Privacy Policy
This policy explains what personal data SevenUI collects when you visit sevenui.dev, sign in, or buy SevenUI Pro — and what we do with it. SevenUI is the data controller for the processing described here. Contact: mail@sevenui.dev.
The short version: we run no database of our own. Your identity lives with Clerk, your purchase and licence keys live with Polar, and the rest is website analytics and server logs. Browsing the documentation and installing the free components requires no account and no personal data beyond ordinary server logs.
1. What we collect
Account data — when you sign in, our identity provider Clerk stores your email address, your name and profile image if your provider supplies them, the identifier of the Google or GitHub account you signed in with, and session and device information used to keep you signed in and to detect abuse. We read this data through Clerk to show your account page; we do not copy it into a system of our own.
Purchase and licence data — when you buy SevenUI Pro, Polar (our merchant of record) collects the data needed to take the payment and issue an invoice: your name, email address, billing country, tax identifiers where relevant, and payment details. We never receive or store your card details. We can see, through Polar, which orders and licence keys belong to your account.
Licence validation data — when you install a Pro block, the request carries your licence key. Our licence endpoint checks it with Polar and, like any web server, records the request in short-lived technical logs (timestamp, IP address, user agent, requested resource).
Server logs — our host, Vercel, records requests to the site: IP address, user agent, URL, response status, and timing. These logs keep the service running and secure.
Usage analytics — we use Google Analytics 4 (measurement ID G-8702Z28SMN) to understand which pages and components get used — only if you allow it in the cookie banner. Until you do, the Google Analytics script is not loaded and no analytics cookies are set. Once allowed, it sets cookies in your browser and reports pageviews, referrer, device and browser type, and a coarse location derived from your IP address. We look at this in aggregate; we do not use it to identify you or to build advertising profiles.
Correspondence — if you email us, we keep the message and your address so we can answer and keep a record of support and refund requests.
2. Why we process it, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Sign you in and show your licences | Account data | Performance of a contract |
| Sell SevenUI Pro, issue and validate licence keys, handle refunds | Purchase, licence, validation data | Performance of a contract |
| Keep invoices and tax records | Purchase data | Legal obligation (handled by Polar as merchant of record) |
| Keep the service available and prevent abuse of licence keys | Server and validation logs | Legitimate interest |
| Answer your emails | Correspondence | Legitimate interest, or contract for existing customers |
| Measure how the site is used | Analytics data | Your consent, given through the cookie banner and withdrawable at any time |
Under Turkish data protection law (KVKK), the same processing rests on the grounds in Article 5/2 — in particular processing necessary for a contract, compliance with a legal obligation, and our legitimate interests — while analytics rests on your explicit consent (Article 5/1).
3. Who processes data for us
We keep the list of third parties deliberately short. Each acts under its own privacy policy, and we do not sell personal data to anyone.
| Provider | Role | Location |
|---|---|---|
| Clerk | Authentication and account records | United States |
| Polar | Merchant of record: payments, invoices, licence keys | United States / EU |
| Vercel | Website and API hosting, server logs | United States and global edge network |
| Google Analytics | Aggregate usage statistics | United States |
We may also disclose data where the law requires it, or to establish or defend a legal claim.
4. International transfers
Because these providers are largely based in the United States, your data is transferred outside Türkiye and the European Economic Area. Those transfers rely on the providers' own safeguards — standard contractual clauses and, where applicable, the EU–US Data Privacy Framework — and, for transfers from Türkiye, on the grounds available under KVKK Article 9, including your explicit consent where no other ground applies.
5. Cookies
We use no advertising or cross-site tracking cookies. On your first visit a cookie banner asks whether you allow analytics; it is off unless you accept, and “Reject all” is as easy as “Accept all”. You can change or withdraw your choice at any time through Cookie settings in the site footer; withdrawing deletes the analytics cookies and reloads the page. What the site sets:
| Cookie | Set by | Purpose |
|---|---|---|
__session, __client_uat | Clerk | Keeps you signed in. Strictly necessary; only set once you sign in. |
cc_cookie | SevenUI | Remembers your cookie choice so the banner does not reappear. Strictly necessary; expires after 182 days (about six months), after which we ask again. |
_ga, _ga_* | Google Analytics | Distinguishes visitors for aggregate usage statistics. Only set after you accept analytics; expires after up to two years. |
Your theme and package-manager preferences are stored in your browser's local storage and never leave your device. You can also block or delete cookies in your browser settings, or opt out of Google Analytics with Google's browser add-on; blocking the Clerk cookies will sign you out.
6. How long we keep it
- Account data — for as long as your account exists, and deleted with it.
- Purchase and licence data — for the life of the licence, then for as long as tax and accounting law requires Polar to keep the records.
- Server and validation logs — short-lived, retained by our host in the ordinary course (typically weeks, not years).
- Analytics — as configured in Google Analytics, up to 14 months.
- Emails — as long as needed to handle the matter and keep a record of it.
7. Your rights
Under the GDPR and KVKK you can ask us to confirm whether we process your data, get a copy of it, correct it, delete it, restrict or object to the processing, receive it in a portable format, and withdraw consent where processing rests on consent. You may also complain to a supervisory authority — in Türkiye, the Personal Data Protection Authority (KVKK); in the EEA or UK, your national authority.
Write to mail@sevenui.dev from the address on your account and we will respond within 30 days. Deleting your account removes your identity data from Clerk; records Polar must keep for tax purposes remain with Polar, and a deleted account does not by itself cancel a licence you have bought.
8. Security
Authentication and payment — the two places sensitive data lives — are delegated to specialist providers rather than kept on our own servers. Traffic to the site and the licence API is encrypted in transit, and licence keys are transmitted as bearer credentials over HTTPS only. No system is perfectly secure; keep your licence key and your sign-in email safe, and tell us if you suspect a problem.
9. Children
SevenUI is a developer tool and is not directed at children. Do not use the service or create an account if you are under 16 (or the minimum age for data-processing consent where you live). If we learn we hold a child's data, we will delete it.
10. Changes to this policy
We will update this page when our tools or processing change; the date at the top always reflects the current version. Material changes will be announced by email to Pro customers.
11. Contact
SevenUI — mail@sevenui.dev. See also our Terms of Service.