Privacy Policy
Effective date: [DOLDURULACAK] · Last updated: [DOLDURULACAK]
This Privacy Policy explains for which purposes, on which legal bases and in what way [DOLDURULACAK] ("Leadivo", the "Company", "we") processes personal data in connection with the Leadivo service (the "Service") and its website and customer dashboard (the "Platform"), and to whom such data is disclosed. It is based on the Turkish Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation and, to the extent applicable, the EU General Data Protection Regulation ("GDPR").
The detailed notice for customers and Platform users under Article 10 KVKK is available at KVKK Information Notice; the notice for people who receive emails on behalf of our customers is available at Recipient Privacy Notice.
1. Controller and contact details
| Item | Value |
|---|---|
| Legal name | [DOLDURULACAK] |
| Brand | Leadivo |
| MERSIS number (Turkish central registry) | [DOLDURULACAK] |
| Tax office / tax number | [DOLDURULACAK] / [DOLDURULACAK] |
| Address | [DOLDURULACAK] |
| [DOLDURULACAK] | |
| Registered electronic mail (KEP) | [DOLDURULACAK] |
| Phone | [DOLDURULACAK] |
| Data protection contact | [DOLDURULACAK] |
2. Definitions
The following terms have the same meaning in this Policy and in our other legal documents:
- Customer: a business (merchant or tradesperson) that subscribes to the Service.
- User: an authorised person (employee, representative) who accesses the Platform on behalf of a Customer.
- Visitor: a person visiting our website.
- Prospect / Recipient: a decision maker at a company in the Customer's target market to whom business emails are sent on behalf of the Customer through the Service.
- Sending Domain and Mailbox: secondary domains and the email accounts on them, procured separately to send emails on behalf of the Customer while protecting the Customer's primary domain.
- Suppression List: the Customer-specific list of Recipients who have opted out, objected or replied negatively, kept so that the Customer never contacts them again.
- Sub-processor: a third-party service provider that processes personal data for the Company in providing the Service.
- Data Processing Agreement (DPA): the Data Processing Agreement between the Company and the Customer governing the processing of Recipient data.
3. Our roles
The Company acts in two different capacities:
- As controller: for Customer accounts, Users, Visitors, subscription and billing processes, support correspondence, and security and audit logs. Sections 4 to 9 of this Policy cover this data.
- As processor: for the data of Recipients found under the Customer's targeting instructions, the emails sent to them, replies received and meeting records, the relevant Customer is the controller; the Company processes this data under the DPA, solely on the Customer's instructions and on its behalf. See Section 10 and the Recipient Privacy Notice.
4. Personal data we process as controller
| Category | Examples | Data subject |
|---|---|---|
| Identity | First name, last name | User, Customer representative, person shown as sender |
| Contact | Business email address, notification email address, phone | User, Customer representative |
| Customer transaction | Company name, industry, targeting segments (industries, job titles, company sizes, regions, language, topic/offer text), campaign settings, actions in the dashboard | User |
| Sender identity | Legal name, MERSIS/tax ID, address, sender contact email, first and last name of the person shown as sender in emails | Customer representative, person shown as sender |
| Finance | Subscription identifiers (LemonSqueezy customer, order and subscription IDs), subscription status, renewal and end dates, amount and currency. The Company never sees or stores card data. | Customer representative |
| Transaction security | Session cookies, authentication records, IP address, browser information, event and audit logs, short-lived rate-limit counters | User, Visitor |
| Integration | Slack incoming webhook URL entered by the Customer | User |
| Requests/complaints | Support requests, data subject requests and correspondence | All data subjects |
The Service is not designed to process special categories of personal data (Art. 6 KVKK; Art. 9 GDPR). We ask Customers not to enter such data into the Platform.
