Privacy Policy

At ÖzgürKod, we value your privacy. This policy explains how your personal data is collected, used, stored, and protected. By using our platform, you agree to this policy.

1. Data Controller

Data Controller: ÖzgürKod
Address: Tuzla, İstanbul, Türkiye
Email: [email protected]

We act as a data controller under the Turkish Data Protection Law (KVKK No. 6698) and the GDPR where applicable.

2. Personal Data Collected

2.1 Data Collected Directly From You

Account Creation:

• First name, last name
• Email address
• Phone number
• Company information
• Job title

Payment Information:

• Billing details (name, address, tax ID)
• Credit card information (via secure payment provider)

Platform Usage:

• Your customer database (data uploaded to CRM)
• Communication records (email, phone, messaging)
• Documents and files
• Customization preferences

2.2 Automatically Collected Data

• IP address
• Browser type and version
• Device information (OS, device type)
• Usage data (access times, click data)
• Cookies and similar technologies
• Log records

3. Purposes and Legal Bases for Processing

Purpose	Legal Basis
Service delivery and account management	Contractual necessity
Customer support	Contractual necessity
Payment processing and billing	Legal obligation
Security and fraud prevention	Legitimate interest
Product development and analytics	Legitimate interest
Marketing communications	Explicit consent

4. Use of Data

4.1 Core Service Delivery

• Enabling use of the CRM platform
• Account creation and authentication
• Storing and processing your customer data
• Running integrations (WhatsApp, Telegram, etc.)

4.2 Communication & Support

• Providing customer support
• Service update notifications
• Resolving technical issues
• Sending training and onboarding materials

4.3 Platform Development

• Usage analytics and performance monitoring
• Error detection and fixing
• Developing new features
• Improving user experience

4.4 Security & Compliance

• Fraud and abuse detection
• Vulnerability detection and remediation
• Legal compliance
• Providing necessary documents in legal proceedings

5. Data Sharing

5.1 Who Do We Share Your Data With?

Third-Party Service Providers:

• Cloud Infrastructure: AWS, Google Cloud (data storage)
• Payment Processors: Stripe (secure payments via Shopify)
• Email Services: SendGrid (transactional emails)
• Analytics Tools: Google Analytics (usage analytics)

Note: All third-party providers have signed data protection agreements and are KVKK/GDPR compliant.

5.2 Legal Obligations

We may share your data in the following cases:

• Court order or legal request
• Public safety and public order
• Criminal investigation
• Tax audit and financial controls

5.3 Business Transfer

In the event of a merger, acquisition, or asset sale, your data may be transferred. You will be notified in advance.

6. Data Security

6.1 Technical Security Measures

• Encryption: TLS/SSL for data transfer, AES-256 for data storage
• Access Control: Role-based access control (RBAC)
• Two-Factor Authentication (2FA): For account security
• Regular Security Scans: Penetration testing
• Firewall and DDoS Protection
• Automated Backups: Daily data backups

6.2 Organizational Measures

• Employee training and confidentiality agreements
• Least privilege principle
• Data access logs and monitoring
• Incident response plans

7. Data Retention Periods

Data Type	Retention Period
Account information	While account is active + 3 years
Customer data (CRM)	While account is active
Invoice and payment records	10 years (tax regulation requirement)
Communication records	3 years
Log records	1 year
Marketing consent	Until consent is withdrawn

After Account Cancellation: When you cancel your account, your data is retained for 30 days for recovery purposes. After this period, all data is permanently deleted (except legal retention requirements).

8. Cookie Policy

8.1 Types of Cookies We Use

Essential Cookies:

• Session management
• Security verifications
• Preference records

Analytics Cookies:

• Google Analytics (usage statistics)
• Hotjar (user behavior analysis)

You can manage cookie preferences through your browser settings.

9. Your Rights Under KVKK and GDPR

Under Article 11 of KVKK and the GDPR, you have the following rights:

1. Right to Information: Know whether your personal data is being processed
2. Right of Access: Request information about your processed data
3. Right to Rectification: Request correction of inaccurate or incomplete data
4. Right to Erasure: Request deletion of data under certain conditions
5. Right to Object: Object to data processing
6. Data Portability: Request transfer of your data to you or another controller
7. Right Against Automated Decisions: Object to decisions made solely by automated systems

9.1 How to Exercise Your Rights

• Email: [email protected]
• Contact Form: Contact Page

Response Time: Your request will be answered within 30 days.

