is closed.
10. Security and access
We use technical and organisational measures designed to protect personal information. The Service is designed around isolated customer workspaces, access controls, private file storage, authentication controls, controlled administrative access and auditable administrative actions.
Customer-authorised support access is restricted to an appropriate purpose where an in-product approval function is available. Other restricted infrastructure-level access may be necessary for security, operations, backups and incident handling. In-product approval and Customer-visible audit features are described in the Service and may change as the Service develops.
Because Meskora operates the infrastructure used to provide the Service, authorised personnel may also have restricted administrative or infrastructure-level access to systems that store or process Customer Content. Such access is used only where reasonably necessary to operate, maintain, secure, monitor, troubleshoot, back up, restore or protect the Service, investigate security incidents, comply with law or perform other legitimate infrastructure administration.
Administrative access is subject to appropriate access controls, confidentiality obligations and logging.
We also use encryption, backup and recovery measures, security logging, monitoring, patching and other safeguards appropriate to the Service.
No internet service can guarantee absolute security. Customers are also responsible for protecting credentials, devices, permissions and local systems.
11. Your rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict personal information; object to certain processing; receive certain information in portable form; and withdraw consent where consent is used. You also have rights relating to certain solely automated decisions. These rights are subject to legal conditions and exceptions.
If your request concerns Customer Content held in a customer’s workspace, please contact that customer first because it will normally be the controller. We will assist customers with valid rights requests as required by our DPA and law.
To exercise a right concerning information for which Meskora is controller, contact privacy@meskora.com. We may need to verify your identity.
12. Complaints
Please contact us first at privacy@meskora.com so we can try to resolve your concern. You may also complain to the UK Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/ or to another competent supervisory authority where applicable.
13. Cookies and similar technologies
Our use of cookies and similar storage/access technologies is described in the Meskora Cookie Notice. We do not set non-essential cookies before obtaining consent where consent is legally required.
14. Children and business use
Meskora is offered only to business customers and is not offered to children as customers or account holders.
Customer Content may nevertheless relate to children or other family members where a customer lawfully needs to process that information as part of its property operations. The customer is responsible for determining whether that processing is lawful and for providing any required privacy information.
15. Automated decision-making
Meskora does not currently make decisions about individuals that have legal or similarly significant effects based solely on automated processing. If this changes, we will update this notice and provide the information required by law.
16. Changes to this policy
We may update this policy when our services, suppliers or legal obligations change. We will post the revised version with a new effective date and, where changes are material, provide an appropriate notice to affected users or customers.
This Privacy Policy is written in English. Any translation is provided for convenience only; if there is any inconsistency, the English version governs.
17. Contact
Sefki Huseyin trading as Meskora
Suite RA01, 195-197 Wood Street, London E17 3NU
Email: privacy@meskora.com
Website: https://meskora.com