Privacy

This page says what bymse.design and By MSE 360 Studio keep, where, for how long, on what legal basis, and who else is involved. In short: no advertising, nothing is sold, and analytics cookies are used only if you allow them.

COOKIE BANNER AND YOUR CHOICE

Every visitor sees the same banner with three equal buttons: “Accept all”, “Reject all” and “Settings”. Closing it counts as “Reject all”; scrolling or using the page is never taken as consent, and every part of the site works whatever you choose. Under “Settings” there are two categories at present: Necessary (always on: the security check by Cloudflare Turnstile, your language, the record of this choice and, once payments open, payment through Polar) and Cookieless statistics (on unless you switch it off). Google Analytics and Microsoft Clarity are not offered at present, see below; if they are offered later, each has its own switch, off unless you switch it on. If your browser sends the Global Privacy Control signal before you have chosen, “Reject all” is applied; you can still change it under “Settings”. You can change your choice at any time with “Cookie settings” at the bottom of every page; the site asks again after 6 months. Visitors from Russia and China are not offered Google Analytics or Microsoft Clarity, and these are never loaded for them.

WHO IS RESPONSIBLE

The data controller is By MSE (bymse.design). For any question about your data, write to destek@bymse.design.

LEGAL BASIS

Each part below names the legal basis of what it keeps: the contract, when the data is needed to give you the service you ask for (GDPR Art. 6(1)(b); Turkish Personal Data Protection Law No. 6698, KVKK, Art. 5(2)(c)); a legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)); our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)), to which you can object (GDPR Art. 21); the vital interests of other people (GDPR Art. 6(1)(d)); or your consent, which you can withdraw at any time (GDPR Art. 6(1)(a); KVKK Art. 5(1)).

HOSTING

The site and the Studio are served by Cloudflare (a Cloudflare Worker); Firebase Hosting, a Google service, is kept only as a fallback. As with any web server, the host receives your IP address and the details of each request to deliver the pages and keep the service secure. The typefaces offered in Settings are served from this site.

Legal basis: our legitimate interest in delivering the site and keeping it secure.

VISITS COUNTED WITHOUT COOKIES

Cloudflare Web Analytics counts page views on this site. It sets no cookie and does not identify you. It is on unless you switch off “Cookieless statistics” in the cookie settings or choose “Reject all”; from the next page load it is not loaded.

Legal basis: our legitimate interest in knowing how much the site is used, to which you can object with the switch above.

GOOGLE ANALYTICS, ONLY IF YOU ALLOW IT

At present Google Analytics is not offered and nothing of it is loaded; the banner shows only “Necessary” and “Cookieless statistics”. If it is offered later, this page says so first, and it stays off until you turn it on with “Accept all” or with its switch under “Settings”; nothing of it is loaded before.

• Service: Google Analytics 4, provided by Google.
• What it records: the views and windows you open, a few actions (entering the site, pressing a button or a link, changing the language or a setting, opening the assistant or the survey) and general device, browser and approximate location information. The text you type is never sent.
• Cookies: Google Analytics sets its own cookies (_ga and _ga_…) after you allow it. Advertising storage, advertising signals and Google signals are switched off.
• Where: Google processes this data on its own servers, which may be outside your country. See Google's privacy policy.
• Legal basis: your consent, given with “Accept all” or the Google Analytics switch.

MICROSOFT CLARITY, ONLY IF YOU ALLOW IT

At present Microsoft Clarity is not offered and nothing of it is loaded. If it is offered later, this page says so first; it has its own switch and is off until you turn it on with “Accept all” or under “Settings”; nothing of it is loaded before. While a form is open on the page (the survey, the feedback form, the assistant), Clarity records nothing. If you later switch it off, Clarity is told that analytics is no longer allowed and stops recording at once, its cookies on this site are deleted, and from the next page load it is not loaded at all.

