Privacy policy

DRAFT — not legal advice. Requires review by a qualified lawyer before use.

• Document: Privacy Policy (platform as controller) · Language: English · Version: 0.1 draft · Date: 2026-10-26
• Basis: docs/research/06-legal-compliance.md R4, F2, F8, F9, F10. All placeholders were closed on 2026-10-27 (F1-64); sentences marked † still await lawyer confirmation (listed in the last section). Company country: Türkiye.
• Türkiye users: see also the KVKK Notice (kvkk-aydinlatma.tr.md), which is kept separate from any consent text.

1. Who we are

1.1 The controller of the personal data described in this policy is Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship), Türkiye, Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul (“we”). Contact for privacy matters: privacy@gondero.com; data protection officer, if appointed: none has been appointed.†

1.2 We do not currently have a representative under GDPR Art.27 / UK GDPR. Whether Art.3(2) applies to our platform is under legal review. If a representative is required, we will appoint one in the EU and in the UK and publish the name and address here.†

1.3 We are not registered in VERBİS (the Data Controllers’ Registry). Whether registration is required is being confirmed with a lawyer and the accountant: domestic controllers are exempt below 50 employees and an annual balance-sheet total of 100 million TL unless special-category data is their main activity, while controllers established abroad are listed as obliged to register regardless of size (06 F1.3).†

2. Scope: what this policy covers and what it does not

2.1 Covered: personal data about visitors to our website and about the people and organisations that hold an account with us, including billing contacts, Authorised Users, support requests and security logs. For this data we are the controller.

2.2 Not covered: the personal data of leads and message recipients that our customers upload or source. For that data our customer is the controller and we process it on the customer’s behalf under the Data Processing Agreement. If you received a message sent by one of our customers, contact that customer; we will help them answer you.

2.3 We do not combine lead personal data across customers, and we do not build a shared lead database.

3. Data we collect

3.1 Account data: name, work email, role, organisation, credentials (stored hashed or encrypted), two-factor settings. 3.2 Billing data: billing contact, tax details and payment status. Payment card data is handled by PayTR; the card number is entered on PayTR’s secured page. 3.3 Usage and security data: logins, IP address, device and browser data, audit logs, API usage, abuse-prevention signals. 3.4 Support data: messages you send us and, in a support session you have authorised, what is needed to resolve the issue. 3.5 Connection data: tokens and settings for mailbox and third-party connections, stored encrypted. We do not display secrets back to you or write them to logs.

4. Purposes and legal bases

4.1 The table lists proposed purposes and bases. Proposed, lawyer to confirm for each jurisdiction.

4.2 Where we rely on legitimate interests we have weighed them against your rights, and you can object (section 10).

4.3 Where we ask for consent, we ask for it separately from this policy and you can withdraw it at any time.

5. Cookies and similar technologies

5.1 Website. The website sets no cookies and uses no similar technology (decision of 2026-10-27; see the Cookie Notice, section 2). It has no analytics, advertising or third-party resources, and nothing is used to measure, profile or track visitors. Panel. After sign-in the panel uses a session cookie that is strictly necessary for the service you asked for, and no advertising cookies (Cookie Notice, section 4). The platform’s outbound emails do not use an open-tracking pixel by default; that is a customer setting and a separate matter covered by the customer’s own notices.

5A. Website visitors and people who e-mail us

Added 2026-10-27 (F1-87). The section number 5A keeps the numbering of the other sections unchanged. Lawyer review required, like the rest of this draft.

5A.1 Scope. This section covers visitors to the Gondero marketing website and people who write to us by e-mail about early access, a demo or a question. It does not cover account holders (sections 3 and 4) or the leads of our customers (section 2.2).

5A.2 What the website does. The website is made of static pages. It has no account, no contact form, no analytics and no third-party resources (fonts and scripts come from our own host). It sets no cookies; see the Cookie Notice.

5A.3 Server logs. The company that hosts the website, Hostinger, processes standard server logs (IP address, time, requested page, browser data) to deliver and secure the site. Hostinger keeps these logs under its own retention schedule, which we have not confirmed (DOĞRULANAMADI).† The data centre that holds the website is chosen at publication and is not yet confirmed (DOĞRULANAMADI). Hostinger’s published VPS locations are FR, DE, LT, UK, IN, ID, MY, US and BR and none is in Türkiye (research report 13), so logs may be processed outside Türkiye. Transfer mechanism: the KVKK standard contract path for data subject to KVKK, and the transfer rules of the visitor’s region otherwise (section 7).†

5A.4 E-mail you send us. The buttons on the site open your own mail app with a pre-filled message. The page itself sends nothing. If you send the message, we receive your e-mail address, the name, company and country you write, and the message. We use it to reply and to keep a record of the request. Proposed basis: legitimate interest and steps taken at your request before a contract (proposed, lawyer to confirm). We keep the request for 12 months after our last contact with you, then delete or anonymise it (the platform default for contacts without engagement, 06 T4).†

5A.5 Sharing. We do not sell this data and we do not use it for profiling. It is shared only with the providers that run our e-mail and hosting (https://gondero.com/en/legal/subprocessors/). We send you marketing only if you ask us to.

5A.6 Your rights. Section 10 applies. Write to privacy@gondero.com.