5. Purposes and legal bases
| Purpose | KVKK legal basis | GDPR legal basis |
|---|---|---|
| Entering into and performing the subscription agreement; account creation, login (magic link/password), setup, procurement of Sending Domains and Mailboxes, running campaigns | Art. 5(2)(c) (contract) | Art. 6(1)(b) |
| Sending positive-reply and meeting notifications by email or Slack | Art. 5(2)(c) | Art. 6(1)(b) |
| Tracking payment status; starting/pausing/ending subscriptions | Art. 5(2)(c) | Art. 6(1)(b) |
| Including sender identity in messages and keeping opt-out records under Turkish commercial electronic message law | Art. 5(2)(ç) (legal obligation) and 5(2)(c) | Art. 6(1)(c) and 6(1)(b) |
| Information security, abuse prevention, rate limiting, event and audit logs | Art. 5(2)(f) (legitimate interest), 5(2)(ç) | Art. 6(1)(f), 6(1)(c) |
| Establishing, exercising or defending legal claims | Art. 5(2)(e) | Art. 6(1)(f) |
| Statutory retention, disclosure and authority-response obligations | Art. 5(2)(ç) | Art. 6(1)(c) |
| Mandatory service notices (security, changes, billing) | Art. 5(2)(c) | Art. 6(1)(b) |
| Producing anonymised or aggregated statistics to improve the Service | Art. 5(2)(f) | Art. 6(1)(f) |
| Responding to data subject requests | Art. 5(2)(ç) | Art. 6(1)(c) |
The Company does not use Customer account data to send marketing messages; should it plan to do so, it will separately carry out the consent and notice procedures required by Law No. 6563 and KVKK.
6. How we collect data
Personal data is collected electronically from Users through forms on the Platform and the dashboard; from the payment provider LemonSqueezy through signed webhook notifications; through email and support channels; and automatically when the website and Platform are used (server logs and strictly necessary cookies). See our Cookie Policy.
7. Disclosures
Personal data may be disclosed, in line with Arts. 8 and 9 KVKK and Chapter V GDPR, to:
- Sub-processors: hosting (Vercel Inc.), database and authentication (Supabase Inc.), notification emails (Resend), email sending infrastructure (Instantly.ai) AI models (Anthropic PBC and/or OpenAI) and internal administrator alerts (Slack Technologies). The current list, data locations and transfer safeguards are at Sub-processors.
- Independent controllers: LemonSqueezy, acting as Merchant of Record for payments and invoicing; the Slack workspace chosen by the Customer; the Customer's own Cal.com account.
- Competent public authorities and courts: where required by law or upon a lawful request.
- Legal, financial and technical advisers: subject to confidentiality and only as necessary.
International transfers
Many of our Sub-processors are established in the United States, and even where data is hosted in the [DOLDURULACAK] region, it may be accessed from abroad. Under Art. 9 KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad of 10 July 2024, where there is no adequacy decision for the destination country, transfers are made by signing the standard contracts published by the Turkish Personal Data Protection Board, which are notified to the Turkish Personal Data Protection Authority within five business days of signature. For Customers and data subjects in the European Economic Area, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (SCCs) and, where available, certification under the EU-US Data Privacy Framework apply.
8. Retention periods
Personal data is kept for as long as required by the purpose of processing and by law; at the end of that period it is deleted, destroyed or anonymised in accordance with the Turkish Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
| Data | Retention period |
|---|---|
| Account and Customer transaction data (segments, campaign settings, notification settings, Slack webhook URL) | During the contract; deleted within a 30-day export window after termination followed by at most 30 days (60 days in total) |
| Contract and subscription records (IDs, status, dates and amounts) | 10 years after termination (Turkish Commercial Code Art. 82, Turkish Code of Obligations Art. 146) |
| Sender identity information | 3 years after termination (evidentiary needs under Art. 13 of the Turkish Regulation on Commercial Communication and Commercial Electronic Messages) |
| Authentication data (email, password hash, session data) | While the account is open; at most 60 days after closure |
| Event and audit logs | 12 months; logs subject to a security incident or dispute review are kept until the review/dispute is concluded |
| Webhook delivery records | 12 months |
| API cost records | 24 months (kept without personal data) |
| Rate-limit counters (keyed by IP address or email) | In the database for the counter window; in any case deleted within 48 hours |
| Hosting provider access logs | The provider's standard log retention; at most 30 days |
| Support correspondence | 3 years after the matter is closed |
| Data subject requests and responses | 3 years after the request is closed |
| Backups | Data deleted from live systems is also removed from backups within the normal backup cycle, at most 30 days |
Retention periods for Recipient data processed on behalf of Customers are set out in the Data Processing Agreement and the Recipient Privacy Notice.
