Subprocessors

This list lets our customers, users and other data subjects know which service providers process personal data, for what purpose, where and under which safeguard. Customers may refer to this list when fulfilling their own obligation to inform as data controllers.

• Customer personal data: For the Google Business Profile content a customer syncs into its workspace (reviewer names, profile photos, review texts, ratings), for the topic and sentiment labels derived from that content and for data a customer places in its workspace about third parties, the customer is the data controller. Fidkeep processes this data as a data processor; the service providers that process it are Fidkeep's subprocessors.
• Data for which Fidkeep is the controller: Fidkeep is the data controller for website visitors, account users, billing contacts, support and communications, security logs and marketing communications. The providers that process this data on Fidkeep's behalf are Fidkeep's processors.
• Independent controllers: Google LLC, for its own services such as Google Accounts and Google Business Profile, and iyzico, for its own obligations under payment services legislation, act as independent controllers. That processing is governed by those parties' own privacy policies.

Each entry below also states whether the provider processes customer personal data.

In the entries below, "KVKK Art. 9 safeguard" refers to the transfer mechanism described in section 4.

Infrastructure and hosting

• Our cloud infrastructure provider (operating from a data centre in Finland) — Service: application servers, primary database and backups; Data processed: all data stored in the application (account and identity data, authentication and security data including encrypted OAuth tokens, Google Business Profile data, workspace content, AI records, billing and subscription records, operational records) and backups of it; Location: Finland (EU); Transfer safeguard: KVKK Art. 9 safeguard; Customer personal data: yes.
• Cloudflare, Inc. — Service: R2 object storage (media and files), content delivery network (CDN), DNS, network security and DDoS protection; Data processed: media and files stored in the application, IP address, browser and device information, request metadata and security signals; Location: global network, headquartered in the US; Transfer safeguard: KVKK Art. 9 safeguard; Customer personal data: yes.

Google integration and analytics

• Google LLC — Service: synchronisation of accounts, locations, reviews and replies and publishing of replies via the Google Business Profile API; "Sign in with Google" authentication; Google Analytics 4 on the marketing site where explicit consent is given; Data processed: business account and location information, review and reply data, published reply texts, OAuth authorisation information, name, e-mail address, profile photo and Google account identifier for sign-in, analytics data of website visitors who consented; Location: US / global; Transfer safeguard: KVKK Art. 9 safeguard; Customer personal data: yes (synchronisation and reply publishing). Google is an independent controller for its own services; for Google Analytics 4 it acts as Fidkeep's service provider.

Artificial intelligence

• Our AI infrastructure providers — Service: routing AI requests and producing reply drafts, review topic and sentiment tagging, location setup suggestions, report narratives and feedback structuring using language models; Data processed: depending on the request, business and location name and category, review rating and text, reviewer display name, the location's language and tone settings, preferred and prohibited phrases, signatures, example replies, instructions from an authorised user, the topic list for the location's industry for topic and sentiment tagging, feedback text, together with the generated outputs (including topic and sentiment labels) and request metadata; Location: US; Transfer safeguard: KVKK Art. 9 safeguard; Customer personal data: yes.

Fidkeep works with AI providers under terms under which API data is not used for model training. The names of the providers and models used are kept confidential by Fidkeep; to the extent necessary for customers to exercise their rights under the Data Processing Agreement, they are disclosed on request and subject to confidentiality obligations. Details are in the AI Use Principles.

Communications and product feedback

• Resend — Service: delivery of service e-mails such as e-mail verification, password reset, invitation, security notice, report and smart-rule alert e-mails; Data processed: recipient name and e-mail address, e-mail content (including review information that may appear in report e-mails and the matched review's information contained in smart-rule alert e-mails, namely the location, rating, review text and reviewer's display name), delivery status and technical metadata; Location: US; Transfer safeguard: KVKK Art. 9 safeguard; Customer personal data: yes (review information contained in smart-rule alert e-mails and that may appear in report e-mails).
• Linear — Service: tracking of AI-structured product feedback and issue records; Data processed: feedback text and the AI-structured record, the submitting user's name, e-mail address and internal user identifier; Location: US; Transfer safeguard: KVKK Art. 9 safeguard; Customer personal data: no.

Error and performance monitoring

• Sentry (Functional Software, Inc.) — Service: application error and performance monitoring; Data processed: error and performance records, IP address, user identifier, browser information and request context; records are kept for 90 days; Location: US; Transfer safeguard: KVKK Art. 9 safeguard; Customer personal data: only where it incidentally appears in request context.

Payments

• iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) — Service: card payment processing and storage of the card on PCI-DSS-compliant infrastructure for recurring payments (tokenisation); Data processed: card details entered directly into iyzico's secure payment form, buyer and billing information, payment amount and transaction records; Location: Türkiye; Transfer safeguard: no transfer abroad; Customer personal data: no. iyzico is a payment institution licensed by the Central Bank of the Republic of Türkiye and is an independent controller for its own legal obligations. Fidkeep never sees or stores full card numbers or CVV codes.

Finland (EU) and the United States are not countries covered by an adequacy decision under KVKK. Transfers to these countries and to global infrastructure rely on the standard contracts announced by the Personal Data Protection Board under Article 9 KVKK as amended by Law No. 7499; standard contracts are notified to the Personal Data Protection Authority within five business days of signature. Where concluding a standard contract is not possible, we rely, on an occasional basis, on the exceptions in Article 9(6) (for example, where the transfer is necessary for the performance of a contract with the data subject).

Before working with a service provider, Fidkeep assesses the provider's data security practices and transfers to it only the data needed for the relevant service. Subprocessors that process customer personal data are bound in writing by data protection obligations consistent with those imposed on Fidkeep under the Data Processing Agreement.

• A new subprocessor that will process customer personal data is notified to the account owner by e-mail at least 30 days before it starts processing that data, and this page is updated.
• The customer has the right to object to a new subprocessor under the Data Processing Agreement; the procedure and consequences of an objection are set out in that agreement.
• Changes to providers that process only data for which Fidkeep is the controller are announced by updating this page.

For questions about this list, write to [email protected]; formal notices can be sent to our KEP address [email protected]. General information on the processing of personal data is in the Privacy Policy.