Privacy Notice

This notice explains how [Company name] ("Tezgâh", "we") processes personal data under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

[Company name], [Address]. Contact: [contact e-mail]

2. Data we process

• Identity and contact: name, e-mail address.
• Account and security: user ID, password hash (scrypt), session records, IP address, browser data, activity logs.
• Customer transactions: subscription plan and status (payments are handled by Lemon Squeezy; we never see card data), support requests.
• Content: imported products, store plans, AI assistant prompts, searches, notification settings.
• Connections: access tokens of the stores and suppliers you connect (stored encrypted).

For buyer data in orders from your connected stores (name, address, phone, e-mail) you are the controller and we process it on your behalf (see the Data Processing Agreement).

3. Purposes and legal bases

We process data to create and manage your account, provide product research, store setup, price/stock sync, order and shipping automation, run subscriptions, keep the service secure and answer requests — based on performance of a contract, legal obligations, establishment of legal claims and our legitimate interests (KVKK art. 5/2-c, ç, e, f; GDPR art. 6(1)(b), (c), (f)). International transfers rely on KVKK art. 9 and, where required, your explicit consent.

4. Recipients

Data is shared only as needed to provide the service. Some recipients are located outside Türkiye (EU, USA, China):

• Hosting: the application and database run on a virtual private server (VPS) we rent; daily encrypted backups are kept on the same server.
• Payments: Lemon Squeezy LLC (USA) acts as the seller and Merchant of Record for subscriptions. We never receive your card details.
• AI: Google LLC (Gemini), Groq, Inc., Cerebras Systems, Inc., OpenRouter, Inc., OpenAI, L.L.C. (if enabled by the operator) — only the text and product data you submit to AI features.
• Sales channels you connect: Shopify Inc., eBay Inc., your WooCommerce site, Trendyol — product, stock, price, order and shipping data.
• Suppliers you connect: CJ Dropshipping, AliExpress (Alibaba Group), Printify, Inc. — the buyer's name, shipping address, phone and order lines needed to place the supplier order.
• Notifications: our e-mail (SMTP) provider and, if you enable it, Telegram Messenger Inc.
• Security and delivery: Cloudflare, Inc. (USA) — all traffic to the site passes through Cloudflare's network for attack and bot protection (IP address, browser data, requested URL); the human check on sign-up and sign-in (Turnstile); and, if enabled by the operator, a page-reading relay.
• E-mail delivery: verification, password-reset and notification e-mails are sent through our e-mail service provider (SMTP); only your e-mail address and the message.
• Technical: Google Fonts (fonts; your IP address reaches Google).

We do not sell personal data or share it for advertising.

5. Retention

Data is kept while your account is open. When you delete your account, account, product, order and connection data is deleted and removed from backups within 30 days. Security logs are kept for the period required by law; subscription and payment records are retained by Lemon Squeezy for tax purposes.

6. Your rights

You may request access, rectification, erasure, restriction, objection, data portability and information about recipients, and you may lodge a complaint with the Turkish Personal Data Protection Authority or your local supervisory authority. Download your data or delete your account from the Account page; for other requests write to [contact e-mail] or open a support ticket ("Personal data request"). We respond within 30 days, free of charge.

Last updated: 15 October 2026