KVKK Privacy Notice

• Trade name: FİDKEEP TEKNOLOJİ TİCARET LİMİTED ŞİRKETİ
• MERSIS No: 0387146003100001
• Tax office / Tax ID: Şahinbey Tax Office / 3871460031
• Address: Sarıgüllük Mah. Ali Nadi Ünler Bul. Milenyum Apt. No: 3A, Şehitkamil / Gaziantep, Türkiye
• KEP (registered e-mail) address: [email protected]
• UETS (national e-notification) address: 25858-21686-99393
• E-mail: [email protected]
• Website: fidkeep.com

As Fidkeep is established in Türkiye, no data controller representative is appointed. You can send all questions and requests concerning your personal data to [email protected]; there is no separate KVKK e-mail address or public telephone line.

Fidkeep is a web application that enables multi-location businesses to manage their Google Business Profile reviews in a single workspace, prepare AI-assisted reply drafts, follow reviews by topic and sentiment, have e-mail alerts sent to their team for new reviews that match rules they set, publish replies and receive location reports. The service is offered only to businesses acting for commercial or professional purposes.

Fidkeep is the data controller for the following groups of data subjects: website visitors (Section 3), account users and customer representatives (Section 4), billing and payment contacts (Section 5), support and contact applicants (Section 6), and prospective customers and recipients of commercial messages (Section 7).

For review content synchronised from our customers' Google Business Profile accounts and the topic and sentiment labels derived from it, and for data that customers enter into their workspaces about third parties, the relevant customer business is the data controller; Fidkeep processes that data as data processor under the Data Processing Agreement (Section 8).

İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico”) is also an independent data controller with respect to its own obligations under payment services law, and Google LLC with respect to its own services; their processing is governed by their own privacy notices.

This section applies to everyone who visits the fidkeep.com website.

Personal data processed

• Transaction security data: IP address, browser and device information, page visited, request time, referring address and records of security events.
• Cookie preference: The choice you make in the cookie banner; stored in your browser's local storage (localStorage).
• Analytics data (only with your explicit consent): Page view and on-site interaction data, device and browser information and a cookie identifier collected through Google Analytics 4. Google Analytics 4 does not log or store IP addresses.

An e-mail address you enter in the sign-up field on the website is passed to the sign-up page to start registration and is processed under Section 4.

Purposes and legal grounds

• Operating the website securely and without interruption, blocking bot and attack traffic, detecting errors: Legitimate interest of the data controller (KVKK Art. 5(2)(f)).
• Retaining traffic records under Law No. 5651 and responding to requests of competent authorities: Expressly provided for by law (Art. 5(2)(a)) and compliance with a legal obligation (Art. 5(2)(ç)).
• Remembering your cookie preference and proving consent: Compliance with a legal obligation (Art. 5(2)(ç)) and legitimate interest (Art. 5(2)(f)).
• Measuring and improving the website through visit statistics: Your explicit consent (Art. 5(1)). Unless you consent, the Google Analytics 4 script is not loaded.
• Establishing, exercising or defending rights in the event of a dispute: Art. 5(2)(e).

Method of collection

The data is collected by automated means when you visit the website, through server logs, Cloudflare network security services, the browser's local storage and (if you consent) analytics cookies. The website does not use advertising or retargeting cookies.

This section applies to people who create an account through auth.fidkeep.com, team members invited to a workspace and representatives acting on behalf of a customer business.

Personal data processed

• Identity: First and last name; if you sign in with Google, the profile photo provided by Google.
• Contact: E-mail address.
• Customer transaction data: The business and workspace you belong to, your role, your location access, invitations, subscription plan and quota usage, actions you take in the application (editing reply drafts, publishing replies, automatic reply and brand voice settings, report recipients, smart rules and your selection as a rule recipient, your mute preferences for smart-rule e-mails and rule history records showing that you were e-mailed) and your product feedback.
• Transaction security: A salted hash of your password (the password itself is not stored), session identifiers, IP address, browser and device information, e-mail verification and password reset records, linked sign-in methods, security events, audit records with sensitive fields redacted, and error records.
• Google connection data: Encrypted Google OAuth access and refresh tokens, token expiry, granted scope and the identifiers of connected Google Business Profile accounts and locations.
• AI operation records: Model used, token counts, cost, operation status and request identifiers.

