Privacy Notice (KVKK / GDPR)

1. Data controller

Data controller: Muhammed Aziz — E Ticexi. Address: Zafer Mah. Deniz Sk. No: 13 İç Kapı No: 1, Gürsu / Bursa. Email: woksyy@eticexi.com.

2. Personal data processed and purposes

• Identity and contact (email): creating and managing your membership, service notices.
• Account and preference data: full name, optional store name, identity data provided when signing in with Google, language and time zone preferences, notification preferences, consent logs recorded at sign-up (consent type, text version, timestamp and a cryptographic, irreversible signed hash of the IP address), and data download and account deletion request records.
• Onboarding answers (experience, selling status, platforms, market): personalizing the service and recommendations.
• Phone number: SMS verification and preventing abuse of free usage rights.
• Analyzed product data and profit form inputs: producing the analysis and profit calculation.
• Billing details (only at payment; name/title, national ID or tax number, tax office, address): invoicing and tax obligations.
• Transaction security data (IP address, cookies, logs): security, abuse prevention and keeping the service running.
• First analysis without an account: a random ID cookie set in your browser and an irreversible signed hash of your IP address (the raw IP is not stored); to prevent abuse of the free analysis and to show you your report.
• An irreversible signed hash of your phone number (not linked to your account): to prevent free analyses from being claimed again with the same number.
• Marketing SMS consent (optional): SMS about offers and news; you can withdraw consent at any time. Rules for commercial electronic messages (such as Turkey's IYS) apply.
• Marketing email consent (optional): campaign, discount, newsletter and product update emails; you can withdraw consent at any time in your account settings. No bulk marketing email is sent before these consents are registered with the Commercial Electronic Message Management System (IYS).
• If the browser extension is used: the product information of the page you analyze and the review texts shown on it (reviewer names are not read; reviews are anonymized). The extension works only for an analysis that you start and sends data only to E Ticexi; purpose: producing the analysis.
• Marketplace store connection (if you connect your store): Through the current marketplace integrations supported by our system (for the current list of supported platforms see the Supported Integrations page: https://eticexi.com/en/integrations), payout, shipping volume/amount, return and order package information is processed via the seller's own API keys for financial reconciliation and error detection, and is hosted on the infrastructure of our cloud providers Supabase (EU — Frankfurt) and Vercel. Legal basis: conclusion or performance of a contract (KVKK Art. 5/2-c) and legitimate interest (Art. 5/2-f). Your buyers' (customers') names, addresses and phone numbers are not stored; for that data E Ticexi is a data processor (Terms of Use §10). In a free scan the details are deleted when the scan finishes and only the total amount found and the date remain; if you do not subscribe, this summary is also deleted after 30 days. When you remove the connection, your API key is deleted immediately and no new data is retrieved from that store; data retrieval also stops when your subscription ends. Payout, shipping, order and finding records already retrieved are kept for at most 5 years from the removal of the connection or the end of the subscription, in order to present evidence and exercise our right of defence in possible disputes relating to the service period (billing, payout calculation errors, compensation claims, administrative inspections), and are automatically destroyed at the end of that period; while the connection and subscription continue, each record is also kept for at most 5 years from its record date. For records kept after the connection is removed, E Ticexi is the data controller. Legal basis: establishment, exercise or protection of a right (KVKK Art. 5/2-e) and, for financial records, compliance with a legal obligation (Art. 5/2-ç). Retained records are not shown on screen, are not used to connect to the marketplace and are not processed for any other purpose. You can ask for these records to be deleted at any time from the Store connections screen in Settings or by writing to us from your registered email address; your request is fulfilled within 7 days at the latest. If you reconnect your store with the same account, your past records are matched to your account again. Exception: To prevent the free scan from being reused for the same store, a one-way, irreversible digest (hash) generated from the marketplace name and your store ID, together with the scan date, is retained for 24 months even if you remove the connection. Your store ID cannot be read from this record, and it is not used for any other purpose. Legal basis: legitimate interest (KVKK Art. 5/2-f).
• Analytics data (only if you consent in the cookie banner): pages you visit, visit duration, clicks within the site, device and browser type, approximate location (country/city) and cookie IDs (Google Analytics 4, via Google Tag Manager); to measure and improve how the site is used. Details are in the Cookie Policy.

