Terms of service

DRAFT — not legal advice. Requires review by a qualified lawyer before use.

• Document: Terms of Service (platform and customers) · Language: English · Version: 0.1 draft · Date: 2026-10-26
• Basis: docs/research/06-legal-compliance.md R4 and brief §8. All placeholders were closed on 2026-10-27 (F1-64) from docs/decisions/01-defaults-2026-10-27.md and the research reports. Sentences marked † still await lawyer confirmation (listed in the last section). Nothing here is a final commitment.
• Company country: Türkiye (content-input/company.md). The open options were decided on 2026-10-27 (01-defaults); where an option was chosen, the other was removed.

---

1. Parties and definitions

1.1 These Terms of Service (the “Terms”) are an agreement between Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship), a business established in Türkiye, registered office Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul, registration number none (sole proprietorship; tax number 7430527303, Halkalı Tax Office) (“we”, “us”, the “Provider”), and the organisation that registers for the service (the “Customer”, “you”).

1.2 “Service” means the multi-tenant outreach platform offered under the name Gondero, including the web application, API and any integrations we enable.

1.3 “Customer Data” means the data you or your users upload to, connect to or generate in the Service, including contacts, companies, lead lists, campaign content, mailbox connections and message content.

1.4 “Recipient” means a person who receives or is intended to receive a message sent through the Service. “Authorised User” means a person you allow to use your workspace.

2. The service

2.1 The Service lets you define target-customer profiles, import or source leads, connect your own email account, and run multi-step email campaigns with country-aware compliance controls.

2.2 By default, messages are sent from your own mailbox (SMTP, Gmail OAuth or Microsoft 365 OAuth). We do not send your cold outreach from our own infrastructure.

2.3 We may change, add or remove features. We will give notice of material reductions to paid features as described in section 16.

3. Accounts, eligibility and security

3.1 The Service is for businesses and professionals. You confirm that you register on behalf of an organisation and have authority to bind it.

3.2 You keep your credentials confidential and are responsible for all activity under your workspace. You must enable the security controls we require, which may include two-factor authentication.

3.3 New workspaces may be subject to graduated sending limits and to email and phone verification before sending starts. These controls protect the platform and other customers.

3.4 The Service is offered to businesses and professionals (companies and sole traders with a tax number) and to persons with legal capacity who act for them. It is not offered to consumers.†

4. Customer responsibilities for outreach compliance

4.1 You are responsible for your outreach. You decide who is contacted, what is sent and on what legal basis. For lead data you provide or source, you are the data controller (veri sorumlusu) and we act as processor (veri işleyen), as set out in section 6 and the Data Processing Agreement.

4.2 The Service contains compliance controls (country rules, consent records, unsubscribe handling, footer fields). These controls support you but do not replace your own legal assessment and do not guarantee that a campaign is lawful in any country.

4.3 You must:

• (a) set the correct country and recipient type for each list or contact, and keep the sender details you give us accurate;
• (b) not send cold email to recipients in jurisdictions or recipient categories where prior consent is required unless you hold a valid consent record;
• (c) honour every opt-out and objection, and keep the platform’s suppression data intact;
• (d) keep records of the source of each lead and, where you rely on consent or on an İYS registration, of that consent or registration;
• (e) complete the onboarding compliance module and the confirmation described in it.

4.4 Country rules summarised in the Service are drafts of product rules and are not legal advice. You should take advice from a lawyer qualified in each jurisdiction you target.

5. Acceptable use

5.1 Your use of the Service is subject to the Acceptable Use Policy, which forms part of these Terms.

5.2 In particular, you must not use the Service to: scrape LinkedIn or Google Maps through the platform; send messages to consent-required recipients without consent; use lead lists without a source you can document; send phishing, fraudulent or deceptive content; or circumvent sending limits or safety controls.

6. Customer Data, roles and data protection

6.1 Roles. For Customer Data about leads and Recipients, you are the controller and we are the processor. For account, billing and security data about your Authorised Users and your organisation, we are an independent controller (see the Privacy Policy and, for Türkiye, the KVKK Notice).