Purposes and legal grounds

• Creating the account, authentication, session management and providing the Service (review synchronisation, reply drafts, review topics and sentiment, smart rules, publishing, reports, team and role management, plan and quota management): Processing directly related to the conclusion or performance of a contract (Art. 5(2)(c)). For customer employees who are not themselves party to the contract, additionally legitimate interest (Art. 5(2)(f)).
• Sending verification, password reset, invitation, security notice, report and smart-rule alert e-mails: Art. 5(2)(c); for customer employees who are not themselves party to the contract, additionally legitimate interest (Art. 5(2)(f)). These are service messages, not commercial electronic messages. Smart-rule alert e-mails are sent only if the customer selects you as a recipient of the rule concerned and can be muted with one click using the link in each e-mail.
• Ensuring information security, preventing unauthorised access and abuse, error and performance monitoring, keeping audit records: Legitimate interest (Art. 5(2)(f)).
• Retaining access and traffic records under Law No. 5651: Art. 5(2)(a) and Art. 5(2)(ç).
• Structuring and tracking product feedback and improving the Service: Legitimate interest (Art. 5(2)(f)).
• Requests of competent authorities and other obligations under legislation: Art. 5(2)(ç).
• Establishing, exercising or defending rights in the event of a dispute: Art. 5(2)(e).

Method of collection

The data is obtained directly from you on the sign-up and application screens, from Google during Google sign-in and Google connection, from the administrator who invites you to a workspace (the invitation e-mail address), from the authorised user who selects you as a smart-rule recipient, and by automated means through session cookies, server logs and error monitoring tools while you use the application. The application uses only cookies that are strictly necessary for sign-in and security; it does not use analytics or advertising cookies.

This section applies to people who purchase a subscription or are designated as billing contacts (owners of sole proprietorships and representatives acting on behalf of legal entities).

Personal data processed

• Identity and tax details: First and last name or trade name, Turkish identity number or tax identification number, tax office.
• Contact: Billing address and e-mail address.
• Financial: Subscription plan and period, invoice, payment and refund history; the card token returned by iyzico, the last four digits of the card, card brand and expiry date.

Card details are entered on iyzico's secure payment form. Fidkeep never sees or stores the full card number or the CVV; for recurring payments the card is stored in iyzico's PCI-DSS-compliant infrastructure.

Purposes and legal grounds

• Concluding the contract, collecting subscription fees, renewals, plan changes and refunds: Art. 5(2)(c).
• Issuing e-invoices and e-archive invoices, retaining commercial books and records: Expressly provided for by law under the Tax Procedure Law No. 213 and the Turkish Commercial Code No. 6102 (Art. 5(2)(a)) and compliance with a legal obligation (Art. 5(2)(ç)).
• Following up failed payments and collecting receivables: Art. 5(2)(c) and Art. 5(2)(e).
• Preventing payment fraud: Legitimate interest (Art. 5(2)(f)).

Method of collection

The data is obtained electronically, directly from you on the order screen and account settings, from the transaction results returned by iyzico during payment, and from e-mail correspondence.

This section applies to people who contact us by e-mail, KEP, post or in-app feedback, and to data subjects who submit applications under the KVKK.

Personal data processed

• Identity: First and last name, the business you represent; in data subject applications, the Turkish identity number or, for foreign nationals, nationality and passport or identity number, as required by law.
• Contact: E-mail address, KEP address, postal address and other contact details you provide.
• Request and correspondence data: The content of your request, attachments, correspondence history and, where relevant, related account information.

Purposes and legal grounds

• Answering your questions and resolving support requests: Art. 5(2)(c) if you are a customer; otherwise legitimate interest (Art. 5(2)(f)).
• Receiving data subject applications, verifying identity, responding and keeping records: Art. 5(2)(a) and Art. 5(2)(ç) under KVKK Article 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller.
• Improving service quality: Legitimate interest (Art. 5(2)(f)).
• Establishing, exercising or defending rights in the event of a dispute: Art. 5(2)(e).

Method of collection

The data is obtained directly from you through e-mail, KEP, post, hand delivery and in-app feedback channels.

This section applies to representatives of businesses interested in Fidkeep's services and to people who receive commercial electronic messages from Fidkeep.

Personal data processed

• Identity: First and last name.
• Contact: Business e-mail address and, if you provided it, telephone number.
• Professional information: The business you work for and your position.
• Marketing: Your communication preferences, consent and opt-out records, message delivery records.

Purposes and legal grounds

• Presenting Fidkeep's services, conducting business discussions and preparing offers: Legitimate interest (Art. 5(2)(f)); where pre-contractual steps are taken at your request, Art. 5(2)(c).
• Sending commercial electronic messages to recipients who are merchants (tacir) or tradespeople (esnaf): Art. 5(2)(a), because Law No. 6563 on the Regulation of Electronic Commerce permits messages to merchants and tradespeople without prior consent, and legitimate interest (Art. 5(2)(f)).
• Commercial messages for which prior consent is legally required: Only your explicit consent (Art. 5(1)).
• Retaining consent and opt-out records and applying opt-out requests: Art. 5(2)(a) and Art. 5(2)(ç) under Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages.

