Privacy Policy
What personal data MisterRoot processes, why, where it goes and for how long.
1. Data controller
MisterRoot · Türkiye is the data controller for individual accounts. For organisation workspaces, the organisation is the controller of exercise data and MisterRoot acts as its processor (see the Data Processing Addendum). Contact: [email protected]. Last updated: 14 October 2026.
2. Data we process
| Category | Examples |
|---|---|
| Account | Name, e-mail address, password hash (never the password), your Google account identifier if you sign in with Google, country and language (to show the legal content that applies to you), your school email address and verification time if you ask for the student discount, e-mail verification time, optional public nickname |
| Exercise content | Your decisions, messages to simulated units, notes, evaluations, reports and files you upload |
| Usage | Exercise history and scores, AI usage counters, badges, lessons read, quiz and practice case results (if you joined the leaderboard, only your nickname and country flag appear on the leaderboard, challenge scoreboards and your public profile), certificates (a certificate page is visible to anyone with its link and shows only your name, the path and the date) |
| Security and audit | Sign-in and account events (including failed sign-ins with the e-mail entered), organisation actions |
| Technical | IP address and request data, used briefly for rate limiting and kept in size-limited server logs |
| Subscription | Plan, subscription status and period end received from the payment provider. We never see card data. |
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service and your account | Performance of a contract |
| Running AI-generated scenarios and unit replies | Performance of a contract |
| Security, abuse prevention, rate limiting, audit trail | Legitimate interest |
| Billing and subscription status | Performance of a contract; legal obligation |
| Public leaderboard and profile (only if you opt in) | Consent, withdrawable at any time |
| Service e-mails (verification, password reset, invitations) | Performance of a contract |
4. Data sent to the AI provider
When you generate a scenario, message a simulated unit, request evidence or an evaluation, the relevant exercise content is sent to our AI provider (Anthropic) to produce the response. Ready-made scenarios are played and scored without AI.
Under the provider's commercial terms, data sent through the API is not used to train its models and is retained only for a limited period. Do not enter real personal data or real confidential information into exercises.
5. International transfers
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, backups and e-mail delivery | Germany (EU); e-mail may be routed via the USA |
| Cloudflare | Content delivery and protection; all traffic passes through it | Global network, incl. the USA |
| Google (only if you choose Sign in with Google) | Confirms your identity; we receive your name, e-mail address and Google account identifier. Google acts as an independent controller | Global, incl. the USA |
| Anthropic | AI processing of exercise content | USA |
| Creem (Merchant of Record) | Payments, invoicing, taxes | EU / global |
Transfers outside Türkiye and the EU rely on the recipients' contractual safeguards (standard contractual clauses) and, for Türkiye, on the transfer provisions of the Personal Data Protection Law (KVKK art. 9). This list is complete: no other recipient receives your personal data.
6. Retention
| Data | Retention |
|---|---|
| Account and exercise content | Until you delete your account (self-service, on the account page) |
| Organisation workspace content | For the term of the organisation agreement; on deletion of your account your contributions there are anonymised |
| Sessions | 14 days; expired session records are removed on the next sign-in |
| Verification, student and password-reset links | 48 hours, 48 hours and 1 hour; expired links are removed when a new one is issued |
| Student verification | 12 months from verification; removed when you delete your account |
| Rate-limit counters (incl. IP) | In memory only, at most 1 hour |
| Server logs | Size-limited rotation (at most 30 MB per service), typically a few weeks |
| Backups | 14 days |
7. Sharing
We do not sell personal data and do not share it for advertising. Data is shared only with the recipients in section 5, with members of an organisation workspace you belong to, publicly if you opt in to the leaderboard, or where required by law.
8. Security
- Encrypted connections (HTTPS) end to end through the proxy.
- Passwords stored with a salted scrypt hash; one-time links stored as hashes.
- Workspace isolation: records of other workspaces are not reachable.
- Uploaded files are served so that they cannot run scripts in the Service.
- Rate limits on sign-in, registration and password reset; restricted server access.
9. Your rights
Under KVKK art. 11 and the GDPR you may request access, rectification, erasure, restriction, portability and objection, and withdraw consent. You can delete your account yourself on the account page; other requests: [email protected]. We answer within 30 days. You may also complain to the Turkish Personal Data Protection Authority or your local supervisory authority.
10. Automated decisions and profiling
Exercise scores and recommendations are generated automatically to support your learning. They have no legal or similarly significant effect on you.
11. Children
The Service is not directed at children under 16 and we do not knowingly process their data.
12. Changes
We will announce material changes to this policy by e-mail or in the Service before they take effect. This English text is binding; translations are provided for convenience.