Privacy Policy

1. Who we are

The data controller is Squamobi Teknoloji Anonim Şirketi, İnciraltı Mah. Mithatpaşa Cad. Morfoloji No: 56-20 İç Kapı No: Z, Balçova / İzmir, Türkiye (Balçova Tax Office). In this policy “Game Lasso”, “we” and “us” mean Squamobi Teknoloji A.Ş.

For any privacy question or request, contact us at privacy@gamelasso.gg.

2. Data we collect

Account data. Your name, email address, password (stored only as a secure hash), account type (studio or creator), country, content language or languages and, for studios, company and billing details. By creating an account you confirm that you are 18 or older; we do not ask for or store your date of birth. If you sign up with Google or Discord, we receive your name, email address and account ID from that provider.

Security and session data. Session identifiers, IP address, browser and device information, sign-in times, two-factor authentication settings (the secret is stored encrypted) and a log of important account actions.

Connected account data (creators). When you connect a TikTok, Instagram or YouTube account with the platform's official login (OAuth), we receive and store:

• access and refresh tokens, stored encrypted;
• the platform's permanent user or channel ID, username, display name, avatar, profile link and, where available, bio and verification status;
• account statistics such as follower, following, like, subscriber and video counts;
• your public videos or media and their metadata (ID, link, caption or description, hashtags, publish time) and statistics (views, likes, comments, shares).

Public video pages. For videos you submit to a campaign, we may also read the public view counter from the video's public page. This lets us keep counting views if an API is temporarily unavailable.

Campaign and payment data. Campaigns you create or join, the videos you submit, review decisions, measured views, earnings, payouts and invoices. Card and bank details are entered directly with our payment provider, Stripe; we only receive limited information such as the card brand, the last four digits and the payout account status.

Communications. Messages you send us, such as support requests and data protection requests.

Website visits. Our hosting provider keeps standard server logs (IP address, browser, requested page and time) for security and troubleshooting. We do not use analytics or advertising cookies on this website.

3. How we use data and our legal bases

We process personal data only for these purposes and on these legal bases (GDPR Article 6(1) and KVKK Article 5(2)):

• Providing the platform (performance of a contract): creating and securing your account, reviewing applications and campaigns, verifying that submitted videos come from your own connected account, measuring views, calculating earnings, paying creators and charging studios.
• Legal obligations: keeping accounting, tax and invoice records and answering lawful requests from authorities.
• Legitimate interests: keeping the platform secure, preventing fraud and artificially inflated views, enforcing our Terms, and improving the service. Fraud signals are reviewed by people; we do not make decisions with legal or similarly significant effects about you solely by automated means.
• Consent: where the law requires it, for example if we ever add non-essential cookies. You can withdraw consent at any time.

4. Data from TikTok, Instagram and YouTube

Our access to connected accounts is read-only. We never post, edit or delete content, never comment or send messages, and never read private messages. We use connected account data only for the purposes described in this policy; we do not sell it, use it for advertising or share it with data brokers.

Studios see the information they need to run their campaigns: the handle and public profile of creators who join, the videos submitted to their campaign and those videos' statistics. Studios may use creator data only for that campaign and may not export or reuse it.

YouTube. Game Lasso uses YouTube API Services. By connecting a YouTube account you agree to be bound by the YouTube Terms of Service. Google's processing of your data is described in the Google Privacy Policy. You can revoke Game Lasso's access at any time on the Google security settings page, in addition to disconnecting the account in Game Lasso. We refresh stored YouTube API data regularly while your account is connected and do not keep YouTube API data other than statistics for more than 30 days without refreshing or deleting it.

Google user data. Game Lasso's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok. We use TikTok Login Kit and the TikTok Display API. Your use of TikTok is governed by the TikTok Terms of Service and TikTok Privacy Policy. You can remove our access in the TikTok app's security and permissions settings, under apps and services connected to your account.

Instagram. We use the Instagram API with Instagram Login, which works with professional (Business or Creator) accounts. Your use of Instagram is governed by the Instagram Terms of Use and the Meta Privacy Policy. You can remove our access in Instagram under Settings, Website permissions, Apps and websites.

