Privacy Policy

1. Who is responsible for your data

OceanLabs determines the processing of platform account information, authentication, service security, and support communications. For these activities, OceanLabs acts as a data controller.

The law office using Hufis determines why and how its client, case, investigation, enforcement, and insurance records are processed. For these records, the office normally acts as the data controller and Hufis processes data on its instructions. Office users should upload only information they are authorized to process. Requests concerning office-controlled records may need to be coordinated with that office.

2. Information we collect and process

We process information you provide, information supplied by your office or its authorized integrations, and technical information generated when you use Hufis. This includes:

• Account and workspace data: name, email address, phone number, office name, membership roles, invitations, language preferences, password hashes, and authentication/session records.
• Office records: client and party contact details, case and court references, investigations, enforcement matters, tasks, deadlines, assignments, notes, and insurance claims entered by users. Hufis does not process card payments through the app.
• Uploaded files and import/export records, including document content, filenames, file types, and related metadata. Depending on what an office uploads, records may contain health information, criminal-conviction information, or other sensitive personal data.
• Security and technical data: IP addresses, request and login information, browser/device information available to the service, audit events, and information needed to investigate errors or abuse.
• Notification data when enabled: device platform, push tokens, installation identifiers, notification preferences, and delivery-related information. Support requests and service emails or SMS also contain the contact details and message content needed for delivery.
• App update requests: app/runtime version and technical network information needed to deliver compatible updates through Expo.

3. Why we use information

Where applicable, processing is based on providing the service under a contract, legal obligations, legitimate interests that respect your rights, or consent when required. Office-controlled and sensitive records require the appropriate legal basis determined by the responsible office.

• Create and manage accounts and workspaces, authenticate users, verify account actions, and apply office permissions.
• Provide the records, documents, imports, exports, tasks, deadlines, and other workflows requested by office users.
• Deliver account/security emails and SMS, respond to support requests, and deliver notifications users enable.
• Maintain service reliability, deliver app updates, record security/audit events, prevent abuse, and troubleshoot problems.
• Meet applicable legal obligations, respond to lawful requests, and establish, exercise, or defend legal rights.

4. Sharing and service providers

Your office’s authorized users can access records according to workspace roles and assignments. Office-enabled integrations and export/share actions can disclose information to recipients chosen by the office or user.

We use infrastructure and service providers for hosting, storage, email/SMS delivery, support, and app updates. These include configured messaging/email providers such as SMTP2GO and Expo for mobile updates. When notifications are enabled, Google Firebase Cloud Messaging and the relevant platform delivery services, including Apple Push Notification service on iOS, process the identifiers and notification information necessary for delivery. Firebase messaging is not used as an advertising or analytics service in Hufis.

Providers may access data only as needed for their service and must protect it through applicable contractual and legal safeguards. Providers may operate outside your country; international transfers must have a lawful basis and the safeguards required by applicable law.

We may disclose information where legally required, to protect users and the service, or as part of a lawful business transfer subject to appropriate protections and notices. We do not sell personal data or use advertising networks or cross-app advertising tracking.

5. Cookies, device storage, and your choices

The website uses necessary authentication cookies and stores language/theme preferences. The mobile app stores authentication tokens through the device’s secure credential storage and may store display-safe preferences and metadata locally. Selected uploads and shared/exported files may temporarily use the app’s cache.

Hufis does not request access to your location, contacts, camera, or microphone for its current workflows. The document picker lets you choose files to upload. We do not use analytics tracking cookies or advertising identifiers.

You can manage notifications in Hufis and your device settings. Turning notifications off does not delete your account or office records. You can change language/theme preferences and withdraw consent for consent-based processing by contacting us; withdrawal does not affect processing already lawfully performed.

6. How we protect information

We use safeguards including authenticated access, workspace boundaries, role-based permissions, password hashing, secure credential storage on mobile, and encrypted HTTPS connections in production. Access and audit records help investigate misuse. No network or storage system can guarantee absolute security. Keep your credentials and devices secure and report suspected unauthorized access promptly.

7. Retention and deletion

Account data is retained as needed to operate your account and address legal, support, and security obligations. Office records are retained according to the responsible office’s lawful instructions and applicable requirements. Archive actions hide records from active views and do not permanently delete them.

Office retention settings currently record manual retention expectations; they do not run an automatic purge. Authorized owners can use the supported permanent case-erasure workflow. Minimal audit records may remain to document the action.

You can request account or personal-data deletion through the Account and Data Deletion page. We verify the request, explain any information that must be retained for a specific legal, security, or legal-claims reason, and communicate the outcome. Account deletion does not itself authorize erasure of other people’s or the office’s records. Backup and provider copies may require separate removal or expiry; applicable retention limits and remaining obligations are considered when handling your request.

8. Your privacy rights

Depending on applicable law, you may request information about processing, access, correction, deletion, restriction, or portability, object to certain processing, withdraw consent, and complain to the relevant data protection authority. Our KVKK Disclosure explains the rights available under Turkish Law No. 6698.

Contact us using the details below and identify your Hufis account and request. We may ask for proportionate information to verify your identity. We will coordinate office-controlled requests with the responsible office where necessary and respond within applicable legal deadlines.

9. Children and professional use

Hufis is intended for authorized adult professional users and is not directed to children. An office may lawfully include information about minors in its case records; responsibility for the lawful processing of those records remains with that office. Contact us if you believe a child has created an account without authorization.

10. Changes to this policy

We publish changes on this page and update its last-updated date. Where applicable law requires additional notice or consent, we will provide it. Contact us below with any questions about this policy or our handling of your data.