At ÖzgürKod, we value your privacy. This policy explains how your personal data is collected, used, stored, and protected. By using our platform, you agree to this policy.
1. Data Controller
Data Controller: ÖzgürKod
Address: Tuzla, Istanbul, Türkiye
Email: [email protected]
We act as a data controller under the Turkish Data Protection Law (KVKK No. 6698) and the GDPR where applicable.
2. Personal Data Collected
2.1 Data Collected Directly From You
Account Creation:
- First name, last name
- Email address
- Phone number
- Company information
- Job title
Payment Information:
- Billing details (name, address, tax ID)
- Credit card information (via secure payment provider)
Platform usage:
- Your customer database (data uploaded to CRM)
- Communication records (email, phone, messaging)
- Documents and files
- Customization preferences
2.2 Automatically collected data
- IP address
- Browser type and version
- Device information (OS, device type)
- Usage data (access times, click data)
- Cookies and similar technologies
- Log records
3. Purposes and legal bases for processing
| Purpose |
Legal basis |
| Service delivery and account management |
Contractual necessity |
| Customer support |
Contractual necessity |
| Payment processing and billing |
Legal obligation |
| Security and fraud prevention |
Legitimate interest |
| Product development and analytics |
Legitimate interest |
| Marketing communications |
Explicit consent |
4. Use of data
4.1 Core service delivery
- Enabling use of the CRM platform
- Account creation and authentication
- Storing and processing your customer data
- Running integrations (WhatsApp, Telegram, etc.)
4.2 Communication and support
- Providing customer support
- Service update notifications
- Resolving technical issues
- Sending training and onboarding materials
4.3 Platform development
- Usage analytics and performance monitoring
- Error detection and fixing
- Developing new features
- Improving user experience
4.4 Security and compliance
- Fraud and abuse detection
- Vulnerability detection and remediation
- Legal compliance
- Providing necessary documents in legal proceedings
5. Data sharing
5.1 Who do we share your data with?
Third-party service providers:
- Cloud infrastructure:
AWS, Google Cloud (data storage)
- Payment processors:
Stripe (secure payments via Shopify)
- Email services:
SendGrid (transactional emails)
- Analytics tools:
Google Analytics (usage analytics)
Note: All third-party providers have signed data protection agreements and are KVKK/GDPR compliant.
5.2 Legal obligations
We may share your data in the following cases:
- Court order or legal request
- Public safety and public order
- Criminal investigation
- Tax audit and financial controls
5.3 Business transfer
In the event of a merger, acquisition, or asset sale, your data may be transferred. You will be notified in advance.
6. Data security
6.1 Technical security measures
- Encryption:
TLS/SSL for data transfer, AES-256 for data storage
- Access control:
Role-based access control (RBAC)
- Two-factor authentication (2FA):
For account security
- Regular security scans:
Penetration testing
- Firewall and DDoS protection
- Automated backups:
Daily data backups
6.2 Organizational measures
- Employee training and confidentiality agreements
- Least privilege principle
- Data access logs and monitoring
- Incident response plans
7. Data retention periods
| Data type |
Retention period |
| Account information |
While the account is active + 3 years |
| Customer data (CRM) |
While the account is active |
| Invoice and payment records |
10 years (required by tax regulations) |
| Communication records |
3 years |
| Log records |
1 year |
| Marketing consent |
Until consent is withdrawn |
After account cancellation: When you cancel your account, your data is retained for 30 days for recovery purposes. After this period, all your data is permanently deleted (except where legal retention requirements apply).
8. Cookie policy
8.1 Types of cookies we use
Essential cookies:
- Session management
- Security verifications
- Preference records
Analytics cookies:
- Google Analytics (usage statistics)
- Hotjar (user behavior analysis)
You can manage your cookie preferences through your browser settings.
9. Your rights under KVKK and GDPR
Under Article 11 of KVKK (Turkey’s personal data protection law) and the GDPR, you have the following rights:
- Right to information:
Find out whether your personal data is being processed
- Right of access:
Request information about the data processed about you
- Right to rectification:
Request correction of inaccurate or incomplete data
- Right to erasure:
Request deletion of data under certain conditions
- Right to object:
Object to data processing
- Data portability:
Request transfer of your data to you or to another controller
- Right against automated decisions:
Object to decisions made solely by automated systems
9.1 How to exercise your rights
Response time: Your request will be answered within 30 days at the latest.
10. Google services and Google user data
ÖzgürKod optionally offers Sign in with Google, Google Calendar, Google Ads and Gmail connections. These connections are established only when you sign in with your Google account and explicitly grant permission. This section explains how we use, store, share and delete data received through Google APIs.
10.1 Data we access and why
| Connection |
Data accessed |
Purpose |
| Sign in with Google |
Name, email address, profile photo |
Creating your account and signing you in |
| Google Calendar |
Title, description, location, start and end time of events in your calendar |
Creating, updating and deleting the appointments you create in the CRM in your calendar, and reflecting changes made in your calendar back to your CRM appointment calendar (two-way sync) |
| Google Ads |
Ad account details; campaign, ad group, ad, keyword and search term reports; cost, click and conversion metrics; click identifiers (GCLID) |
Reporting your ad performance in the CRM and matching your customer records to the campaign that brought them; pausing/resuming campaigns and updating daily budgets when you act or under rules you define; reporting confirmed sales to your own Google Ads account as conversions using the click identifier |
| Gmail |
Email messages in the mailbox you connect (sender, recipients, subject, body, attachments) and permission to send email |
Letting you read, reply to and send your emails inside the CRM, and linking conversations to the related customer record |
We use Google user data only to provide and improve the user-facing features described above. We do not use this data to serve advertisements, we do not sell it, we do not use it to determine creditworthiness, and we do not build user profiles for third parties.
