Privacy Policy & Cookie Policy

This policy is about how Volosoft uses and processes your data when shared through our website or service. It was last updated on September 26, 2025

1. GENERAL

This Privacy Policy describes how Volosoft (the “Company”, “we”, or “us”) collects, uses, stores, shares and protects your personal information in connection with your use of both the platform accessible through our websites including jtable.org, aspnetzero.com, aspnetboilerplate.com, abp.io, volosoft.com (together with their sub-domains, content and services, collectively referred to hereafter as the “Site”) and the services we may offer through the Site from time to time. The Site and the filtering services provided thereunder, are individually and collectively referred to herein as the “Services”. This policy (together with our Terms and Conditions) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it

2. DATA CONTROLLER

Personal information is processed by us, an entity incorporated in accordance with the laws of Turkey and with following contact details;

Volosoft Bilişim Anonim Şirketi
Address: İstanbul İhtisas Serbest Bölgesi. Yesilkoy SB Mah. E-Blok Sok. E1 Blok. 34149, No:2 BAKIRKÖY / ISTANBUL

3. DATA WE RECEIVE

3.1. Web Server Logs

When you visit our website, we may track information from your visit. With each visit we may automatically collect the following information:

Technical information, including the internet protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.

Information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information, methods used to browse away from the page.

3.2. Third – Party Technologies

We use Google services (Analytics, Remarketing, Display). We use Remarketing with Google Analytics to advertise online. Third-party vendors, including Google, may show our ads on sites across the internet. We and third-party vendors, including Google, use first-party and third-party cookies together to inform, optimize, and serve ads based on a person’s past visits to our website.

3.3. Personal Data Obtained From You

Visitors can register or fill out the necessary forms to obtain access to some parts of our websites (including but not limited to download pages, online service pages, blog to email services). We will ask you for some Personal Data or information related to your role in the organization you represent. Some of the information requested will be required for registration or transaction and some may be optional. Also, we may ask you to disclose further Personal Information to enable us to provide assistance and information to you. We may also collect and process data about you to help in administrative purposes. You may give us personal information by signing End User License Agreement, filling the forms and in the registration/download form on our websites or by sending other documentation. The Personal Information that you give us may include your name, address, e-mail address and phone number, and other relevant information. During the Support, we may process your

3.4. Data collected by our products and services

The data collected by our products and services is used for the purpose that you provided it for and to improve the products and services, usage, compatibility with operating systems and other 3rd party products and services. The data that is automatically collected may include IP addresses, operating system, operating system version, operating system language, browser type, geographic location, browser language, device information and other information.

4. LEGAL BASIS AND PURPOSE OF PROCESSING

We will process your data when we have to perform a contract, and we will be processing your data as long as the contractual relationship with you is in force and during the five years following the end of said relationship. This results in us having to process your data for purposes of providing you with both the Services, as well as to perform our obligations under the Services

Subject to obtaining your consent, and if you do not withdraw any such consent, we may also process your data for the following purposes

a) To send you electronic commercial communications (if you subscribe to our newsletter) or to answer the requests you may address us when contacting us;

b) To process information obtained through cookies, as described in more detail in the Cookie Policy, and subject to the terms set forth therein;

c) If you opt to sign in by means of a third-party social media platform, we may obtain ID confirmation and other information from that third party, as mentioned in each case;

d) For profiling purposes based on your behavior and how you browse the Site and use the Services, which pages you have visited, and to build audiences. Please note that we may profile users by means of cookies. In those cases, your acceptance of the installation and use of cookies results in a data processing for profiling purposes, as described in this paragraph.

When we have to comply with a legal obligation applicable to us from time to time, such as those set forth in Regulation of Publications on the Internet No: 5651, Criminal Code laws. In any such cases, the data will be processed only during the periods set forth by said laws, being deleted thereafter.