10. Google Services and Google User Data

ÖzgürKod optionally offers Sign in with Google, Google Calendar, Google Ads and Gmail connections. These connections are established only when you sign in with your Google account and explicitly grant permission. This section explains how we access, use, store, share and delete data received through Google APIs.

10.1 Data We Access and Why

Connection	Data Accessed	Purpose
Sign in with Google	Name, email address, profile photo	Creating your account and signing you in
Google Calendar	Title, description, location, start and end time of events in your calendar	Creating, updating and deleting the appointments you create in the CRM in your calendar, and reflecting changes made in your calendar back to your CRM appointment calendar (two-way sync)
Google Ads	Ad account details; campaign, ad group, ad, keyword and search term reports; cost, click and conversion metrics; click identifiers (GCLID)	Reporting your ad performance in the CRM and matching your customer records to the campaign that brought them; pausing/resuming campaigns and updating daily budgets when you act or under rules you define; reporting confirmed sales to your own Google Ads account as conversions using the click identifier
Gmail	Email messages in the mailbox you connect (sender, recipients, subject, body, attachments) and permission to send email	Letting you read, reply to and send your emails inside the CRM, and linking conversations to the related customer record

We use Google user data only to provide and improve the user-facing features described above. We do not use this data to serve advertisements, we do not sell it, we do not use it to determine creditworthiness, and we do not build user profiles for third parties.

10.2 Storage and Security

• Access and refresh tokens issued by Google are stored encrypted on our servers and are never sent to your browser.
• Data imported from Google is kept only in your business's own database, isolated from our other customers.
• All data exchange with Google takes place over TLS-encrypted connections.
• Within your business, only users with the appropriate role permissions can access this data.

10.3 Sharing and Human Access

We do not sell Google user data or share it with third parties. ÖzgürKod staff do not read this data, except (a) where you have given explicit permission for us to look at specific data for support, (b) for security and abuse investigations, (c) to comply with applicable law, or (d) when the data is aggregated and anonymized for internal operations.

AI and Google user data: Data received from Google APIs (Google Calendar events, Google Ads account and campaign data, and Gmail messages) is never sent to any third-party AI service, in raw, aggregated, anonymized or derived form. This data is flagged in the CRM as "Google-sourced" and the code that prepares AI requests automatically excludes it: appointments imported from or edited in Google Calendar are not included in AI summaries, assistant answers or availability calculations sent to AI, Google Ads campaign and metric data is not included in the Ad Center's AI review (only rule-based recommendations run on those accounts), and emails from accounts connected through the Gmail API are not sent for AI analysis.

ÖzgürKod's AI features (message replies, summaries, analyses) work only with data the business enters into the CRM itself or receives through non-Google channels, and are sent to the provider selected by the business (Google Gemini API, OpenAI API, DeepSeek API, OpenRouter, MiniMax API). ÖzgürKod does not use, transfer or sell Google user data to develop, improve or train generalized AI and/or ML models.

10.4 Compliance with the Google API Services User Data Policy

ÖzgürKod's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10.5 Revoking Access and Deleting Data

• You can disconnect Google Calendar, Google Ads and Gmail at any time from the Integrations and Email settings screens in the CRM. When you disconnect, the tokens we store are deleted. If you have no other ÖzgürKod connection with the same Google account (for example, Calendar and Ads are not both connected), your permission is also revoked on Google's side; otherwise the Google permission is kept so the other connection keeps working.
• You can also remove access at any time from your Google account: myaccount.google.com/permissions
• Records imported into the CRM before disconnecting (appointments, emails, ad reports) are kept as part of your business's CRM data while your account remains active. To have them deleted, simply email [email protected]; your request will be fulfilled within 30 days.
• When you close your account, data received from Google is permanently deleted together with your other data, within the periods described in Section 7.