6.2 Our processing of Customer Data on your behalf is governed by the Data Processing Agreement, which applies automatically once you accept these Terms.

6.3 We do not reuse lead personal data across customers. Each workspace is isolated from other workspaces. We keep platform-level suppression only for hard bounces, spam complaints, abuse and requests sent to us directly.

6.4 You are responsible for giving Recipients the notices that the law requires of you as controller, including the source of their data. The Service provides notice blocks you can include in your first email; their legal sufficiency is your responsibility.

6.5 Transfers of personal data outside the country where it was collected depend on the hosting and sub-processors described in the Data Processing Agreement. The hosting provider of the platform is not yet selected (see the sub-processor list). Personal data of Turkish origin is transferred under the KVKK standard contract used unchanged, data of EU/EEA origin under the EU Standard Contractual Clauses, and data of UK origin under the UK Addendum (DPA Annex D).†

7. Mailbox connections and third-party services

7.1 You authorise us to connect to your mailbox providers, lead-data providers and other third-party services you select, and to use credentials you provide. We store credentials encrypted and do not display them back to you.

7.2 Your use of third-party services is subject to their terms (for example mailbox provider policies and lead-provider terms). You are responsible for holding any account or licence a provider requires, and we cannot distribute a third party’s data to you beyond what its terms allow.

7.3 Mailbox providers set their own limits and rules. Their action against your mailbox (including suspension) is outside our control.

8. AI features

8.1 Some features use AI models from third-party providers. By default, lead personal data is not sent to AI models: templates and summaries use placeholders that are filled in after generation.

8.2 Features that necessarily process Recipient content (for example reply classification) are available only where a transfer basis exists for the Recipient’s region. Where no such basis exists, the feature is switched off for that region. The inference region of our AI provider can only be global or the US; there is no EU option (sub-processor list, row 2).†

8.3 Access to your workspace data from your own AI client (such as through MCP) is off by default and can be enabled only by a workspace owner or administrator. Enabling it is your documented instruction to us to make that data available to that client, and you accept responsibility for the client provider as your own recipient.

8.4 AI output may be wrong. You review messages before they are sent. We do not guarantee the accuracy, suitability or lawfulness of AI output.

9. Fees, subscription and billing

9.1 Fees, plan limits and billing periods are those shown on the plan page of the website and in the order summary at checkout. Card payments are taken through PayTR (see the Distance Sales Agreement).

9.2 Prices are in Turkish lira (TL) and exclude VAT (KDV), which is added at the rate in force and shown separately in the order summary. Payment is by card through PayTR. No instalment payment is offered.

9.3 Usage that exceeds your plan limits may be limited or charged as set out in the plan. When a plan limit is reached, new resources or usage above the limit are blocked and nothing already set up is switched off. There is no automatic postpaid overage charge. You can change plan or, for credit-based features, buy a credit pack.

10. Suspension and termination

10.1 We may suspend or restrict a workspace, immediately and automatically where needed, for example when bounce or complaint rates cross the thresholds in the Acceptable Use Policy, when abuse is detected, or when we are required to by law.

10.2 We will tell you why where we reasonably can and will review a suspension on request. To ask for a review, write to support@gondero.com; we answer in writing.†

10.3 You may cancel at any time in the panel (the owner or a user with billing permission). We may terminate for material breach, for repeated or serious breach of the Acceptable Use Policy, or on reasonable prior notice for convenience if the order allows.

10.4 After cancellation or termination, section 12 applies.

11. Support access to Customer Data

11.1 Our platform administrators manage tenants, billing status and abuse indicators without reading your contacts, messages or inbox content.

11.2 Access to your content happens only through a time-limited support session with a recorded reason, which is logged in your workspace audit log.

11.3 A support session starts with your consent, or on our initiative for abuse or legal reasons only, and we tell you afterwards.

12. Data export and deletion

12.1 You can export your workspace data in documented formats while your workspace is active and during the deletion grace period.