Every commercial message offers a free and easy way to opt out. Once you opt out, commercial messages to you stop. Service messages such as account, security, billing, report and smart-rule alert notifications are not commercial messages and are not affected by an opt-out.

Method of collection

The data is obtained directly from you by e-mail, in meetings and through the website. Where your business contact details are obtained from public business contact channels such as your company's website, this notice is provided to you at the time of first contact.

If you have written a review of a business on Google Maps and that business is a Fidkeep customer, your review may be synchronised into the business's Fidkeep workspace. For this data the relevant customer business is the data controller; Fidkeep acts only as data processor on behalf of and on the instructions of that business. This section is provided for transparency, although we are not the data controller.

• Data processed: Your display name, profile photo, the rating you gave, the review text, links to media attached to the review, review dates, the business's replies to the review, AI drafts prepared for those replies and topic and sentiment labels derived with AI from the text and rating of your review (for example “service: negative”). If your review matches a smart rule defined by the business, the review's information (location, rating, review text and your display name) is sent by e-mail to the team members the business has selected.
• Purpose: Enabling the business to see reviews on a single screen, follow and filter reviews by topic and sentiment, have its team alerted by e-mail about new reviews that match rules it sets, prepare and publish replies and generate location reports.
• Source: Obtained from Google through the Google Business Profile API with the authorisation of the business. Reviews are personal data made public by you (Art. 5(2)(d)); they nevertheless remain personal data.

Fidkeep does not use this data for its own purposes, does not sell it and does not use it to train any AI model. Topic and sentiment labels only classify the content of the review; they are not used to profile, score or classify you and do not involve any decision that produces legal effects concerning you. The data is kept for the term of the business's Fidkeep contract and deleted within 90 days of account closure.

To exercise your rights regarding this data, we recommend that you first contact the business you reviewed. If you send your request to Fidkeep, we forward it to the relevant customer business without undue delay and help the business respond; you can use the Data Subject Request Form for this. Editing or deleting your review on Google is subject to Google's own rules.

Fidkeep does not intentionally process special categories of personal data within the meaning of KVKK Article 6 (health, religion, ethnic origin, biometric data, etc.). Reviews, especially of hospitals and clinics, may contain health or other special-category information that the reviewer has published. Such information is processed only incidentally, as part of the review text; Fidkeep does not seek, extract or profile such data. The topic and sentiment labels assigned to reviews, including reviews in the health sector, only classify the content of the review against the topic list for the location's industry; they are not used to draw conclusions about the reviewer's health or other special categories of data.

Our customers must not enter special categories of personal data into brand voice instructions, example replies or replies. Replies in the health sector must never confirm that a reviewer is or was a patient and must not disclose any health or personal information.

Fidkeep relies on explicit consent only for analytics cookies on the website (Google Analytics 4) and for commercial messages for which prior consent is legally required. No separate explicit consent text is used for this: your explicit consent to cookies is obtained through the cookie banner on the website, separately from this Privacy Notice.

You can withdraw your consent at any time through the “Cookie preferences” link at the bottom of the website or through the opt-out link in commercial messages. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. See the Cookie Policy for details.

Your personal data is transferred to the following groups of recipients only to the extent necessary for the purposes above and in accordance with the conditions of KVKK Articles 8 and 9. Fidkeep does not sell personal data.

Recipients in Türkiye

• İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico) — Purpose: processing payments, storing the card for recurring payments and refunds. iyzico is an independent data controller with respect to its obligations under payment services law.
• Competent public authorities and courts — Purpose: responding to information and document requests from legally authorised bodies and complying with legal obligations.
• Certified public accountants, accounting and financial advisers — Purpose: keeping accounting records, preparing tax returns and fulfilling financial obligations.
• Legal advisers and lawyers — Purpose: obtaining legal advice and establishing, exercising and defending rights.

Recipients abroad

• Our cloud infrastructure provider operating from a data centre in Finland — Purpose: application servers, primary database and backups; Location: Finland (EU).
• Cloudflare, Inc. — Purpose: R2 object storage (media and files), content delivery network (CDN), DNS, network security and DDoS protection; Location: global network, US-headquartered.
• Google LLC — Purpose: synchronisation and reply publishing through the Google Business Profile API, “Sign in with Google” (OAuth), and, with your consent, Google Analytics 4 on the website; Location: US and global.
• Our AI infrastructure providers — Purpose: processing AI requests for reply drafts, review topic and sentiment tagging, location setup suggestions, report narratives and structuring feedback; Location: US.
• Resend — Purpose: delivering verification, password reset, invitation, security, report and smart-rule alert e-mails (smart-rule e-mails contain the recipient's name and e-mail address and the matched review's location, rating, review text and reviewer's display name); Location: US.
• Linear — Purpose: tracking product feedback (feedback text, submitting user's name, e-mail address and internal user ID); Location: US.
• Sentry (Functional Software, Inc.) — Purpose: application error and performance monitoring (may include IP address, user ID, browser information and request context); Location: US.