Finally, we may also process your data to protect our legitimate interests, as long as said data is strictly necessary to fulfil the goals set forth below, namely:
a) To review, monitor, investigate, and analyze how to improve the Services and/or the Site, as well as to keep our Services and the Site secure and operational and prevent abusive activity (e.g. fraud, spam, phishing activities, etc.). The interests at stake are ensuring a correct and safe environment for both other users and us, taking those interests prevalence over your legitimate interests (we need to create and maintain an environment which is in accordance with the law, the legitimate interests of other parties, what other users may expect from our end, and to protect other users’ security when accessing the Site and using the Services);
b) Besides any commercial electronic and non-electronic commercial communication sent when we have obtained your consent as mentioned above, we may also send you those kind of communications when you are our client. In this last case, we will only send you information belonging to us and concerning services and/or products identical or similar to the ones you have contracted with us. In these cases, we have a legitimate interest in processing your contact information to keep you informed about any of our products and services, prevailing this interest over your right to personal data given the non-sensitive nature of the data in question and the fact that the contractual relationship built with our clients results in those clients expecting these kinds of communications; and
c) Upon dissociating the data we have so as to be impossible to be associated to you or any other person, to perform statistical and other analysis on information we collect (technical and metadata).

5. TRANSFER OF DATA

We share your information with our service providers who help us to provide the Services to you, in which case those third parties are required to comply with our internal standards, policies, and technical and organizational measures that ensure that your data is protected and kept confidential at all times, and only in accordance with and to the extent authorized by this Privacy Policy. When you authorize us to do so, we may also share your data with other parties that they can process the data for other purposes, as explained more in detail when we request your prior consent.

We may also share your information with competent courts and authorities, when we are legally required to do so (for instance, to allow such bodies to investigate, prevent, or take action against illegal activities), or we have to take action to protect our rights or any third-party rights.

6. DATA RETENTION

We retain personal data that we collect only for as long as necessary for the purpose for which you have provided the data for or for as long as we legitimately need to do so, or as long as required for tax, legal or other regulatory requirements request us to do for compliance with such.

If your personal data is no longer required for any legitimate reason to be stored, we will delete, securely destroy, erase it, or in case it is not possible for example in backups or archives your data will be destroyed when deletion is possible.

7. USE OF COOKIES

7.1. Our Site may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by Us and are used only by Us. We use Cookies to facilitate and improve your experience of Our Site. By using Our Site, you may also receive certain third-party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than Us. Third party Cookies are used on Our Site for advertising services. These Cookies are not integral to the functioning of Our Site and your use and experience of Our Site will not be impaired by refusing consent to them. By giving your consent to the placing of Cookies you are enabling Us to provide the best possible experience and service to you. You may, if you wish, withdraw your consent and delete Cookies by using browser settings; however certain features of Our Site may not function fully or as intended.

7.2. The following first party Cookies may be placed on your computer or device:

Necessary Cookies

COOKIE DESCRIPTION
AspNetCore.Antiforgery.# Helps prevent Cross-Site Request Forgery (CSRF) attacks.
.AspNetCore.Culture This cookie is used by ASP.NET Core to store the user's culture and UI culture preferences. It helps maintain the user's selected language and formatting settings (like date, time, and number formats) across different pages and sessions within the application.
AbpDocsPreferences This cookie stores user preferences and settings for ABP applications, such as theme choices or layout options, to personalize and maintain a consistent user experience.
Csrftoken This cookie is used to distinguish between humans and bots
XSRF-TOKEN Ensures visitor browsing-security by preventing cross-site request forgery. This cookie is essential for the security of the website and visitor.
AbpIoAnonymousId This cookie is used to distinguish between users.
UserMatchHistory Used to ensure targeted advertising based on user history.
timezone-id This cookie is used to store the timezone of the user.
timezone-offset This cookie is used to store the timezone of the user.

Third Party Cookies

COOKIE DESCRIPTION
_ga Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
_gat Used by Google Analytics to throttle request rate
_gid Registers a unique ID that is used to generate statistical data on how the visitor uses the website
Collect Used to send data to Google Analytics about the visitor's device and behavior. Tracks the visitor across devices and marketing chann els.
AEC Cloudflare Bot Management cookie to manage incoming traffic and filter out bots.
HSID Security cookie used by Google to authenticate users, prevent fraudulent use of login credentials, and protect user data from unauthorized parties.
IDE Google advertising cookie used for targeting and showing relevant ads across the web.
SAPISID Used by Google for tracking and user identification.
MUID Microsoft User Identifier for tracking users across Microsoft services.
__cf_bm This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.
TawkConnectionTime Tawk.to, a live chat functionality, sets this cookie. For improved service, this cookie helps remember users so that previous chats can be linked together.
__cfruid This cookie is a part of the services provided by Cloudflare - Including load-balancing, deliverance of website content and serving DNS connection for website operators.
ANONCHK This cookie, set by Bing, is used to store a user's session ID and also verify the clicks from ads on the Bing search engine. The cookie helps in reporting and personalization as well.
personalization_id Unique value with which users can be identified by X. Collected information is used to be personalize X services, including X trends, stories, ads and suggestions.
bcookie LinkedIn sets this cookie to track the use of embedded services.
CLID The cookie is set by embedded Microsoft Clarity scripts. The purpose of this cookie is for heatmap and session recording.
lidc The cookie used by the social networking service, LinkedIn, for tracking the use of embedded services.
MR The cookie used to collect information for analytics purposes.
_gcl_au The cookie is used by Google AdSense for experimenting with ad efficiency across websites using their services. It helps in measuring the effectiveness of ads and managing ad performance by storing information on user interactions with ads and the website.