12.2 After cancellation your workspace moves to pending deletion for 30 days, during which export remains possible. After that period we delete the workspace data and destroy its encryption keys, except records we must keep by law, platform audit logs and hashed global suppression entries.

12.3 Backup copies expire according to our backup cycle. Backup copies expire after the backup retention period, which is set when the hosting provider is selected.†

12.4 Retention periods for operational data are set in the Privacy Policy and can be adjusted by you within limits.

13. Intellectual property

13.1 We own the Service and its software. You get a limited, non-exclusive, non-transferable right to use it during the term.

13.2 You own Customer Data. You grant us the licence needed to host and process it to provide the Service.

13.3 You keep your rights in your content and data. We may use feedback you give us about the Service to improve it, without obligation to you. These Terms do not transfer any trademark of either party, and you may not use the Gondero name or logo without our written permission.†

14. Warranties disclaimer and liability

14.1 The Service is provided “as is” and “as available”, with no warranty other than those that mandatory law does not allow us to exclude†. We do not promise that messages will reach inboxes, avoid spam folders, or produce replies or sales.

14.2 We are not liable for the lawfulness of your campaigns or for actions by mailbox providers, regulators or Recipients against you.

14.3 Limits on liability: to the extent mandatory law allows, we exclude liability for indirect or consequential loss and loss of profit, and our total liability for claims about the Service is limited to the fees you paid for the period in which the event occurred. Nothing here limits liability for intent or gross negligence, or any liability that cannot be limited by law.†

15. Indemnity

15.1 You indemnify us against third-party claims and regulatory actions arising from your campaigns, your lead sources, or your breach of these Terms or the Acceptable Use Policy, to the extent those claims are caused by your acts or omissions and mandatory law allows†.

16. Changes to the terms

16.1 We may update these Terms. We will give reasonable advance notice of material changes by email or in the Service. Continued use after the notice period means acceptance; if you object, you may cancel.

16.2 The version and date of the Terms you accepted are recorded.

17. Governing law and disputes

17.1 These Terms are governed by the law of Türkiye; the courts of İstanbul have jurisdiction.†

17.2 Mandatory consumer or data-protection law that cannot be waived is unaffected. (Customers are businesses; the lawyer confirms whether any consumer-protection provision could apply.)

18. Contact

18.1 Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship), Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul, +90 850 309 65 02, hello@gondero.com. Data protection contact: privacy@gondero.com. Abuse reports: hello@gondero.com.

19. Notes for the reviewing lawyer

• Company country is Türkiye; governing law, liability cap, indemnity scope and notice wording (marked †) await the lawyer.
• Support access (11.3: consent, or notified emergency access for abuse or legal reasons) and the 30-day deletion grace period (12.2) are the defaults of 2026-10-27 (TODO-Faruk 8d).
• Check whether the platform falls under GDPR Art.3(2) and whether an EU/UK representative is needed (06 F2, F10, L8). Check the VERBİS position (06 F10).
• Check that the Acceptable Use Policy ban on scraping and the product’s positioning match the mailbox providers’ API policy wording (ADR-006 R1).
• Section 8.3: lawyer to confirm that the tenant-admin switch is enough as a “documented instruction” for GDPR Art.28(3)(a) and KVKK purposes (06 F8).
• Section 4: confirm how far the platform can state that country rules are “controls” without implying legal advice.
• Filled 2026-10-27 (F1-89) from content-input/company.md: name, tax office and number, address and e-mail addresses. It is a sole proprietorship, so there is no MERSIS number; the tradesperson or trader status is for the accountant to confirm. The mailboxes hello@, support@, privacy@, billing@ and security@gondero.com are open. legal@, abuse@, postmaster@, dmarc@ and no-reply@ do not exist yet, so hello@gondero.com is used for legal notices and abuse reports until they do. Statements in the header that the company country is unknown are superseded (Türkiye); the options were decided on 2026-10-27. All placeholders were closed on 2026-10-27 (F1-64); the status table is in README.md.
• † Clauses awaiting lawyer confirmation: 3.4, 6.5, 8.2, 10.2, 12.3, 13.3, 14.1, 14.3, 15.1, 17.1.