Privacy Notice

This notice explains what personal data gekopilot processes, why, how long it is kept and how you can have it removed. It describes the same processing as the Turkish KVKK notice; it is written for readers outside Türkiye rather than translated clause by clause.

The controller is Anomeda Yazılım ve Danışmanlık Aytuğ Topçu, Fevzi Çakmak Mah. Sadullah Ağa Sok. Toprak Apt. No:12/1, Balçova / İzmir, Türkiye. Requests: [email protected] · general contact [email protected] · registered e-mail [email protected].

What we process

During a free scan: the domain or brand you enter, the brand profile extracted from publicly available content at that address, the measurement results, and the IP address the request came from. We do not ask for identity information at this stage.

If you have no website: brand name, industry, city or service area, a product/service description and, optionally, official profile addresses, phone and e-mail. These are brand profile data, used to set up the measurement and to check what AI systems say about you. This form sends you no e-mail and creates no contact record.

When you request the report: your name, e-mail address and company name if given. If you ask for a call, your phone number and preferred time. This step is separate and runs on your explicit consent.

When you open an account: your name, e-mail address, company name and an irreversible hash of your password. The password itself is stored nowhere and never written to records or logs. Other technical data processed with the account: the session cookie, the IP address used to rate-limit sign-in and sign-up attempts, your interface language, the date you confirmed your e-mail address, and irreversible digests of password reset and e-mail confirmation links together with their expiry. The links themselves are not stored — we hold only a digest, so we cannot reproduce a link we sent you.

Purchases and scan entitlements: which product you bought, the amount and currency, the payment date, when the entitlement starts and ends, and which scan ran in which period. For a payment we also keep the provider's transaction reference and the order/session references we generate ourselves.

Billing details collected at checkout: your first and last name, phone number, billing address, city and country. These are the fields our payment provider requires, and we keep them on your account so the form can be pre-filled next time.

We do not store your national ID / tax number. Our payment provider requires this field on every payment request, but it does not need to *stay* with us: the number is placed in that single request and there is no such column in our database. That is why you have to enter it again for each payment — this is a deliberate data-minimisation decision, not an oversight. The number is also never written to our logs, audit records or admin screens.

We never see your card details. The card number, expiry date and CVV are entered on the payment provider's own page; those fields never reach our servers, are not stored by us and are not written to our logs. The party that processes card data is the payment provider; all we hold is the outcome of the payment (success or failure), the transaction reference and the amount.

IP addresses are processed only to prevent abuse, to count the daily free scan allowance and to rate-limit sign-in and sign-up attempts.

Requests to your site: during a scan we read the home page of the address you entered, a few corporate pages where present, and `robots.txt`. Only publicly available content is read; no forms are submitted and no session is opened. Private network and local addresses are never requested. If you have no website, no address is requested at all — the profile addresses you give are only format-checked.

Legal bases

Measurement data is processed to produce the service itself, on the basis of legitimate interest. Contact details are processed on your explicit consent only, to send the report and to get in touch. The consent box is never pre-ticked and the form cannot be submitted without it.

Account and purchase data is processed to form and perform a contract; it rests on the contractual relationship rather than consent and continues while your account is open.

You may withdraw consent at any time, and your contact details are deleted when you do. The moment of consent is recorded server side together with the version of the notice you consented to, so it can be shown afterwards which text applied.

Who we share it with

During a measurement, questions are sent to the APIs of AI providers. Those questions are the industry's standard questions or questions generated for your brand; your contact details are never included in those calls.

E-mail: reports and notifications are sent through Resend. Your name, e-mail address and the message itself, including any report PDF, are passed to that provider. The provider also reports back whether the message was delivered, bounced or drew a complaint, and we keep that in your delivery record. There is no open tracking and no tracking pixel in our e-mails; we do not measure whether you opened a message.

Hosting and infrastructure: our server hosting provider and Cloudflare in front of it (domain, bot protection). Your data is not shared with or sold to anyone else.

How long we keep it

Contact details are kept for at most 2 years, counted from the date the record was created. At the end of that period your name, e-mail address, phone number, company name, call note, preferred time and IP address are deleted and the consent record lapses with them. What remains is a measurement record that does not identify a person (domain, industry, score) — the series that shows how a brand's visibility changed.

The automated job that does this is written and runs daily. It is currently in counting mode: it finds expired records and reports them, and deletion is carried out with a person's approval. There is a practical reason — the service went live in September 2026, so not a single record has yet reached 2 years. When the first ones approach the limit the job will switch to deleting and this page will be updated. Each run writes how many records were found and cleaned to the audit log; no personal data from a deleted record enters that log.

If you want your data removed sooner, write to the address below and we do it within 30 days at the latest. On request we also place a send block on the record, so no e-mail goes out to you while deletion is pending. The same block is applied automatically if you report spam or if your address hard-bounces, and we never e-mail that address again.

Measurement results (questions, assistant answers, score) continue to be kept, because they show how a brand's visibility changes over time. Those records are at domain and brand level and contain no contact details.

Your account

There is no button yet that lets you delete your account yourself. Write to the request address below and we do it by hand. We say so plainly rather than describe a button that does not exist.

When an account is deleted, your name, e-mail address and session records are deleted. Measurement records and purchase records remain: the first is the product itself, the second is an accounting record, and both must be kept.

E-mail confirmation: when you open an account we send a single-use confirmation link to your address, valid for 3 days and invalid once used. You can request a new one from your account. Confirmation is a precondition for purchase; the rest of the service works without it. Password reset links are also single-use and valid for 2 hours.

Your rights

Depending on where you are, you may have rights to learn whether your personal data is processed, to obtain information and a copy, to have inaccurate data corrected, to have data erased, to object to processing and to lodge a complaint with a supervisory authority. Mandatory rights under the law applicable to you are not limited by this notice.

Send requests to [email protected]. We respond within 30 days at the latest.

Cookies

There are no analytics, advertising or tracking cookies on this site, we use no site analytics, and we write nothing to your browser's local storage. The only components in use are strictly necessary ones — two session cookies and Cloudflare Turnstile for bot protection. The [Cookie Policy](/en/cookies) describes them in full and explains why no consent banner is shown.