When you disconnect or revoke access. If you disconnect an account in Game Lasso, we revoke and delete its tokens immediately and delete the data we received from that platform within 7 days. If you revoke access from the platform instead, we delete that data within 30 days at the latest. We keep the identifier the platform gives your account (not your profile details), so that the same account cannot be claimed by another creator and past earnings stay attributable to it. We keep the records needed for payments and accounting (the campaign, the video link, the measured views and the earnings) as described under “How long we keep data”. If a campaign you joined is still running, we may continue reading the public view counter of videos you already submitted until the campaign's tracking period ends, so that you can be paid; tell us if you want this stopped, in which case those videos stop earning.

5. Who we share data with

We share personal data only with:

• Studios, as described in the previous section;
• Service providers that process data on our behalf under contract: cloud hosting and databases (Amazon Web Services and our managed database provider, both in Frankfurt, Germany), DNS and email routing (Cloudflare), email delivery, and payments (Stripe);
• Platforms (TikTok, Meta, Google), when we call their APIs with the access you granted;
• Authorities, courts and advisers, when required by law or to establish, exercise or defend legal claims;
• A successor, if Game Lasso is merged, acquired or sold, under the same protections.

We do not sell personal data.

6. Where data is stored and international transfers

Our platform data is stored with Amazon Web Services in the Frankfurt (eu-central-1) region in the European Union. Our team operates from Türkiye. Some providers, such as Stripe, Cloudflare and the social media platforms, process data in other countries, including the United States.

Where personal data is transferred outside Türkiye or the European Economic Area, we rely on adequacy decisions where available or on appropriate safeguards such as standard contractual clauses, as required by KVKK Article 9 and Chapter V of the GDPR.

7. How long we keep data

• Account data: while your account is open. After you close your account we delete or anonymize it within 30 days, except for the records below.
• Connected account tokens: deleted immediately when you disconnect the account.
• Data received from platforms: refreshed regularly while connected; deleted within 7 days of disconnecting in Game Lasso or 30 days of revoking access on the platform.
• Platform account identifier: kept after you disconnect an account, for ownership and payment records; deleted when you close your Game Lasso account or when the platform sends us a data deletion request for that account.
• Payment, earnings and invoice records: 10 years, as required by Turkish commercial and tax law.
• Security logs and the audit log: 2 years.
• Website server logs: up to 90 days.
• Support and data protection correspondence: 2 years after the request is closed.

Data is kept longer only if the law requires it or it is needed for an ongoing legal claim.

8. Cookies and local storage

This public website does not set any cookies and does not use analytics, advertising or tracking tools.

When you sign in to the platform we use one strictly necessary session cookie to keep you signed in and protect your account. It is marked HttpOnly and Secure and is removed when you sign out or the session expires. Strictly necessary cookies do not require consent. If we ever add other cookies, we will update this policy and ask for your consent where required.

If you sign in with Google, we also set a short-lived security cookie (up to 10 minutes) that checks the sign-in was started in your browser, and your browser keeps a note of the page you started from for that tab only. Both are strictly necessary, and the note is deleted when you close the tab.

The platform also remembers a few display choices in your browser's local storage: light or dark theme and how your games list is shown. They are saved only when you pick an option, stay on your device and are never sent to us. Clearing your browser's site data removes them.

9. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time.

Under KVKK Article 11 you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties to whom it is transferred in Türkiye or abroad; to request its correction if it is incomplete or inaccurate; to request its deletion or destruction under KVKK Article 7 and the notification of these actions to third parties to whom it was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage from unlawful processing.

To exercise your rights, email privacy@gamelasso.gg from the address registered to your account, or use the settings in your account. We may ask you to verify your identity. We answer within 30 days at the latest. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, if you are in the European Economic Area, to your local data protection authority.

To delete your data or a connected account, see our data deletion instructions.

10. Security

We use encryption in transit (HTTPS), encrypt secrets such as access tokens and two-factor keys at rest, require two-factor authentication for studio and staff accounts, limit staff access to what each role needs and log important actions. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

11. Age limit

Game Lasso is only for people aged 18 or older. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version. If we make significant changes, we will notify account holders by email or in the platform before they take effect.

13. Contact

Squamobi Teknoloji Anonim Şirketi, İnciraltı Mah. Mithatpaşa Cad. Morfoloji No: 56-20 İç Kapı No: Z, Balçova / İzmir, Türkiye. Email: privacy@gamelasso.gg.