Names and usernames in product reviews are not processed or stored.

3. Legal bases

We rely on the following legal bases: conclusion and performance of a contract, compliance with a legal obligation, legitimate interests (security and abuse prevention) and explicit consent (for example optional communications). Under the GDPR: Article 6(1)(a), (b), (c) and (f).

Processing through analytics cookies relies solely on your explicit consent; you can withdraw it at any time via the “Cookie settings” link in the site footer. Not consenting does not affect your use of the service.

Consent records are kept to fulfil our legal obligations and as a means of proof; keeping invoice and payment records for the statutory retention periods after account deletion is required by our legal obligations under the Tax Procedure Law (VUK) and the Turkish Commercial Code (TTK) and by our legitimate interest.

4. Recipients

Your data is shared with the following processors to deliver the service:

• Supabase (EU — Frankfurt): database and authentication.
• Vercel: hosting.
• Anthropic: AI processing; reviews are sent after anonymization and contain no personal names.
• Resend (EU — Ireland): email delivery.
• Google Workspace: contact email.
• iyzico: payment processing.
• SMS provider: sending the verification code.
• Google (Google Ireland Limited / Google LLC): Google Tag Manager and Google Analytics; only if you consent to analytics cookies.

Data may also be shared with competent public authorities where legally required.

5. Transfers abroad

Some of our providers (for example Vercel, Anthropic, Google) may process data outside Turkey and/or the EU/EEA. These transfers follow the transfer regime of Article 9 of KVKK and Chapter V of the GDPR, with safeguards such as Standard Contractual Clauses. For current transfer details, write to woksyy@eticexi.com.

6. Retention periods

• Account and analysis data: while your account is open. If you request account deletion, the data is permanently deleted after a 7-day period during which you can undo the request.
• Analysis without an account and the related cookie ID and IP hash: at most 30 days (if you sign up, the report moves to your account and the guest record's content is deleted immediately).
• Phone number: while your account is open. Signed hash of a number that received free analyses: 24 months even if your account is deleted (abuse prevention, legitimate interest).
• SMS verification codes: the code itself is not stored; its signed hash is kept for at most 2 days.
• Invoice and payment records: After an account deletion request, the user's account data, analyses and preferences are deleted, while invoices and statutory financial documents issued under the Tax Procedure Law and related financial legislation continue to be kept, with their contents unchanged, for the mandatory statutory retention period. Invoices, payment and refund records, distance sales agreement and preliminary information acceptances and subscription consents are kept for 10 years after the account is deleted (TTK Art. 82).
• Store connection records (payouts, shipping, orders and findings): while the connection and subscription continue, at most 5 years from the record date; at most 5 years from the removal of the connection or the end of the subscription (establishment and protection of a right). Deleted within 7 days at the latest if you request it. The marketplace API key is deleted immediately when the connection is removed. The record of the deletion (request and deletion dates; no store or financial data) is kept for 5 years.
• Consent logs and deletion request records: kept for 5 years after the account is deleted, in case of legal disputes.
• Review texts: not stored; only themes and counts are kept.
• Analytics data: cookies (_ga, _ga_<id>) in your browser for up to 2 years; usage data in Google Analytics for up to 14 months. Your cookie consent choice is kept for 6 months.

7. Your rights

Under Article 11 of KVKK you have the right to learn whether your data is processed, request information, learn whether it is used for its purpose, know the recipients, request correction, deletion/destruction and notification of these to third parties, object to results of automated analysis and claim compensation for damage. Under the GDPR you also have the rights to data portability, restriction of processing and objection.

Users can download their data or permanently delete their account at any time directly from “Account settings → My data” on our platform.

8. How to apply

You can send your requests in writing to woksyy@eticexi.com. We reply within 30 days at the latest. If you are not satisfied with the reply, you may complain to the Personal Data Protection Board (or the competent supervisory authority in your country).