Privacy Policy

We use your account data to authenticate you and operate your session. We use the brand and competitor data you provide to run the AI-visibility measurements, generate competitor comparisons, and produce the growth recommendations and reports the Service is built to deliver. We do not use your data to train our own models.

To measure your brand's visibility, the Service sends analysis-specific prompts and brand or competitor names to third-party AI providers and receives their answers. The engines we use today are ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and DeepSeek. In measurements with web search, requests to ChatGPT, Claude and Gemini go directly to each provider's own API: OpenAI, Anthropic and Google. Requests without web search (DeepSeek's answers, measurements without search, and internal analysis steps such as evaluating an answer or drafting recommendations) go through a model gateway, OpenCode Zen, which passes each request on to the provider that runs the model. When Ask Mavzena prepares an answer, it sends your question and a short summary of the data on the page you are on (not the raw data itself) to an AI provider, also through the OpenCode Zen gateway. These providers process the data under their own terms and privacy policies; we do not control how they protect or retain it on their side. Do not enter information in the brand or competitor fields that you do not want sent to an AI provider.

Our order process is conducted by our online reseller Paddle.com, which is the Merchant of Record for all our orders. When you upgrade, Paddle's checkout opens on our site and your card details go to Paddle; we never see or store your card number. Paddle receives your name, e-mail address, billing country and payment details to take the payment, calculate tax and issue invoices, and processes them under its own privacy policy (paddle.com/legal/privacy). From Paddle we receive the status of your subscription, its billing dates and a customer reference, so that we can apply your plan.

Hosting: the Service and its database run on a server operated by KEYUBU İnternet ve Bilişim Tic. Ltd. Şti. in Istanbul, Türkiye. All account and brand data is stored there.

Cloudflare: our domain's DNS, encrypting and protecting site traffic against attacks, and the bot check (Turnstile) on the sign-up (including opening a new account with Google), password reset and invite code request forms, on the free first-look form on the home page, and on sign-in after repeated failed attempts. Every request to the site passes through Cloudflare, which processes your IP address and browser details.

Brevo: sends the emails about your account (email verification, password reset and product notifications). Brevo receives your email address and the content of the email.

Google: database backups (Google Drive) and the optional "Continue with Google" sign-in (see section 10).

PostHog: site analytics, only if you allow it in the cookie banner (see section 6).

Sentry: used to track errors on the site and the server; its servers are in Germany (EU). Errors that happen in your browser do not go to Sentry directly: they first reach our own server and go through the same cleaning. No personal data (email, IP address, cookies, form content, AI prompts or answers) is sent with an error report; email addresses and long tokens in the text are masked before sending. This processing is based on KVKK art. 5(2)(f).

Serper: the search service we use for the public voice scan (finding forum, review-site and Google Maps results that mention your brand) and for finding nearby competitors. Serper receives only search terms such as brand and competitor names and your brand's city; no personal data from your account is sent. Serper's servers are abroad.

Paddle: payments (see section 4).

To provide the Service, some of your personal data (such as your IP address and email address) is transferred to our service providers abroad (Cloudflare, Brevo, Sentry, PostHog, Google, Paddle), and the prompts and brand and competitor names described in section 3 are transferred to the AI providers abroad (OpenAI, Anthropic, Google, and OpenCode Zen together with the model providers it passes requests on to, such as the one running DeepSeek). For these transfers, we are in the process of signing the standard contracts published by the Turkish Personal Data Protection Board under KVKK art. 9 and notifying the Board; we will update this text as the process is completed.

We use a small number of necessary cookies: a session cookie that keeps you logged in (set as httpOnly, so it cannot be read by page scripts), and a cookie that remembers your language preference. Your theme preference (light or dark) is stored in your browser's local storage rather than a cookie. If you go from the free first look to sign-up, what you entered is kept there for 24 hours; if you create a share card from a first look, the key that lets you turn off the card's link is kept there too. This information is not sent to us. While you are signed in, a small marker (aio_ui_locale_reported) in your browser's session storage (sessionStorage) remembers whether we have already sent your interface language to your account; it is deleted when you close the tab.

