Privacy Statement — Plugins

Last updated: 1 September 2026

Applicable to: the WordPress plugins listed below, in their free and Pro editions. For this website and the customer account area, see the Website Privacy Policy / KVKK.

1. Who this is for

These plugins run on your own WordPress site. For the data your visitors leave on that site, the data controller is you, not us. This page describes only one thing: what — if anything — each plugin sends OUT of your site, and to whom.

The short answer: in the free editions, nothing leaves your site except where you switch it on yourself or where the plugin's own job requires it (MevvPos talks to your bank). The Pro editions check their licence against our server.

2. Controller

Mev E-Ticaret Limited Company ("Mevvsoft")
Address: Fenerbahçe Mah. İğrip Sok. No:13 Kadıköy / İstanbul 34726
MERSIS: 0620166247200001
Tax ID: 6201662472
E-mail: iletisim@mevvsoft.com

3. Licence verification (Pro editions only)

MevvPos Pro, MevvCart Pro, MevvCode Pro, MevvBlocks Pro and MevvLegal Pro verify their licence against mevvsoft.com. The request carries exactly four fields:

• license_key — the key you entered
• site_url — your site address, so the seat count can be enforced
• plugin, version — which product and which version is asking

No visitor data, no order data, no content is sent. The answer is cached for twelve hours, so the request is made about twice a day and only in the admin area — never on a page your visitors see.

Free editions never make this request. The licence client ships inside the Pro package; if Pro is not installed, the code is not on your site at all.

4. Product by product

MevvPos

MevvPos is a payment plugin, so sending data out is its job: at checkout it talks to the bank or payment provider YOU configured (İşbank, Akbank, Garanti BBVA, iyzico, PayTR, Craftgate, Sipay and others). Card number, expiry and CVV travel from the shopper's browser to that provider under 3D Secure and are never written to your database or ours.

Those providers are separate controllers with their own policies. Which one receives the data is your choice, made in the plugin settings.

Separately, MevvPos has a form for requesting a new POS definition or support from us. It is sent only when you press the button, and it carries the contact details you type (name, e-mail, phone), your site address and the message itself.

MevvCart

MevvCart stores abandoned carts and the e-mail address entered at checkout in your own database, and sends reminders through your own site. That data does not reach us.

It also has an optional usage-statistics setting. It is OFF by default and nothing is sent unless you turn it on. When on, it posts to mevvsoft.com/api/v1/usage-tracking: version numbers, your locale, theme name, which features you enabled, the number of recorded carts, and one hash derived from your site address together with the admin e-mail. It contains no visitor and no order data.

Your site address is not stored. The plugin no longer sends it; if an older version sends it, the endpoint discards it. What remains is the hash, which is enough to merge two records from the same installation and not enough to say whose it is. Your IP address is not stored either: it is used in memory for rate limiting and written to no row. One row per installation — a repeat report updates that row instead of adding a new one, so the table never becomes a usage log.

MevvCode

MevvCode Free does not send telemetry, licence checks or source code. The source code, metadata, conditions, revisions and safety events you create stay on your own WordPress installation. A migration health check makes a signed loopback request only to your own site.

MevvCode cannot make user-written code private by itself: a snippet you write, an import you approve or an external asset address you enter can make its own network request. In that case you choose the recipient and are responsible for disclosing that processing to your visitors.

Pro cloud workspaces are a separate, explicit opt-in. They remain off until you enable mevvcode_pro_cloud_enabled. A cloud request authenticates with the Pro licence key and site address; a write also carries the workspace name, revision, and the source code and metadata of the snippets you select. Mevvsoft stores the site host, workspace name, revision and timestamps, while the snippet payload is protected with application-level encryption. The current workspace is retained until you overwrite it or ask us to delete it.

AI review is another separate, explicit opt-in. It remains off until you enable mevvcode_pro_ai_enabled. Before a request, the plugin locally redacts recognisable WordPress keys and salts, OpenAI-style API keys, private keys and password assignments. It then sends the redacted code copy and the review instruction you write, together with licence authentication, through Mevvsoft to the configured AI review provider. Pattern redaction is a safety aid, not a guarantee: review the outgoing copy and never place personal data or secrets in it. The MevvCode application route does not write the request or result to its database. The returned diff is shown for your decision and is never applied automatically.

MevvBridge

MevvBridge sends nothing out of your site. It reads your existing pages, converts what it recognises into blocks and freezes the rest. The only network request it makes is to your own site — it fetches one of your own pages to compare the result before and after the conversion. MevvBridge has no Pro edition, so it never checks a licence either.

MevvBlocks

The free edition makes no external requests at all — not one. Blocks are rendered on your server and the style CSS is produced there too.

Two things can send data out, and both are things you set up yourself: the Pro form engine can post a submission to a webhook address you enter, and the map block loads a map frame from OpenStreetMap. The map is described below.

The map block asks first. A third-party map frame reveals your visitor's IP address to that service. By default the frame is not loaded until the visitor agrees. If MevvLegal is installed, the frame is handed to its consent mechanism; if not, the block asks on its own.

MevvLegal

MevvLegal is the plugin that stops other scripts from running without consent, so it holds itself to the same rule: the free edition sends nothing out of your site.

• The consent record stays on the visitor's device. It is written to browser storage, not to a cookie, and it never reaches a server.
• The consent log on your server is anonymous. It counts (day, policy version, choice) triples. No IP address, no visitor identifier, no personal data — deliberately, because proving consent per person would require giving the visitor a durable identifier, which is a new processing operation nobody consented to.
• The cookie scanner reads names, never values. Only the part before the equals sign is ever read, and it never leaves your site. A session cookie's value is an identity token; collecting it in order to measure cookie consent would open the very channel this product exists to close.
• Geographic rules use no IP lookup. The region is derived from the browser's own time-zone setting. No request is made to any geolocation service and no IP address is sent anywhere.
• Google Consent Mode is off unless you turn it on. When you do turn it on, Google's tag runs on your pages and a request reaches Google even for a visitor who refused — carrying the refusal itself. That is a step back from the default behaviour, it is your decision to make, and the plugin says so on the screen where you make it.

5. What we never do

• We do not collect your visitors' personal data on our own servers through these plugins.
• We do not send anyone's IP address to a third-party service in order to determine their location.
• We do not collect cookie values, session tokens or passwords on our servers. If you opt into MevvCode AI review, local redaction recognises likely secret patterns only to remove their values before transmission.
• We do not sell or share data with advertising networks.

6. Your rights

For the licence records we hold (your key, your site address, your e-mail as the customer), you may ask us to show, correct or delete them under Article 11 of the Turkish Data Protection Law and Articles 15–22 GDPR. You may also request deletion of your MevvCode cloud workspaces. Write to iletisim@mevvsoft.com. Deleting a licence record ends the licence.

For data your own visitors leave on your own site, the request belongs to you, not to us — you are the controller there.

7. Changes

If a plugin starts sending something it did not send before, this page changes on the same day and the date at the top is updated. Each statement here was checked against the code on the date shown.

Documentation

• MevvPos — Multibank virtual POS for WooCommerce
• MevvCart — Sales funnels and cart recovery
• MevvCode — Safe local code snippet management
• MevvBridge — Migration away from a page builder
• MevvBlocks — Blocks and templates for the block editor
• MevvLegal — Cookie consent and legal pages