Only the data needed for the relevant task is sent to AI providers. Fidkeep does not use customer content to train its own models or any AI model, and works with providers under terms under which API data is not used for model training.

Access within the Service

The name, e-mail address, role and in-app activity records of account users can be viewed by the authorised workspace users of the customer business they belong to, within the limits of their role and location permissions. Smart-rule history also shows who was e-mailed under a rule.

The Personal Data Protection Board (the “Board”) has not issued an adequacy decision for Finland or the United States. Fidkeep therefore relies on KVKK Article 9, as amended by Law No. 7499 and applicable since 1 June 2024, for transfers abroad:

• Transfers are made using the standard contracts announced by the Board, and each standard contract is notified to the Personal Data Protection Authority (the “Authority”) within five business days of its signature.
• Where a standard contract cannot be put in place, Fidkeep relies, for occasional transfers only, on the exceptions listed in Article 9(6), for example where the transfer is necessary for the performance of a contract with the data subject.

The categories of data transferred and the recipients are listed in Section 11, and the current list is on the Subprocessors page.

Personal data is kept for as long as necessary for the purpose for which it is processed and for the period required by law. At the end of that period it is erased, destroyed or anonymised in accordance with KVKK Article 7 and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

• Account and workspace data: For the term of the contract. An export can be requested within 30 days after account closure; the data is deleted or anonymised within 90 days of account closure.
• Google OAuth tokens: While the Google connection is active; deleted when the connection is removed, Google access is revoked or the account is closed.
• Synchronised Google review and reply data and AI drafts: For the term of the contract; deleted within 90 days of account closure (or of disconnecting the location, if the customer requests).
• AI operation records: 12 months.
• Access, traffic and security logs: 2 years (Law No. 5651 and information security).
• Sentry error records: 90 days.
• Invoices, payment and accounting records: 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253).
• Support correspondence: 2 years after the request is closed.
• Data subject request records: 3 years after the request is concluded.
• Commercial message consent and opt-out records: 3 years after the consent ends.
• Google Analytics 4 data: 14 months.
• Cookie preference: 12 months; you are then asked again.
• Backups: Kept on a rolling basis and overwritten within 30 days at the latest.

Under KVKK Article 11 you may apply to Fidkeep to exercise the following rights:

1. To learn whether your personal data is processed.
2. To request information about the processing if your personal data has been processed.
3. To learn the purpose of the processing and whether your data is used in line with that purpose.
4. To know the third parties in Türkiye or abroad to whom your personal data is transferred.
5. To request rectification if your personal data is incomplete or inaccurate.
6. To request erasure or destruction of your personal data under the conditions set out in KVKK Article 7.
7. To request that rectification, erasure or destruction be notified to the third parties to whom your personal data has been transferred.
8. To object to a result against you arising from the analysis of the processed data exclusively by automated systems.
9. To claim compensation for damage suffered as a result of unlawful processing of your personal data.

Under Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your application in Turkish by one of the following methods:

• In writing: By handing your application bearing your wet signature in person at Sarıgüllük Mah. Ali Nadi Ünler Bul. Milenyum Apt. No: 3A, Şehitkamil / Gaziantep, Türkiye, or by sending it by post or through a notary.
• By KEP: By sending it from your own KEP address to [email protected].
• With a secure electronic signature or mobile signature: By e-mailing an application signed with one of these signatures to [email protected].
• From your registered e-mail address: By sending it to [email protected] from the e-mail address you previously provided to Fidkeep and that is registered in our systems.

Your application must include your first and last name, your signature for written applications, your Turkish identity number (for foreign nationals, nationality and passport number or identity number, if any), your residential or business address for notifications, your e-mail address and telephone number for notifications, if any, and the subject of your request. We recommend using the Data Subject Request Form, which contains all of these elements.

Your application is concluded free of charge as soon as possible depending on the nature of the request and within 30 days at the latest. If the action requires an additional cost, the fee in the tariff set by the Board may be charged. Fidkeep accepts your request or rejects it with reasons and notifies you of its response in writing or electronically. If the application arises from Fidkeep's error, any fee charged is refunded.

We may ask you for additional information to verify your identity or clarify your application.

If your application is rejected, you find the response insufficient or no response is given in time, you may, under KVKK Article 14, lodge a complaint with the Board within 30 days of learning of the response and in any event within 60 days of the application date. A complaint to the Board can only be made after first applying to Fidkeep.

This Privacy Notice may be updated in line with changes to our processing activities, service providers or legislation. The current version is always published on this page. Material changes are also announced to our account holders by e-mail or in-app notification.