11. Meta Services (Facebook, Instagram, WhatsApp) and Meta Platform Data

ÖzgürKod optionally offers Facebook, Facebook Page, Instagram professional account and WhatsApp Business connections. These connections are established only when an authorized person at your business signs in with their Facebook or Instagram account and explicitly grants permission in Meta's permission dialog, and they work only for the Pages and accounts that person selects. This section explains how we use, store, share and delete data received through Meta APIs (Meta Platform Data).

11.1 Data We Access and Why

Feature	Data Accessed	Purpose
Connection and account selection	Your Facebook user ID, name and email address; the list of Facebook Pages, Instagram accounts and WhatsApp Business accounts you manage	Setting up the connection and letting you choose which Pages and accounts are connected to the CRM
Messages (Messenger, Instagram Direct, WhatsApp)	Messages and attachments from people who write to your business, their name or username and profile photo; on WhatsApp, their phone number	Showing messages in the CRM Message Center and letting you reply; linking conversations to the related customer record; automatic replies (chatbot) if you turn them on
Comments, mentions and recommendations	Comments on the posts and ads of your Facebook Page and Instagram account, @mentions and Facebook recommendations (ratings); the author's name or username	Showing them in the Social Media inbox; replying to, liking, hiding or deleting them when you act or under rules you define; linking the commenter to a customer or lead record
Publishing	The text, images and videos of posts you prepare in the CRM; the ID and link of published posts; the list of posts already published on your Page and account	Publishing your posts to the Page and Instagram account you choose, immediately or at the time you schedule; showing published posts in the calendar and deleting Facebook posts at your request
Insights	Page, account and post metrics (reach, views, engagement, follower count, aggregated and anonymous audience breakdowns)	Showing your social media performance in CRM reports and suggesting the best time to post
Lead ads	Form answers from people who fill in your lead ad forms	Creating lead records in the CRM from those answers
Ad accounts	Campaign, ad set and ad details; spend and result metrics	Reporting your ad performance; pausing and resuming campaigns, updating budgets and creating ads when you act or under rules you define; creating custom and lookalike audiences in your own ad account from your CRM customer list when you choose to (emails and phone numbers are sent hashed with SHA-256)
Conversions API	The email address and phone number of records that turned into sales in the CRM (hashed with SHA-256) and the sale event	Reporting confirmed sales to your own Meta ad account as conversions

We use Meta Platform Data only to provide and improve the user-facing features described above. We do not sell or license this data, we do not transfer it to data brokers, we do not use it to make eligibility decisions such as creditworthiness, employment, housing or insurance, and we do not build user profiles for ad targeting outside Meta's products.

11.2 Storage and Security

• Access tokens issued by Meta are stored only on our servers, in your business's database; they are never sent to your browser and are used only in requests to Meta APIs.
• Data received from Meta is kept only in your business's own database, isolated from our other customers; message and post media (images, videos, audio) are stored in Amazon Web Services (AWS) cloud storage.
• All data exchange with Meta takes place over TLS-encrypted connections.
• Within your business, only users with the appropriate role permissions can access this data; in the Social Media module, staff access is also granted per profile.

11.3 Sharing, Human Access and AI

We do not sell Meta Platform Data or share it with third parties; only the infrastructure providers required to deliver the service (hosting and cloud storage) process it on our behalf under contract. ÖzgürKod staff do not read this data, except (a) where you have given explicit permission for us to look at specific data for support, (b) for security and abuse investigations, and (c) to comply with applicable law.

AI and Meta Platform Data: When your business uses AI features (automatic message replies, comment reply suggestions, sentiment and topic analysis, summaries, post text suggestions), the related message, comment or post text is sent only to generate that reply or analysis, to the AI provider your business selects or ÖzgürKod provides (Google Gemini API, OpenAI API, Anthropic API, DeepSeek API, OpenRouter, MiniMax API). Your business controls which AI features are turned on in the CRM settings. ÖzgürKod does not use or transfer Meta Platform Data to train AI or machine learning models.

11.4 Compliance with the Meta Platform Terms

We process Meta Platform Data in accordance with the Meta Platform Terms and the Developer Policies.