• Service: Microsoft Clarity, provided by Microsoft.
• Why: only to see how the site is used and to fix it; never for advertising.
• What it records: how the pages are used: clicks, scrolling, mouse movement and the page layout, from which it makes heat maps and replays of visits, and general device and browser information. It runs with strict masking: the page's text and everything you type are hidden in your browser before anything is sent, and the assistant, the settings and the survey are masked as a whole.
• Cookies: after you allow it, Clarity sets its first-party cookies on this site (_clck and _clsk) and may set third-party cookies on its own domain (clarity.ms): CLID, MUID, SM, MR and ANONCHK. Clarity is told that advertising storage is not allowed, and the site blocks its call to Microsoft's advertising domain (c.bing.com).
• How long: Microsoft keeps the playback data of recordings for 30 days; recordings marked as favourites or labelled, heat maps and click data for 9 months.
• Where: Microsoft processes this data on its own servers, which may be outside your country. See Microsoft's privacy statement.
• Legal basis: your consent, given with “Accept all” or the Microsoft Clarity switch.

WHAT STAYS ON YOUR DEVICE

Your settings (tone, light colour and strength, typeface, text size, sound, motion, language) are kept in your browser's local storage under bymse.site.settings and bymse.settings, and your cookie choice with its date under bymse.consent.v2. They are not sent anywhere. “Reset” in Settings, or deleting the site's data in your browser, removes them.

Legal basis: they are stored only to keep the choices you make, and only on your device.

THE ASSISTANT

What you type to the assistant is sent, with at most your last three questions and answers, to Cloudflare Workers AI to write the answer; the assistant answers only from the site's own texts. The server keeps no conversation.

• A question it cannot answer is kept with its language, topic and time, without your IP address or e-mail, so the site's texts can be improved; it is deleted after 12 months.
• A message you leave is kept with the e-mail address you type (if you type one), its language, a one-way hash of your IP address and the time. It is e-mailed to destek@bymse.design through Resend, with your address as the reply address; it is deleted after 12 months.
• Counts of what happens each day (for example how many questions were asked) are kept with no text and no IP address, for 12 months.
• Legal basis: answering your question and passing on your message are the service you ask for (contract); keeping unanswered questions and the counts is our legitimate interest in improving the site's texts.

THE SURVEY

The survey is optional. Its answers (your choices and the optional note of up to 500 characters), the language and the time are kept without your IP address or e-mail, and deleted after 12 months. To stop misuse, a one-way hash of your IP address is kept for at most a day.

Legal basis: your consent, given by sending the answers; for the hash of your IP address, our legitimate interest in stopping misuse.

EARLY ACCESS, ACCESS CODES AND STUDIO ACCOUNTS

• Age: Studio accounts are for people aged 18 or over. If you are younger, do not send an early-access request or open an account.
• Early-access request: the form is on the Studio's early-access page and, for a signed-in account that is not approved yet, on the Studio's waiting screen. It keeps your name, e-mail, note, language, a keyed one-way hash of your IP address, the time and the state of the request. One e-mail about it goes to destek@bymse.design through Resend. A person approves each request by hand. A request that is declined, or that leads to no account, is deleted 12 months after it was sent; an approved request is kept while its account exists, and is deleted with the next daily run after the account is deleted, once 12 months have passed since it was sent.
• Trial: when the early-access trial is open (the early-access form says so), only an approved request gives a free 7-day Pro trial, once per e-mail address and browser (forms of an address with dots or a + tag count as the same address); no card is asked. When it ends, the account moves to the Free plan; nothing is charged and nothing is deleted. Its start and end times are kept with your account.
• Access code: only a one-way hash of the code is stored (never the code), with its note, expiry, and when and by which account it was used. A used or ended code is deleted after 12 months.
• Account: your e-mail address, language, plan and the day the account was opened. There is no password: you sign in with an eight-digit code or a link sent to your e-mail, valid for 10 minutes and usable once. Signing in sets a session cookie __Host-sid for 30 days; one account stays signed in on at most 2 browsers. A cookie __Host-dev (400 days) remembers that an account was opened in this browser; a second account opened from the same browser is suspended, and the reason is given by e-mail and at sign-in. At sign-up only a one-way hash of your IP address is kept.
• Only if you add it: your name, company, profession, logo or photo, country and place on the map. Location and device data inside your pictures (EXIF, GPS) are removed before upload. Your location is never taken any other way.
• Support access: only if you open it in your profile, the administrator can look at your account for 24 hours, read only (nothing can be changed); you can close it at any time.
• Two separate consents, off until you turn them on in your profile: news e-mails, and a record of how you use the Studio (kept for 90 days, deleted when you turn it off). Without them your account works the same.
• Tours and uploads are stored in Cloudflare R2, and account data in Cloudflare D1, both in Western Europe. A tour stays until you delete it or your account is deleted.
• Reports about a tour: a report made with “Report” is kept, with a one-way hash of the reporter's IP address, as long as the tour exists, and is deleted with the tour.
• Help requests: what you send with the Studio's help button (your message, the error the page showed, the page and, only if you tick it, a screenshot) is kept until your account is deleted.
• Your copy and deletion: you can download a copy of your data and delete your account in your profile. Deleting removes your tours, files, help requests, sessions and sign-in data together, and a confirmation e-mail is sent. These stay after deletion, for the times written on this page: the sign-in record, the child abuse record, the trace after deletion, your early-access request (deleted 12 months after you sent it), feedback you sent (no longer linked to you) and the log of suspensions and bans (no longer linked to you).
• Legal basis: the contract, for the early-access request (a step you ask for before an account is opened), the trial, access codes, the account, your tours, help requests, your copy and deletion; your consent, for the details you add to your profile, news e-mails and the record of how you use the Studio; our legitimate interest in keeping unlawful content off the Studio, for reports about a tour.