Analytics cookies are used ONLY if you accept them in the cookie banner. We use PostHog (PostHog Inc., servers in the United States; this means the analytics data is transferred abroad) to see how the site is used: which pages are visited, what is clicked, and recordings of sessions on the site so we can find and fix problems. Text you type into forms is masked in these recordings and passwords are never recorded. Analytics data is linked to your account only by an internal account id, never by your email or name, and is not used for advertising or cross-site tracking. If you reject, no analytics cookies are set and no session is recorded. You can change your choice at any time with "Cookie preferences" at the bottom of the site. The full list of cookies, their purpose and duration is in our Cookie Policy (/cookies).

We keep your account and brand data for as long as your account is active. You can delete your account yourself at any time under Account → My data and account; this removes your account, your brands, your personal workspace and the records of the emails we sent you immediately. After the deletion we send a single 'your account has been deleted' email to your address; no record of that email is kept. Even while your account stays open, the records of the emails we send you are deleted 1 year after they are sent. A workspace you share with other people is kept, and only your membership is removed. You can also ask us to delete it through the contact page. Your invoices are issued and kept by Paddle as the Merchant of Record (section 4); we keep no invoice records. The record of the 'start the service immediately' consent you give before payment (the time of consent, the plan, your IP address and browser details) is kept for 3 years from the end of the subscription and then deleted, to meet the burden of proof under the Turkish Distance Contracts Regulation and to protect our rights in a possible dispute (KVKK Article 5(2)(ç) and 5(2)(e)); deleting your account or your brand does not shorten this period. If the payment page never opens (the payment provider returns an error), the consent record is deleted at once. Payment notifications that arrive from the payment provider after your account is deleted and match no account are deleted after 30 days. So that free allowances cannot be reset by deleting an account and opening a new one with the same address, when you delete your account we keep a one-way digest of your email address (not the address itself) and how much of the measurement and AI allowance of your last free period you used, for 12 months (KVKK Article 5(2)(f)). If you sign up again with the same address during that time, the new account starts with what was left of that period; after 12 months the record is deleted. When you permanently delete an archived brand, all of its data is deleted at once (except the legal records above) and disappears from backups within 30 days at the latest. Ask Mavzena chats are deleted automatically after 90 days, and you can delete your chat yourself at any time from the Ask Mavzena panel. The AI cost records kept for billing and usage totals do not contain the brand's name. Free first look records are deleted after 30 days and session activity records after 7 days at the latest. Share cards are kept until you turn off the link or delete the brand (30 days for first look cards). If someone on our team has to stop a measurement because of a technical problem, that team member's email address and the reason are written to the measurement's record and kept with it.

You can access, correct or delete the personal data we hold about you at any time. Under Account → My data and account you can download all of it as a single file and delete your account yourself. You can also send these requests through the contact page; we answer them within 30 days at the latest, as KVKK (Turkish Personal Data Protection Law No. 6698) requires. We do not send marketing emails. Emails needed to run your account (email verification, password reset) are always sent. Every product notification (for example, that your first results are ready or that your monthly measurement has renewed) includes a one-click unsubscribe link.

We take reasonable technical measures to protect your data, including hashing passwords and using an httpOnly session cookie for authentication. No online service can guarantee absolute security, and we cannot promise that unauthorised access, loss or misuse of data will never occur.

Mavzena uses Google APIs for two purposes.

Sign-in with Google: if you use "Continue with Google", the Mavzena application asks Google only for the "openid", "email" and "profile" permissions. Google sends us your name, email address and Google account ID; we never see your Google password. We use this only to open your account and to recognise you when you sign in. We do not take your profile picture and we do not store Google's access or refresh tokens, so we cannot do anything in your Google account on your behalf. If your account has a password, you can disconnect Google on your account page; if you delete your account, this data is deleted too. Signing in with Google is optional; you can also sign up with your email address and a password.

Database backups: copies of the Service's own database are backed up to a Google Drive account that belongs to the Mavzena team. For this, the Mavzena application asks Google only for the "drive.file" permission, which lets it see and manage only the files it has created itself. It does not read, list or change any other file in that Drive account, and it does not access the Google Drive of any Mavzena user.

The backup files contain the Service data described in section 1 and are kept for 30 days, after which they are deleted automatically. Data handled through Google APIs is used only for these two purposes: to recognise you at sign-in, and to store and, if needed, restore these backups. It is not sold, not shared with third parties, not used for advertising and not used to train AI models. Mavzena's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

We may update this Privacy Policy as the Service evolves, for example if we add a new third-party processor. We will update the "last updated" date above whenever we do.