In addition to the controls that We provide, you can choose to enable or disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all cookies or only third-party Cookies. By default, most internet browsers accept Cookies but this can be changed.

8. DATA SUBJECT RIGHTS

By requesting to our company within the frame of Article 11 of Law No. 6698; you may claim request to access rights as set forth below.

  • Inquiry on whether personal data is processed;
  • Requesting information about personal data if it has been processed;
  • Inquiry on the purpose of processing personal data and whether they are used appropriately for the purpose;
  • Finding out whether the third parties to which personal data are transferred in the country or abroad;
  • Requesting correction of personal data if it is incomplete or improperly processed, and requesting that third parties to this process be notified of the transfer of personal data;
  • Requesting that personal data be deleted or destroyed in the event that the reasons for its processing is not fulfilled despite the fact that it has been processed in accordance with the provisions of Law No. 6698 and other related laws, and requesting that the process performed in this context be notified to third parties;
  • Objection to the appearance of a result against the person himself by analyzing the processed data exclusively through automated systems;
  • Having the right to claim damages in the event of a corruption due to the processing of personal data in violation of the law

9. INFORMATION SECURITY POLICY

9.1. Company & Product Context

Volosoft is the company behind ABP Platform (ABP Framework, ABP Commercial, and related tools such as ABP Studio and ABP Suite). ABP is a modern .NET application framework with modules for identity, authorization, audit logging, settings, GDPR, and more. It provides secure‑by‑default building blocks (e.g., antiforgery, security headers, permission management) that customers use to build their own applications.

This Information Security Policy establishes Volosoft’s commitment to information security across all operations, products, and services, including the whole ABP Platform and related services. This policy applies to all employees, contractors, and authorized users of Volosoft systems and services.

9.2. Endpoint Security

Volosoft implements endpoint security measures to protect devices and systems used in the development, maintenance, and delivery of our software frameworks and applications, including the ABP Platform.

9.2.1 Technical Security Controls

Browser Security
  • • Content Security Policy (CSP): Implementation of CSP mechanisms in our web applications
  • • Cross-Site Request Forgery (CSRF) Protection: CSRF protection through ASP.NET Core Antiforgery tokens
  • • XSRF Protection: XSRF-TOKEN cookie/token implementation for visitor browsing security

Web Application Security
  • • Authentication and Authorization: Authentication and authorization controls are built into the ABP Framework
  • • Identity Management: Identity management systems based on the Microsoft Identity library through ABP’s Identity Modules
  • • Access Control: Permission Management and role-based access controls
  • • Audit Capabilities: Auditability through the Audit Logging module (action/entity changes) and Identity Security Logs (sign-in events)
  • • Transport Security: HTTPS/TLS configuration guidance for production and clustered deployments
  • • AI Assisted Bot Prevention System: ABP includes an AI-assisted bot prevention system designed to block spam and harmful content.
  • • Reviewing Process: All ABP Platform developments are reviewed by at least two people (a developer/engineer and a dedicated QA team member).