PLANS, PAYMENTS AND PROTECTION AGAINST ABUSE

• One inbox, one account: your e-mail address is also kept in a plain form (lower case, without a "+" tag and, for Gmail, without dots), so that no second account is opened for the same inbox. Addresses of temporary e-mail services cannot open an account.
• Uploads and projects: how many tours your account has made and how many panoramas it has uploaded are kept, for the limits of the free plan.
• Plan record: every change of your plan (time, plan before and after, its source: trial, payment, refund or admin) is kept for 24 months.
• Feedback and robot checks: feedback you send (its kind, text, the page, language, time, and your account if you are signed in) is kept for 12 months. Robot checks on the sign-in and early-access forms are done by Cloudflare Turnstile.
• Payments (when they open): Polar takes the payment and keeps your card details; this site never sees them. Of Polar's notices only their id, type and time are kept (not their content) for 24 months, and with your account your customer id at Polar, the end date of a cancelled subscription, the time of your last payment and how many refunds or card disputes there were.
• Sign-in record: the time of each sign-in, a one-way hash of your IP address and a hash of the browser's device cookie are kept for 1 year, also after you delete your account (the traffic-data rule of Turkish Law No. 5651).
• Trace after deletion: when you delete your account, only these are kept for 24 months under a keyed one-way hash of your e-mail address and of your devices: the uploads and projects used, whether the trial was used, the number and last time of refunds, and whether the account was banned. They keep a deleted and reopened account from starting the limits or a ban again.
• Suspension and ban: an account can be suspended automatically (a second account in the same browser; a new account from the device or address of an account that a refund or card dispute dropped to the free plan in the last 30 days) or banned automatically (when the device or address of a banned account comes back). The administrator can also suspend or ban an account by hand. Every such action (time, account, reason, source) is kept for 24 months. You are told the reason by e-mail and at sign-in. You can object to an automatic decision (Turkish Data Protection Law, Art. 11(1)(g); for people in the EU and UK, GDPR Art. 22(3): you can ask for a person to decide, give your view and contest the decision): write to destek@bymse.design; a person looks at it, and if you are right the suspension or ban is lifted without delay.
• Child sexual abuse: a single report of child sexual abuse takes the tour offline at once (its page and data stop answering and the cache is cleared); its files are then moved, within hours, to a place no address points to, and kept, not published, until a person has reviewed the report, and its owner's account is suspended for review. If the review confirms the report, the files are deleted and the case is reported to the competent authorities (in Türkiye the İnternet Bilgi İhbar Merkezi, ihbarweb.org.tr); if the report proves wrong, the tour comes back online and the account is reopened. A match reported by Cloudflare's CSAM scanning makes us delete the files as soon as it is received, suspends the owner's account for review, and the case is reported to the competent authorities in the same way. In every case a record for the authorities (the tour, its owner's account id and e-mail, the file path and the time) is kept for 24 months, also after the account is deleted; it holds no image.
• Legal basis: the contract, for the plan record, the uploads and projects used, feedback and payments; our legitimate interest in preventing fraud and abuse, which you can object to (GDPR Art. 21), for the plain form of your address, the trace after deletion, the robot checks, suspensions and bans and their log; a legal obligation, for the sign-in record (Turkish Law No. 5651); a legal obligation and the vital interests of children, for the child abuse record.