6. Sharing and sub-processors

6.1 We share data only with: (a) service providers acting on our instructions (hosting, email infrastructure for our own transactional emails, billing, error monitoring, AI providers); (b) professional advisers and authorities where required by law; (c) a successor in a merger or sale, with notice to you.

6.2 The current sub-processors are listed in https://gondero.com/en/legal/subprocessors/. Our own transactional email (invitations, password resets, alerts) goes through a separate platform sender and never carries customer campaign content.

6.3 We do not sell personal data.

7. International transfers

7.1 Where personal data leaves its country of collection, we use a lawful transfer mechanism: EU Standard Contractual Clauses (Modules 2 and 3), the UK Addendum, and, for personal data originating in Türkiye, the Turkish Personal Data Protection Board’s standard contract used unchanged and notified within 5 business days of signature (KVKK art.9).

7.2 Türkiye has no EU adequacy decision. The hosting provider and region of the platform are not yet selected (ADR-008), and the first release has no region pinning. For personal data of Turkish origin the KVKK standard contract path applies, for EU/EEA origin the EU Standard Contractual Clauses, and for UK origin the UK Addendum (DPA Annex D).†

7.3 We have not found a KVKK adequacy decision; we design as if none exists.

8. AI processing

8.1 Features that use AI models are designed so that lead personal data is not sent to the model by default: prompts use placeholders that are filled after generation.

8.2 Where an AI feature must process personal data (for example classifying a reply), we use it only where a transfer basis exists for the person’s region. Our planned AI provider is Anthropic. Its inference region can only be global or the US, with no EU option, and its DPA does not cover KVKK (sub-processor list, row 2).†

8.3 Our AI provider’s inputs and outputs are deleted within 30 days by default, with exceptions (for example files and policy-violation flags), unless a zero-data-retention arrangement applies. The provider’s current terms apply and are confirmed before the feature is released.†

8.4 Access to your workspace data from your own AI client (MCP) is off by default and enabled only by a workspace owner or administrator.

9. Retention

9.1 The proposed defaults below apply to data we process; tenant-adjustable periods apply to customer-controlled data. Proposed, lawyer to confirm.

9.2 After cancellation your workspace moves to pending deletion for 30 days, after which we delete it.

10. Your rights

10.1 Depending on where you live, you may have the right to access, correct, delete, restrict or port your data, to object to processing (including an absolute right to object to direct marketing), and to withdraw consent.

10.2 We answer requests within one month under GDPR and UK GDPR (extendable by two months in the cases the law allows), and within 30 days, free of charge, under KVKK art.13/2. California residents may have rights under the CCPA where its thresholds apply.

10.3 To exercise a right, write to privacy@gondero.com. You may also complain to your data protection authority (for Türkiye, the KVKK Board).

11. Security

11.1 We use technical and organisational measures appropriate to the risk, including tenant isolation, encryption of stored credentials, access control, audit logging and two-factor authentication. The measures are listed in the Data Processing Agreement, Annex B.

11.2 Our administrators do not read customer content except in a logged, time-limited support session.

11.3 If a personal data breach affects your data, we notify the people and authorities concerned as the law requires. Under KVKK art.12/5 the controller notifies the data subject and the KVKK Board as soon as possible; under GDPR Art.33 and 34 the controller notifies the supervisory authority and, where the risk is high, the data subjects. For customer lead data we inform the customer without undue delay (DPA, section 9).†

12. Changes to this policy

12.1 We will update this policy when our processing changes and tell you of material changes in good time before they apply. The version and date are shown at the top.

13. Contact

13.1 Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship), Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul, privacy@gondero.com.

14. Notes for the reviewing lawyer

• The Art.27 representative (1.2), VERBİS (1.3) and hosting residency (7.2) are stated as under review; the lawyer decides (06 F10, L8, R6).
• Confirm the platform/tenant role split (controller for account data, processor for lead data) and that no shared cross-tenant lead cache or global suppression makes the platform a controller (06 F10, L5).
• Retention values in section 9 are 06 proposals (T4), not legal minimums or maximums; confirm per jurisdiction.
• Confirm the KVKK art.5/2 bases and the separation of the KVKK Notice from consent text (06 F1.3, decision 2026/347 [S]).
• Confirm AI transfer wording: Anthropic’s DPA covers EU SCC Modules 2 and 3, the UK Addendum and Swiss law but not KVKK and not the DPF; whether any vendor would sign the KVKK standard contract is DOĞRULANAMADI (06 F8).
• Filled 2026-10-27 (F1-89) from content-input/company.md: name, tax office and number, address and e-mail addresses. It is a sole proprietorship, so there is no MERSIS number; the tradesperson or trader status is for the accountant to confirm. The mailboxes hello@, support@, privacy@, billing@ and security@gondero.com are open. legal@, abuse@, postmaster@, dmarc@ and no-reply@ do not exist yet, so hello@gondero.com is used for legal notices and abuse reports until they do. Statements in the header that the company country is unknown are superseded (Türkiye); the options were decided on 2026-10-27. All placeholders were closed on 2026-10-27 (F1-64); the status table is in README.md.
• † Clauses awaiting lawyer confirmation: 1.1, 1.2, 1.3, 4.1, 5A.3, 5A.4, 7.2, 8.2, 8.3, 9.1, 11.3.