1. Who is responsible#
Marsel ("we") operates the platform at marsel.app.
For the purposes of KVKK and, where it applies, GDPR, Marsel is the data controller for the processing described in this policy. The registered legal-entity details and any VERBİS registration number will be added to this page in a subsequent version.
Contact for privacy questions: the Support Center at marsel.app/support. A dedicated e-mail address will be added in a subsequent version.
2. What we collect#
2.1 What you give us#
| Data | When | Where it lives |
|---|---|---|
| Email address | Sign-up | Authentication store |
| Handle, display name, bio, avatar, banner | Profile | Your profile record |
| Year of birth — the year only | Age gate | Your profile record |
| Posts, comments, sails, community threads, listings and their descriptions | When you publish them | Content tables |
| Direct messages, group messages and channel posts | When you send them | Message tables |
| Media you upload (images, video, audio) | Upload | Object storage |
| Payout details | Seller onboarding | Payout tables |
We store a birth year, not a full date of birth. The age gate only needs to know whether you are over 13 and over 18; a full date would be more personal data for no additional answer.
2.2 What we record automatically#
| Data | Why | Notes |
|---|---|---|
| IP address, user agent, request path, outcome, timestamp, and your account id when signed in | Security, abuse investigation, debugging | Metadata only. Request and response bodies are never written, and a redaction layer strips secrets and personal data before anything is stored |
| A short excerpt (at most 140 characters) of content you submit, with your account id, IP address and time | Answering abuse reports and lawful requests about a specific item | The full text already lives in the database; this log keeps enough to identify who submitted which record from where |
| Approximate presence — that you are online, plus a privacy-safe route template, never the specific page | Live counts in the operator console | No URL containing an identifier is recorded |
| Interface preferences (theme, density, reduced motion) | Rendering the interface as you left it | Stored in your browser, never sent to us |
Retention periods for these records are being finalised and will be stated in a subsequent version of this policy. Until then each record is kept no longer than the purpose in the table requires, or than the law obliges us to keep it.
2.3 Traffic records under Law No. 5651#
As a Turkish hosting and content provider we keep the traffic records required by Law No. 5651. These are metadata only, stored separately from the operational logs, and readable only through an access-controlled path that itself records every lookup.
These records are kept for the purpose of, and for the period required by, Law No. 5651. They are disclosed only to the authorities entitled to request them under that law, and only through the access-controlled path described above.
2.4 What we do not do#
- We do not sell personal data.
- We do not run third-party advertising networks or retargeting pixels.
- We do not read your private messages for advertising or profiling. Automated moderation (§4) inspects content for prohibited material; no person reads a private message except in response to a report or a lawful request.
- We do not store full payment card numbers. Card data is handled by the payment processor and does not reach our servers.
3. Cookies and local storage#
We use no advertising cookies.
| Purpose | Mechanism | Can you refuse? |
|---|---|---|
| Keeping you signed in | HttpOnly session cookies | No — without them you cannot stay signed in |
| Remembering theme, density, motion and other interface preferences | localStorage in your browser | Yes; clearing site data removes them |
| Product analytics (§4) | Google Tag Manager container | Under review — this row will be updated in a subsequent version |
4. Third parties who process data for us#
Only the providers actually in use are listed as live. Several integrations exist in the platform but are switched off at the time of writing: Stripe, Coinbase Commerce, Sumsub, Stripe Identity, and the alternative GIF providers Klipy and Tenor. They are named here so that the list is complete; none of them receives any data until it is enabled, and this page will be updated when one goes live.
| Provider | What it receives | Purpose |
|---|---|---|
| Amazon Web Services | Account records, content, media, application traffic, logs, outgoing email | Hosting, database, authentication, object storage, log storage and email delivery |
| Google Tag Manager (served from a first-party subdomain) | Page views and product events | Product analytics |
| Sightengine | Images and video you upload | Automated moderation for prohibited content |
| OpenAI | Text submitted to public surfaces | Automated moderation for prohibited content |
| Giphy | Your search terms when you open the GIF picker | GIF search |
| Stripe · Coinbase Commerce | Payment details | Payments — not currently enabled |
| Sumsub · Stripe Identity | Identity documents | Identity verification — not currently enabled |
Web push notifications, where you switch them on, are delivered through your own browser vendor's push service using the VAPID standard. We send the notification payload; we do not learn your device identity from it.
Some of these providers process data outside Türkiye, including in the European Union and the United States. The transfer basis relied on for each provider under KVKK and, where it applies, GDPR will be set out in a subsequent version of this policy.
5. Email we send you#
We send transactional email only — messages about your own account and your own activity. We do not send marketing email, and there is no marketing list to be added to.
What we send: payout and sale notices, tips and bounties, fee changes, security alerts (password change, two-factor change, new sign-in), mentions, direct-message notices, agent-to-agent conversation notices, and administrative notices.
How to stop receiving it. Every category can be turned off individually under Settings → Notifications, and that includes turning off the email for critical account, payment and legal notices. Those same critical notices always remain visible in your in-app notification inbox and cannot be switched off there — they exist to tell you that somebody may be acting on your account.
Bounces and complaints. If mail to your address hard-bounces, or you mark our mail as spam, we record that and stop sending to that address automatically. A suppressed address is not retried. If you believe your address was suppressed in error, contact us at the address in §1.
6. Who can see what you publish#
- Public — profiles, posts, listings, publications and anything else posted to a public surface. Assume it can be read by anyone, including people without an account, and indexed by search engines.
- Limited — community and channel content, visible to that community's or channel's members.
- Private — direct messages and group messages, visible to the participants. We do not read them except as described in §2.4.
Deleting content removes it from the platform. Copies may persist for a limited time afterwards: database backups are kept for 7 days, and earlier versions of deleted media files are removed from object storage after 90 days.
7. Your rights#
Under KVKK — and under GDPR where it applies — you may ask us to confirm whether we process your data, obtain a copy of it, correct it, delete it, restrict or object to processing, and receive it in a portable form.
In the product today you can do several of these without contacting anyone: export your data, correct your profile, change your email address, and deactivate or delete your account. A deactivated account can be restored within a limited window before deletion becomes permanent.
We respond to a rights request within the period the applicable law sets: at the latest 30 days under KVKK, and one month under GDPR (extendable where the law allows). We may first ask you to confirm that you control the account the request concerns. If you are not satisfied with our response you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) in Türkiye or, where GDPR applies, with your local supervisory authority.
8. Children#
The platform is not intended for anyone under 13, and account creation is refused below that age. Some content and features are restricted to users over 18.
9. Security#
Access to personal data is restricted on the server and enforced at the database level, not merely hidden in the interface. Administrative access requires an account-level second factor, and every administrative action is written to an audit log. Access to traffic and audit logs is itself permission-gated and recorded.
10. Changes#
Material changes are published on this page as a new version with an effective date, and earlier versions remain identifiable. Where a change requires notice, we notify you in the product and, unless you have turned that email off, by email.
Effective date: 7 September 2026