This page explains what personal data subverselab.com collects, why, who else handles it, and what you can ask us to do with it. It is written to match what the site actually does.
Who is responsible
The data controller (KVKK) and controller (GDPR) is Şenol Şahan, trading as SubverseLab, Gaziantep, Türkiye. Contact for everything on this page: info@subverselab.com.
What we collect, and why
You can read the site, the guides and the plugin pages without an account. We collect personal data only in the situations below.
Account. When you sign in you create a Firebase Authentication account (Google Firebase) with an e-mail address and a password, or you continue with Google. With a password sign-up we hold your e-mail address and a password hash managed by Firebase; we never see your password. With Google sign-in we receive your e-mail address, name and profile picture from Google. We use this to identify you, to send the verification and password-reset e-mails, and to tie licences and downloads to one person.
Free launch downloads. When you download Kubbe or Kaset from the Download Room we record your account ID and e-mail address, the licence key issued to you, the product, the time, and how many times you downloaded each plugin for each platform (first and last time). If you activate a licence from a plugin, we also store the instance name your plugin sends. We use this to count each producer once while the first 1,000 last, to give you your key again, and to show how many are left.
Paid orders. Payment is handled by Lemon Squeezy, not by us (see below). Through their webhook we receive and store your order e-mail address, the order ID and number, the product and variant, the order status and date, whether it was refunded, a link to your receipt, and the licence key and its activation count. The checkout link we send you to carries your e-mail address and your account ID, so the order can be attached to the account that clicked Buy. We never see your card number or other payment details.
Tester applications. If you apply to the tester programme we store your e-mail address and account ID, your operating system and version, the DAWs and plugin formats you use, how many years you have been producing, an optional link you give us, your written answer, and the decision. Approved testers can send bug reports; each report stores your e-mail address, the plugin, operating system, DAW and version, the kind of report, and your text.
Problem reports. The report forms on the Download Room and on the storefront store the affected product, your operating system, the e-mail address you type (or "Anonymous" if you leave it empty), and your description. The Download Room form also stores your account ID if you are signed in, your browser's user-agent string (the first 300 characters), the page you were on, the step, the DAW you name and the last download message shown to you. You can send these without signing in.
Forum. If you post a topic or a reply we store the text, your account ID and a display name. The display name is your profile name or, if you have none, the part of your e-mail address before the @ sign. Topics and replies are public.
Server logs. Our web server runs on Google Cloud Run in Belgium (europe-west1). Google Cloud Logging records each request with the time, the URL, your IP address and your browser's user-agent string. Cloud Logging keeps these for 30 days by default.
Usage statistics, only if you accept. Google Analytics 4 (through Firebase) is switched off until you press "Accept analytics" in the banner at the bottom of the page; before that nothing from it is loaded or stored. If you accept, it measures visits and pages using identifiers stored in your browser, and reports to us in aggregate. It records your approximate location (country, region and city, worked out from your IP address; Google Analytics does not store the IP address itself) and device data (device type, operating system, browser and screen size). Google signals is off, so there are no advertising features, no ad personalisation and no cross-device tracking. We use it to see which pages are read. You can decline, or change your mind at any time with "Cookie settings" in the footer; declining stops collection and removes the Google Analytics cookies.
Cookies and browser storage
The site stores the following in your browser:
Firebase Authentication keeps you signed in using the browser's local storage.
Your light or dark theme choice, if you made one (local storage).
An unsent forum topic draft, so you do not lose it (local storage; removed once the topic is published).
A flag in session storage that a checkout was opened in this tab, so the Download Room knows to wait for your order.
Your cookie choice, "granted" or "denied" (local storage), so the banner does not ask again.
Google Analytics identifiers (cookies or local storage, set by Google), only after you accept analytics.
We do not use advertising cookies, ad pixels or ad networks, and the site loads no advertising scripts. You can clear or block any of the above in your browser; declining or blocking Google Analytics does not affect how the site works.