10.2 Storage and security
- Access and refresh tokens issued by Google are stored encrypted on our servers and are never sent to your browser.
- Data imported from Google is kept only in your business's own database, isolated from our other customers.
- All data exchange with Google takes place over TLS-encrypted connections.
- Within your business, only users with the appropriate role permissions can access this data.
10.3 Sharing and human access
We do not sell Google user data or share it with third parties. ÖzgürKod staff do not read this data, except (a) where you have given explicit permission for us to look at specific data for support, (b) for security and abuse investigations, (c) to comply with applicable law, or (d) when the data is aggregated and anonymized for internal operations.
AI and Google user data: Data received from Google APIs (Google Calendar events and Gmail messages) is never sent to any third-party AI service, in raw, aggregated, anonymized or derived form. This data is flagged in the CRM as "Google-sourced" and the code that prepares AI requests automatically excludes it: appointments imported from or edited in Google Calendar are not included in AI summaries, assistant answers or availability calculations sent to AI, and emails from accounts connected through the Gmail API are not sent for AI analysis.
ÖzgürKod's AI features (message replies, summaries, analyses) work only with data the business enters into the CRM itself or receives through non-Google channels, and are sent to the provider selected by the business (Google Gemini API, OpenAI API, DeepSeek API, OpenRouter, MiniMax API). ÖzgürKod does not use, transfer or sell Google user data to develop, improve or train generalized AI and/or ML models.
10.4 Compliance with the Google API Services User Data Policy
ÖzgürKod's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
10.5 Revoking access and deleting data
- You can disconnect Google Calendar, Google Ads and Gmail at any time from the Integrations and Email settings screens in the CRM. When you disconnect, your permission is also revoked on Google's side and the tokens we store are deleted.
- You can also remove access at any time from your Google account: myaccount.google.com/permissions
- Records imported into the CRM before disconnecting (appointments, emails, ad reports) are kept as part of your business's CRM data while your account remains active. To have them deleted, simply email [email protected]; your request will be fulfilled within 30 days.
- When you close your account, data received from Google is permanently deleted together with your other data, within the periods described in Section 7.
11. Marketplace connections (Trendyol, Hepsiburada, Çiçeksepeti, Amazon)
If your business connects a marketplace store in the Order Tracking module, ÖzgürKod reads that store's orders, returns and product listings on your business's behalf, and sends the updates your business turns on (stock, price, order status, shipping details) to the marketplace. This data is processed only within your business's CRM account, solely to provide the service to your business; it is not sold and is not used for advertising or marketing.
- Connection credentials: API keys issued by the marketplace or, for Amazon, the authorization issued by Amazon are stored encrypted with AES-256-GCM. For Amazon, ÖzgürKod never asks for a key or password; access is granted in Seller Central.
- Order data: order and package number, product, quantity, price, order status, shipping carrier and tracking number, return records.
- Trendyol, Hepsiburada and Çiçeksepeti buyers: the buyer name and delivery address needed for delivery are written to the order and customer record; for Çiçeksepeti, the card message and requested delivery date are also written to the order. The buyer's phone number is written to the order only if the business turns on this setting, and never to the customer record. The buyer's email address is not stored. Marketplace buyers are excluded from bulk campaigns from the start.
- Amazon buyers: the buyer's name, address, phone number, email address and gift message are not retrieved and not stored. Only the city and district of the delivery address are read; all Amazon orders are kept under a single shared “Amazon TR buyers” record. Orders fulfilled by Amazon (FBA) are not imported. From Amazon's returns report, only the order and return numbers, product, quantity, return reason, date, refunded amount and status are taken (the report contains no buyer details); the report file itself is not stored. No messages or campaigns are sent to Amazon buyers through ÖzgürKod.
- Revoking access and deletion: you can revoke the Amazon authorization at any time in Seller Central → Apps and Services → Manage Your Apps. When you delete the connection in ÖzgürKod, the stored credentials, product matches, return records and sync log are deleted immediately. Orders already imported remain part of your business's CRM data and are kept for the periods in Section 7; you can ask for their deletion by emailing [email protected], and the request will be fulfilled within 30 days.
12. For Shopify store users
This app is installed via the Shopify App Store. The app accesses customer name, email address, phone number, order details and shipping information through the Shopify API. This data is used solely for sending WhatsApp notifications and saving customers to your CRM. Your data is never shared with or sold to third parties. When you uninstall the app, your Shopify webhook subscriptions and API access token are automatically revoked. Your CRM data is deleted after 30 days.
13. Data breach notification
In the event of a breach that compromises the security of personal data, affected users are notified by email and the required legal authorities are notified within 72 hours.
14. Policy updates
We may update this privacy policy from time to time. Significant changes are notified by email and announced on the platform.
15. Contact and complaints
Data Protection Officer:
At ÖzgürKod, we prioritize your privacy and data security. You can always contact us with your questions.