Privacy Policy
Your data privacy is important to us.
Last updated: 08.04.2026 | Version 3.0 | Applicable law: Republic of Türkiye — Law No. 6698 (KVKK) / GDPR-aligned
1. DATA CONTROLLER
Otomasyum ("Platform") acts as the Data Controller for personal data collected through this Platform. Contact for data privacy matters: [email protected]
2. PERSONAL DATA WE COLLECT
| Category | Data | Source |
|---|---|---|
| Identity | First name, last name, company name | Registration form |
| Contact | Email address | Registration form |
| Billing | Invoice name/address, VAT number (card details processed by payment provider only) | Billing settings |
| Technical | IP address, browser type, OS, session data | Automatic (login/usage) |
| Usage | Features used, API calls, content generated, domains added | Platform activity |
| Website Data | GSC metrics, keyword rankings, site analytics synced by User | User-authorized API |
| Communication | Support messages, feedback | User-submitted |
We do not intentionally collect sensitive personal data (health, religion, biometrics, etc.).
3. PURPOSES AND LEGAL BASIS
- Service delivery — Providing and maintaining Platform features (legal basis: performance of contract).
- Account management — Authentication, billing, subscription management (legal basis: performance of contract).
- AI service processing — Passing necessary context to AI APIs to generate content on your behalf (legal basis: performance of contract; explicit consent for sensitive contexts).
- Security and fraud prevention — Monitoring for unauthorized access, abuse, and policy violations (legal basis: legitimate interest).
- Service improvement — Aggregated, anonymized analysis of usage patterns (legal basis: legitimate interest).
- Legal compliance — Retaining records as required by Turkish tax, commercial, and data protection law (legal basis: legal obligation).
- Marketing communications — Product updates and announcements (legal basis: consent; opt-out available at any time).
4. AI PLATFORM DATA PROCESSING
When you use AI content generation features, limited context data (domain name, target keyword, content settings) is transmitted to third-party AI providers (e.g., Anthropic, Google). This data is processed solely to generate the requested content. We do not transmit personal data such as your name, email, or billing information to AI providers.
Third-party AI providers operate under their own privacy policies and data processing agreements. Content generated via AI may be retained by the provider per their terms. We recommend reviewing the privacy policies of: Anthropic (claude.ai/privacy) and Google (policies.google.com/privacy).
5. DATA SHARING AND TRANSFERS
- Payment processors — PayTR, Stripe, or similar; card data is processed directly by these providers under PCI-DSS standards.
- AI API providers — Limited, pseudonymized context data as described in Section 4.
- Cloud infrastructure — Hosting and storage providers operating under data processing agreements.
- Legal authorities — When required by a valid legal process, court order, or applicable law.
We do not sell, rent, or trade your personal data to any third party for commercial purposes.
6. DATA RETENTION
- Active account data: retained for the duration of the account.
- After account closure: personal data is anonymized or deleted within 90 days, unless legal retention obligations apply.
- Billing records: retained for 10 years per Turkish tax law (VUK).
- Security logs: retained for 2 years.
7. SECURITY MEASURES
We implement industry-standard security measures including TLS/HTTPS encryption in transit, AES-256 encryption at rest for sensitive fields, bcrypt password hashing, two-factor authentication support, access controls and audit logs, and regular vulnerability assessments. No system is completely immune to breach; users are advised to use strong, unique passwords and enable 2FA.
8. YOUR RIGHTS
Under KVKK Article 11 and applicable privacy law, you have the right to:
- Know whether your personal data is being processed;
- Request information on how your data is processed;
- Know the purpose and whether data is used in accordance with that purpose;
- Know domestic or foreign parties to whom your data is transferred;
- Request correction of incomplete or inaccurate data;
- Request deletion or destruction of data under the conditions in Article 7;
- Object to automated processing of your data to your detriment;
- Request compensation for damages resulting from unlawful processing.
To exercise your rights, contact us at: [email protected]. We will respond within 30 days.
9. COOKIES
We use cookies and similar technologies to operate and improve the Platform. For detailed information, see our Cookie Policy.
10. CHANGES TO THIS POLICY
We may update this Privacy Policy periodically. Material changes will be notified via email or in-platform notice. Continued use after notification constitutes acceptance.