E-MAIL

Sign-in codes, notices and the messages left with the assistant are sent through Resend. Mail to destek@bymse.design is forwarded by ImprovMX to the support mailbox at Google. When you write to us, your address and message are used only to answer you; they are kept there as long as they are needed to answer you and to keep a record of the answer.

Legal basis: the contract, for sign-in codes and notices about your account; our legitimate interest in answering you, for mail you send us.

CONTENT FROM OTHER SERVICES, LOADED ONLY WHEN YOU OPEN IT

• 360° tours open inside the page but are served by Panoee (tour.panoee.net). When you open one, your browser connects to Panoee, which handles that connection under its own policy.
• The support link opens Buy Me a Coffee in a new tab; this site loads nothing from it before you press it. If you choose to support the projects, your payment details are entered on its page and processed by it and its payment provider; this site never sees them. See its privacy policy.
• Links to Instagram, YouTube, LinkedIn, ArtStation and Pinterest open those sites, which have their own policies. The links carry two tags (utm_source and utm_medium) that only say the visit came from this site.

DATA SENT ABROAD

These providers work outside Türkiye, in the USA. When you use the parts of the site below, your data is transferred to them for that purpose only:

• Cloudflare, Inc. (USA): hosting of the site and the Studio, the security check (Turnstile), the cookieless statistics and the assistant's answers (Workers AI).
• Resend (Plus Five Five, Inc.; data processed in the USA): sending our e-mails, such as sign-in codes.
• ImprovMX Incorporated (USA): forwarding mail sent to destek@bymse.design.
• Polar Software, Inc. (USA): payments, once payments open.
• Panoee Corp (USA): the 360° tours shown from tour.panoee.net, when you open one.
• Publisherr Inc (Buy Me a Coffee, USA): support payments, when you choose to support.
• Google LLC (USA): the support mailbox that receives mail sent to destek@bymse.design and the Firebase Hosting fallback; and, only if they are offered later and you allow them, Google Analytics, together with Microsoft Corporation (USA) for Microsoft Clarity.

WHO SEES IT

The By MSE administrator can see accounts, tours, requests, messages and survey answers to give support and prevent abuse, and can close an account or a tour when needed. Your data is not sold or shared with anyone for advertising. If the law requires us to give it to an authority, only what is required is given.

YOUR RIGHTS

You can ask what is kept about you and get a copy; have it corrected or deleted; have its processing restricted (GDPR Art. 18); receive the data you gave us in a common, machine-readable form and, where technically possible, have it sent to another controller (GDPR Art. 20); object to processing based on our legitimate interest (GDPR Art. 21); withdraw a consent at any time; and ask for compensation if unlawful processing causes you damage (KVKK Art. 11(1)(ğ)). Write to destek@bymse.design; you get an answer within 30 days. You can also complain to the data protection authority of your country; in Türkiye this is the Personal Data Protection Authority (KVKK).

Is giving data required? An e-mail address is required to open an account, because sign-in codes and links are sent to it; without one no account can be opened. Everything else you give (your name and note, profile details, survey answers, messages, feedback, consents) is optional.

ACCURACY

The site, the Studio and everything written on them may contain technical, typographical or other errors, and may be incomplete or out of date. By MSE does not warrant that they are accurate, complete or current, and may change them at any time without notice. If you spot a mistake, write to destek@bymse.design so it can be fixed.

CHANGES

When what the site or the Studio does changes, this page changes with it; the date at the top shows the last change. Account holders are told about an important change by e-mail.