Global Privacy Policy & Data Protection Notice

1.1. Principal Covenant and Operational Scope: This Global Privacy Policy explains how your personal data is collected, used, stored, and protected across mistikist.com, app.mistikist.com, the Mistikist iOS and Android apps, and the Mistikist Microsoft Teams app.

1.2. Principal Covenant and Operational Scope: In accordance with Article 26 of the EU/UK General Data Protection Regulation (GDPR) and Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK), the following two affiliated corporate entities act as Joint Data Controllers:

1.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

1.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• UK & International Data Controller: Mistikist LTD ("Mistikist UK") · Company No. 15705777 · Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom · Email: [email protected] / [email protected]
• Türkiye Data Controller & R&D Operator: Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. ("Shellix Bilişim A.Ş.") · MERSİS No. 0769152927300001 · Registered Office: Kötekli Mahallesi Denizli Yolu Bulvarı No:4B/23 Menteşe / MUĞLA, Türkiye · Email: [email protected]
• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).

2.1. Principal Covenant and Operational Scope: We strictly adhere to the principle of data minimization and collect only the categories of data required to deliver and secure your experience:

2.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

2.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

2.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Account & Identity Data: Full name, email address, preferred language (across 16 supported languages), timezone, and unique user identifier (Firebase UID).
• Billing, Subscription & Corporate Tax Data: Selected plan, license seat count, billing status, and—when a corporate invoice is requested—company legal name, tax/VAT ID, tax office, and billing address. (Note: Full payment card numbers and CVV codes are never stored on Mistikist servers; they are tokenized directly by Stripe, Apple, or Google).
• In-App Session & Progress Data: Completed 21-day journey steps, session streaks, favorite frequencies, gratitude journal entries, and Mistikist AI session preferences.
• User Own-Voice Recordings (Optional): Audio affirmations recorded by you when you explicitly grant microphone permission in the Own-Voice Affirmation Studio.
• Wellness & HRV Biofeedback Metrics (Optional): Numerical heart rate, Heart Rate Variability (HRV), and stress index scores generated when you run a camera rPPG scan or connect Apple HealthKit / Google Health Connect.
• Technical, Device & Security Telemetry: IP-derived country/region code, device model, OS version, crash reports, and authentication tokens.

3.1. Principal Covenant and Operational Scope: Your personal voice and physiological rhythm are deeply private. Voice recordings created in the Own-Voice Affirmation Studio are encrypted at rest (AES-256) and in transit (TLS 1.3), isolated to your personal account, and are never sold, rented, or used to train third-party voice-cloning or advertising models.

3.2. Principal Covenant and Operational Scope: When you use the camera-based rPPG Stress & HRV scan, optical pulse signal extraction is performed in real time on your device. Raw camera video frames or facial photographs are never recorded, stored, or transmitted to our servers; only the resulting numerical HRV and wellness scores are saved to your personal progress history.

3.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

3.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

4.1. Principal Covenant and Operational Scope: We process your personal data only where we have a valid legal basis under applicable data protection law:

4.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

4.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

4.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Performance of a Contract (GDPR Art. 6(1)(b) / KVKK Art. 5/2-c): Creating and authenticating your account, synchronizing your 21-day journeys across devices, and fulfilling individual or B2B subscriptions.
• Compliance with Legal Obligations (GDPR Art. 6(1)(c) / KVKK Art. 5/2-ç): Issuing statutory tax/VAT invoices, maintaining accounting records, and responding to lawful requests from regulatory authorities.
• Legitimate Interests (GDPR Art. 6(1)(f) / KVKK Art. 5/2-f): Protecting network security via Cloudflare WAF/DDoS mitigation, preventing payment fraud, and fixing software crashes.
• Explicit Consent (GDPR Art. 6(1)(a) & Art. 9(2)(a) / KVKK Art. 5/1 & Art. 6/3-a): Processing optional own-voice recordings, camera rPPG/HRV wellness metrics, marketing communications, and non-essential analytics/advertising cookies.

5.1. Principal Covenant and Operational Scope: If you choose to link Mistikist with Apple Health (HealthKit) or Google Health Connect, Mistikist only reads or writes the specific wellness data types you authorize (such as Mindful Minutes, Heart Rate, and HRV).

5.2. Principal Covenant and Operational Scope: In strict compliance with Apple App Store and Google Play Store policies: data obtained through HealthKit or Health Connect is never transferred to advertising platforms, data brokers, or information resellers, and is never used for marketing or creditworthiness profiling.

5.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

5.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

6.1. Principal Covenant and Operational Scope: We do not sell your personal data. We share data only with vetted infrastructure sub-processors bound by strict Data Processing Agreements (DPAs):

6.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

6.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

6.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Google Cloud Platform & Firebase (Google Ireland Ltd. / Google LLC): Authentication, encrypted Firestore database, cloud storage, and Crashlytics.
• Stripe Payments Europe Ltd. / Stripe, Inc.: PCI-DSS Level 1 payment processing and fraud prevention.
• Apple Inc. & Google LLC: In-app subscription validation and store billing.
• Microsoft Corporation (Microsoft Azure): Enterprise AI session assistant (Azure OpenAI with zero third-party training retention), neural TTS (Azure Speech), transactional email (Azure Communication Services), and Microsoft Teams integration.
• Cloudflare, Inc.: Edge CDN, TLS encryption, DDoS protection, and privacy-preserving country detection.