11.5 Disconnecting

• You can disconnect Meta at any time with the "Disconnect" button on the Settings › Meta Settings screen in the CRM. When you disconnect, the Meta access tokens we store (user and Page tokens) are deleted and no new data is received from Meta.
• You can also remove access on Meta's side: on Facebook under Settings & privacy › Settings › Business integrations, and on Instagram under Settings › Website permissions › Apps and websites. facebook.com/settings?tab=business_tools
• Records imported into the CRM before disconnecting (messages, comments, leads, reports) are kept as part of your business's CRM data while your account remains active; you can delete them in the CRM or request their deletion as described below.

11.6 Data Deletion Requests

If you want the data we received through Meta to be deleted:

1. Business users: send an email to [email protected] with the subject "Meta data deletion request" and include your Facebook Page name or Instagram username. To stop new data from being received right away, you can first disconnect as described above.
2. People who messaged or commented on a business through Facebook, Instagram or WhatsApp: the business concerned is the data controller for these records and ÖzgürKod processes them on its behalf. You can send your request directly to the business, or email [email protected] with your Facebook or Instagram username or WhatsApp number and the name of the business you contacted; we will fulfil the request together with that business.
3. Your request is fulfilled within 30 days at the latest once your identity is verified, and the outcome is sent to you by email with a request number.
4. Removing the app on Meta stops new data from being received; to have existing records in the CRM deleted, send the request above. When you close your account, data received from Meta is permanently deleted together with your other data, within the periods described in Section 7.

12. Marketplace Connections (Trendyol, Hepsiburada, Çiçeksepeti, Amazon)

If your business connects a marketplace store in the Order Tracking module, ÖzgürKod reads that store's orders, returns and product listings on your business's behalf, and sends the updates your business turns on (stock, price, order status, shipping details) to the marketplace. This data is processed only within your business's CRM account, solely to provide the service to your business; it is not sold and is not used for advertising or marketing.

• Connection credentials: API keys issued by the marketplace or, for Amazon, the authorization issued by Amazon are stored encrypted with AES-256-GCM. For Amazon, ÖzgürKod never asks for a key or password; access is granted in Seller Central.
• Order data: order and package number, product, quantity, price, order status, shipping carrier and tracking number, return records.
• Trendyol, Hepsiburada and Çiçeksepeti buyers: the buyer name and delivery address needed for delivery are written to the order and customer record; for Çiçeksepeti, the card message and requested delivery date are also written to the order. The buyer's phone number is written to the order only if the business turns on this setting, and never to the customer record. The buyer's email address is not stored. Marketplace buyers are excluded from bulk campaigns from the start.
• Amazon buyers: the buyer's name, address, phone number, email address and gift message are not retrieved and not stored. Only the city and district of the delivery address are read; all Amazon orders are kept under a single shared "Amazon TR buyers" record. Orders fulfilled by Amazon (FBA) are not imported. From Amazon's returns report, only the order and return numbers, product, quantity, return reason, date, refunded amount and status are taken (the report contains no buyer details); the report file itself is not stored. No messages or campaigns are sent to Amazon buyers through ÖzgürKod.
• Revoking access and deletion: you can revoke the Amazon authorization at any time in Seller Central → Apps and Services → Manage Your Apps. When you delete the connection in ÖzgürKod, the stored credentials, product matches, return records and sync log are deleted immediately. Orders already imported remain part of your business's CRM data and are kept for the periods in Section 7; you can ask for their deletion by emailing [email protected], and the request will be fulfilled within 30 days.

13. For Shopify Store Users

This app is installed via the Shopify App Store. The app accesses customer name, email, phone number, order details, and shipping information through the Shopify API. This data is used solely for sending WhatsApp notifications and syncing customers to your CRM. Your data is never shared with or sold to third parties. When you uninstall the app, your Shopify webhook subscriptions and API access tokens are automatically revoked. Your CRM data is deleted after 30 days.

14. Data Breach Notification

In the event of a breach compromising personal data security, affected users will be notified via email, and required legal authorities will be notified within 72 hours.

15. Policy Updates

We may update this privacy policy from time to time. Significant changes will be notified via email and announced on the platform.

16. Contact & Complaints

Data Protection Officer:

• Email: [email protected]
• Address: Tuzla, İstanbul, Türkiye
• Phone: +90 542 154 43 45