Who else handles your data
We do not sell your data, rent it out or share it for advertising. The following providers process data for us or are loaded by the site:
Google (Firebase Authentication, Firestore database, Cloud Run hosting, Cloud Logging, Cloud Storage for the installers, Google Analytics, Google Fonts). Google Fonts serves the site's typefaces from Google's servers, so your IP address reaches Google when a page loads.
Gmail SMTP, which Firebase Authentication uses to send the verification and password-reset e-mails.
Lemon Squeezy, the merchant of record for paid products. It collects your payment details and billing information under its own privacy policy, handles payment, tax, invoices and refunds, and tells us about your order.
YouTube. Some plugin pages embed demo videos from youtube-nocookie.com, and the storefront embeds a YouTube playlist from youtube.com. YouTube may set cookies and receives your IP address when the player loads.
These providers are based in or operate from countries outside Türkiye and the European Economic Area, including the United States, so your data may be transferred abroad. We rely on the safeguards those providers offer for such transfers. We also disclose data where the law or a competent authority requires it.
Legal grounds
We process your data to perform our agreement with you (your account, your downloads, your licence, your order), on our legitimate interest in running, securing and improving the site and answering your reports, to meet legal obligations, and, where the law requires it, on your consent (Google Analytics runs only on your consent). You may withdraw consent at any time without affecting what was done before.
How long we keep it
Each kind of data has its own period:
Account, free launch claim, download counters and licences: while your account exists. They are deleted when you delete your account. The only thing kept is a one-way hash of your e-mail address (it cannot be turned back into the address), so that the free launch licence stays one per person and the public count of claimed licences does not go down.
Paid orders: Lemon Squeezy, the merchant of record, keeps the invoices under its own policy. We keep the order ID, product, status and a hashed e-mail address for as long as the licence exists, to handle refunds and re-downloads. When you delete your account we delete the rest of the order record (your e-mail address, receipt link and licence key) and keep only those fields.
Problem reports: 12 months after we mark them resolved or move them to our archive, then they are deleted automatically. A report that is not resolved yet is kept until it is.
Tester applications and tester reports: until the tester programme ends, and for 12 months after that, or until you delete your account, whichever comes first.
Forum topics and replies: until you delete them or delete your account; then they are removed.
Server request logs: 30 days (the Google Cloud Logging default).
Analytics: only with your consent. Google Analytics keeps event data for 2 months (the retention period we set); older data is deleted by Google.
Your cookie choice: in your browser until you clear it.
Lemon Squeezy and Google keep their own records under their own policies. Where the law requires us to keep something longer, or we need it to defend a legal claim, we keep only that.
Your rights (KVKK and GDPR)
Under Article 11 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and under the GDPR, you may ask us to:
confirm whether we process your data and give you a copy (access);
correct data that is wrong or incomplete (correction);
delete your data, including your account, licence and download records, reports and tester application (deletion): sign in, open your Account page and press "Delete my account";
stop or restrict processing that rests on our legitimate interest (objection);
give you your data in a common machine-readable format (portability);
tell us that you withdraw a consent you gave.
Deletion you can do yourself: on your Account page, "Delete my account" removes your account and the personal data described under "How long we keep it" straight away, apart from the hashed e-mail marker explained there. For anything else (access, correction, portability, objection, withdrawing consent), e-mail info@subverselab.com from the address on your account, saying what you want. We may ask you to confirm that the account is yours. We answer within 30 days. Forum posts can be deleted by their author. If you are not satisfied with our answer you can complain to the Turkish Personal Data Protection Board (KVKK Kurulu) or to the data protection authority where you live.
Children
SubverseLab is not directed at anyone under 16, and accounts are for people aged 16 or over. If you believe a child has given us personal data, e-mail us and we will delete it.
Security
The site is served over HTTPS only. Licence, order and tester records can be read only by our server, and a signed-in person can read only the licence record for their own verified e-mail address. No system is perfectly secure, and we cannot promise it; if a breach affects you we will tell you and the authorities as the law requires.
Changes to this policy
We will change this page when what the site does with data changes. The date at the top shows the latest version. Last updated: 3 October 2026.