7.1. Principal Covenant and Operational Scope: Because Mistikist operates globally between the United Kingdom, the European Union, Türkiye, and the United States, cross-border transfers are protected by legally recognized mechanisms: the European Commission Standard Contractual Clauses (Decision 2021/914 — EU SCCs), the UK International Data Transfer Agreement (UK IDTA), the EU-US / UK-US Data Privacy Framework (DPF), and Turkish KVKK Article 9 Standard Contracts.

7.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

7.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

7.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

8.1. Principal Covenant and Operational Scope: We retain personal data only as long as necessary to fulfill the purposes outlined in this Policy or comply with statutory retention laws:

8.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

8.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

8.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Active Account & Session Progress Data: Retained while your account remains active; permanently deleted within 30 days of account deletion.
• Own-Voice Recordings & HRV Wellness Scores: Deleted immediately when removed in-app, or within 7 days of account deletion.
• Tax, Invoice & Accounting Records: Retained for 6 years in the United Kingdom (HMRC) and 10 years in Türkiye (Tax Procedure Law No. 213).
• Security & Access Logs: Retained for up to 24 months for cybersecurity and statutory compliance.

9.1. Principal Covenant and Operational Scope: All network communications are encrypted using TLS 1.3, and all databases and voice storage buckets are encrypted at rest using AES-256. Access to production systems is restricted via Role-Based Access Control (RBAC), hardware Multi-Factor Authentication (MFA), and continuous audit logging.

9.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

9.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

9.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

10.1. Principal Covenant and Operational Scope: Mistikist is intended for users aged 18 and older. We do not knowingly collect personal data from children under 16 (or under 13 under US COPPA). If we learn that a child’s personal data has been collected without verified parental consent, we will delete the account and associated data immediately.

10.2. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

10.3. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

10.4. Notices, Escalation, and Statutory Redress Channels: Any formal inquiry, compliance notice, data subject request, or dispute relating to this Section may be submitted in writing to [email protected], [email protected], or [email protected] (and [email protected] for Türkiye). All verified submissions are logged under a unique reference identifier and resolved free of charge within the applicable statutory deadline (one (1) month under EU/UK GDPR Article 12(3), 30 days under KVKK Article 13, and 30–45 days under CCPA/CPRA).

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.

11.1. Principal Covenant and Operational Scope: Depending on your jurisdiction (EU GDPR, UK GDPR, Turkish KVKK, US CCPA/CPRA, Brazil LGPD, Canada PIPEDA), you have the right to access, rectify, erase ("right to be forgotten"), restrict, or export (portability) your personal data, object to processing, and withdraw consent at any time.

11.2. Principal Covenant and Operational Scope: You can delete your account or manage permissions directly inside the app ("Profile -> Privacy & Data") or by emailing [email protected], [email protected], or [email protected]. All verified requests are fulfilled free of charge within 30 days.

11.3. Statutory Basis, Regulatory Hierarchy, and Rules of Construction: The interpretation, performance, and enforcement of this Section shall be governed strictly in accordance with applicable mandatory statutory frameworks, including Regulation (EU) 2016/679 (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), the UK Consumer Rights Act 2015, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), and—for users domiciled in the Republic of Türkiye—Personal Data Protection Law No. 6698 (KVKK) and Consumer Protection Law No. 6502 (TKHK). Nothing in this Section shall be construed to limit, waive, or derogate from any non-waivable statutory right or remedy afforded to consumers or data subjects under the mandatory laws of their habitual residence.

11.4. Technical Enforcement, Auditability, and Evidentiary Integrity: Mistikist LTD (registered in England and Wales under Company No. 15705777, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) and Shellix Smart Solutions Bilişim Teknolojileri Yazılım İthalat ve İhracat A.Ş. (MERSİS No. 0769152927300001, Muğla, Türkiye) maintain cryptographic audit logs, timestamped consent ledgers, and role-based access controls across iOS, Android, Web (app.mistikist.com / mistikist.com), and Microsoft Teams environments. Both parties acknowledge that server-side cryptographic timestamps, authenticated session records, and payment processor receipts (Stripe, Apple App Store, Google Play Store) constitute prima facie, verifiable evidence of transaction and consent state.

• Cross-Platform Applicability: Binding across Mistikist iOS, Android, Web Application (app.mistikist.com), Corporate Web (mistikist.com), and Microsoft Teams integrations.
• Joint Corporate Accountability: Administered jointly by Mistikist LTD (UK Company No. 15705777) and Shellix Bilişim A.Ş. (Türkiye MERSİS 0769152927300001).
• Cryptographic & Privacy Safeguards: Enforced via TLS 1.3 in transit, AES-256 encryption at rest, strict tenant isolation, and zero third-party ad-network data brokerage.
• Statutory Redress & DPO Escalation: Formal requests are processed via [email protected], [email protected], and [email protected] within statutory timelines.