9.2.2 Infrastructure Protection

Cloudflare Integration
  • • Bot Management: Bot management and traffic filtering
  • • Load Balancing: Load balancing and DNS security services
  • • Traffic Protection: Protection against malicious traffic and automated threats

Development Environment Security
  • • Framework Security: Support for modern .NET security features within the ABP Framework
  • • Core Integration: Integration with ASP.NET Core security mechanisms
  • • Multi-tenant Security: Secure development practices for multi-tenant applications

Volosoft Internal Endpoints
  • • Corporate Systems: Volosoft maintains security controls for internal corporate devices and services
  • • Documentation Scope: Specific details about internal endpoint tooling (e.g., EDR, MDM, disk encryption) are not publicly documented in this overview

9.2.3 Customer Deployment Responsibilities

Volosoft provides secure framework components, while customers are responsible for:

  • • Transport Security: Enforce HTTPS everywhere; configure reverse proxies/WAFs as needed
  • • System Hardening: Implement OS/container patching, host/network hardening, endpoint AV/EDR, and monitoring in your environment
  • • Configuration Security: Review and tune ABP security headers, anti-forgery behavior, and CORS according to your application's architecture

9.3. Personnel Security

9.3.1 Background Verification

  • All employees and contractors undergo appropriate background verification before access to sensitive systems.
  • Verification processes comply with Turkish legal requirements and industry standards.
  • Regular review of personnel security clearances.

9.3.2 Access Management

  • • Principle of Least Privilege: Users are granted the minimum necessary access rights.
  • • Authorization Framework: As documented on the abp.io documentation website, authorization is used to check if users are allowed to perform specific operations.
  • • Regular Access Reviews: Periodic review and update of user access rights.

9.3.3 Termination and Change of Employment

  • The Human Resources (HR) department and the respective manager are responsible for ensuring a smooth and secure off-boarding process.
  • All physical and logical access rights shall be revoked immediately upon termination of employment.
  • This includes, but is not limited to, disabling email accounts, VPN access, and access to all internal systems, cloud platforms (AWS, Azure, GCP), and source code repositories (e.g., GitHub, GitLab).

9.4. Security Awareness Training

Volosoft maintains a comprehensive security awareness training program that includes:

  • • New Employee Orientation: Security awareness training for all new hires
  • • Regular Updates: Periodic updates to inform employees about security measures and product status (through team meetings and one-on-one sessions)
  • • Incident Response: Defines the steps to follow when security incidents are suspected. An internally used Discord bot is also available for incident reporting within the ABP Platform.
  • • Compliance Requirements: Understanding of relevant legal and regulatory requirements

In addition, customer security education is also provided via:

  • Documentation and guides provided to ABP.io framework users regarding secure development practices
  • Security headers implementation guidance as documented in ABP.io documentation website
  • Best practice recommendations for secure application development

9.5. Encryption at Rest

ABP product capabilities

  • • Settings & string encryption: ABP provides an encryption service for sensitive settings and values. Settings marked as encrypted are stored securely and transparently decrypted when read.
  • • Passwords: ABP leverages ASP.NET Core Identity password hashing, aligned with modern best practices.
  • • Tokens & cookies: ABP uses ASP.NET Core Data Protection for cookie and token protection, with guidance for multi‑node deployments.
  • • OpenIddict (token signing/encryption): Production deployments use signing/encryption certificates.
  • • BLOB/files: ABP abstracts BLOB storage. Actual encryption at rest depends on the underlying provider configured (e.g., database, file system, S3, Azure Blob).

Volosoft's internal structure

Volosoft maintains internal security measures to safeguard its development and operational environments. These include secure development practices, restricted access to sensitive systems, and adherence to industry‑standard security principles.

For cloud storage security:

  • Encrypted storage for any data stored in cloud environments
  • Secure configuration of cloud storage services with appropriate access controls
  • Regular audit of cloud storage security configurations

Customer deployment responsibilities

  • Enable database and storage encryption in the hosting environment.
  • Manage encryption keys, rotation, and access controls according to organizational standards.

9.6. Data Protection and Privacy

9.6.1 Privacy Compliance

As detailed in our Privacy Policy, Volosoft complies with:

  • • Turkish Data Protection Law (KVKK): Full compliance with Law No. 6698
  • • GDPR Considerations: Appropriate protections for EU data subjects
  • • Industry Standards: Adherence to software industry best practices

9.6.2 Data Collection and Processing

  • • Minimal Data Collection: Only necessary personal information is collected
  • • Purpose Limitation: Data is used only for stated purposes
  • • Retention Limits: Data is retained only as long as necessary for legitimate business purposes

For more information, please refer to;
Privacy And Cookie Policy
Eula
Terms and Conditions

10. CONTACT

You may contact us via our privacy e-mail info@volosoft.com. Please send e-mail through this adress for exercise your rights.