Gizlilik Politikası / Privacy Policy

English

1. Data Controller

hangel International Social Benefit Association ("hangel") is the data controller. Contact: info@hangel.org.

2. Data we collect

• Account: name, email, phone (for verification).
• Donations: amount, date, recipient NGO, payment reference.
• Engagement: in-app click / page-view metrics (anonymized).
• Chrome Extension: see the dedicated section below.

3. Purposes

• Process donations and issue receipts.
• Match users with NGOs they have selected.
• Legal obligations (KVKK, association law, tax records).
• Service quality measurement (anonymous metrics).

4. User rights

Under KVKK art. 11 you may request access, rectification, erasure, or objection by writing to info@hangel.org.

Google account connection and Google user data

Organisation administrators and hangel administrators connect Google accounts for meetings; any user may choose to sign in with Google or connect Google Calendar, and neither is required. Google Drive is also connected only by users who choose to, for their own account. hangel accesses Google APIs only with the permission granted on Google's consent screen and only to:

• meetings.space.created: create Google Meet spaces for online events and volunteering listings.
• meetings.space.readonly: after the event, read the attendance records of only the spaces hangel created (display name in Meet, session start and end times) to record attendance and duration and issue participation certificates.
• drive.file: upload recordings made in hangel's own meeting room with participants' consent to hangel's organisational Drive and delete them when the retention period (180 days by default) ends; only files hangel created are accessible.
• drive.file (your own Drive): fetch the file you choose in the Google Picker into the action you started (not stored permanently), and at your request create or update, in your own Drive, a Google Doc or Sheet of content you can already see and download in the panel (project application, meeting notes and AI summary, participant/application/registration-answer/attendance/review lists). If you pass a chosen file to an AI-powered action, its text is processed only for that request, not stored and not used to train any model.
• openid, email: show the connected account's email address in the admin panel.
• youtube.force-ssl: if an organisation administrator connects their own YouTube channel, create, bind, start and end a live broadcast and stream on that channel for the Oda event; the stream key is kept only on the server and other videos, comments and subscription data on the channel are not touched.
• openid, email, profile (Sign in with Google): receive the Google account identifier, verified email and name once at sign-in to find the hangel account with the same email or, on the sign-up screen after the agreements are accepted, create one; no profile photo is taken and no long-term permission is kept.
• calendar.app.created (Google Calendar): create a separate calendar named "hangel" and write, update and delete in it only the events you registered for and your approved volunteering; other calendars are not accessed and meeting links are not written. Disconnect under Settings › Notifications › Google Calendar.
• adwords (Google Ads): if an organisation administrator connects their own Google Ads / Google Ad Grants account, it is used only for actions the administrator starts in the panel: show the account name, currency and account type; create, edit, pause and enable the search campaigns the administrator approves (ad groups, keywords, ad text, sitelinks, budget, targeting, conversion actions); show campaign results (impressions, clicks, click-through rate, conversions, grant spend, quality score, search terms) in the panel and check compliance with Ad Grants policies. No change is made to the account without the administrator's approval. Ads data is shown only to that organisation, not shared with other organisations or third parties and not used for hangel's own advertising. Account health reports and the AI advisor's recommendations are kept in hangel for that organisation while the connection lasts. To produce recommendations, campaign results are sent to an AI service provider (Google Gemini; Anthropic Claude as a fallback under load) only for that request and are not used to train any model. Disconnect from the account connection card under Panel › Ads › Google Ad Grants › Set up › Account: access is also revoked at Google and the connection record, account health and advisor records are deleted. Access can also be withdrawn at myaccount.google.com/permissions.
• contacts.readonly (Google Contacts): if a user chooses "Invite from contacts", the contact list is read once; phone numbers are hashed (SHA-256) to match existing hangel members and the list is shown to the user to choose whom to invite. Contacts are not stored on the server, the access token is discarded as soon as the read ends, and no invitation is sent unless the user selects someone.

The access permission is stored only server-side, in records closed to clients. Google data is not sold, not used for advertising, not transferred to third parties and not used to train any model; Meet data is not sent to AI models. hangel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can withdraw access with the disconnect button in the hangel panel (it is also revoked at Google) or at myaccount.google.com/permissions. Full text: Privacy Policy, section 13.

The YouTube live streaming feature uses YouTube API Services; by using it you agree to the YouTube Terms of Service. How Google processes data: Google Privacy Policy. You can also revoke access on the Google security settings page.

Chrome Extension data handling (summary)

• Browsing history is NEVER sent to hangel servers. Brand matching happens entirely inside Chrome via the locally cached brand list in chrome.storage.local.
• Only when the user clicks the "Yapsın" (Do it) button is the brand identifier (brandId) sent to hangel. This request contains no URL, history, or PII.
• "Don't ask again" preferences (30 days) live only in Chrome's local storage.