9. Your rights and how to exercise them
Under Art. 11 KVKK you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether data is used in line with that purpose; to know the third parties in Turkey or abroad to whom it is transferred; to request rectification of incomplete or inaccurate data; to request erasure or destruction under Art. 7 KVKK; to request that rectification and erasure be notified to the third parties to whom data was transferred; to object to a result to your detriment arising from analysis exclusively by automated systems; and to claim compensation for damage arising from unlawful processing.
Data subjects covered by the GDPR also have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and not to be subject to automated decision-making (Art. 22), and the right to lodge a complaint with the supervisory authority of their habitual residence, place of work or place of the alleged infringement.
In line with the Turkish Communiqué on the Procedures and Principles of Application to the Controller, you can send your request:
- in writing with a wet signature, in person or through a notary, to [DOLDURULACAK];
- by registered electronic mail (KEP) to [DOLDURULACAK];
- signed with a secure electronic signature or mobile signature, to [DOLDURULACAK];
- or from an email address you have previously notified to us and that is registered in our systems, to [DOLDURULACAK].
Your request should include your name, signature (for written requests), Turkish ID number (for foreign nationals: nationality and passport/ID number), residential or business address for notifications, email address for notifications if any, phone number and the subject of the request. Requests are answered free of charge within 30 days at the latest; if the action requires additional cost, the fee set by the Turkish Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient, or no answer is given in time, you may complain to the Turkish Personal Data Protection Board under Art. 14 KVKK. GDPR data subjects may also contact their supervisory authority at any time.
We may ask for additional information where we cannot verify your identity.
10. Recipient data processed on behalf of our Customers
Within the Service, the Customer defines its target market (industry, job title, company size, region and language); on that instruction, the Company obtains business contact data from the Apollo.io database, prepares personalised emails with the help of AI models, and sends them from Sending Mailboxes in the Customer's name and with the Customer's identity details. In this context:
- The controller is the Customer whose identity appears in the email footer; the Company is the processor.
- Every email contains the Customer's legal name, MERSIS/tax ID, address and contact email, an opt-out (unsubscribe) link and a link to the Recipient Privacy Notice.
- Recipients who opt out, object or reply negatively are added to the relevant Customer's Suppression List and to the sending provider's block list and are never contacted again on behalf of that Customer. The sending provider's block list applies across the Company's entire sending infrastructure; the person will therefore not be emailed through this infrastructure on behalf of any other Sender either. That list holds only the email address.
- Recipient data is not shared with any other Customer, not combined across Customers and not used for the Company's own marketing.
Recipients may exercise their rights directly with the relevant Customer or by writing to [DOLDURULACAK]; requests received by the Company are forwarded to the Customer without delay, and opt-outs and objections are applied immediately on the Customer's behalf.
11. Use of artificial intelligence
Third-party large language models (Anthropic PBC and/or OpenAI) are used through their APIs to personalise email texts and to classify incoming replies (positive, neutral, negative). The commercial API terms of these providers state that content submitted through the API is not used to train their models by default; content may be subject to the providers' limited-duration retention for abuse monitoring. Only the minimum data necessary is sent to the models (the Recipient's name, job title, company and industry; the Customer's offer text; the reply text for classification). Reply classification is not a decision that produces legal effects concerning the Recipient or similarly significantly affects them; it only determines whether the Customer is notified and whether opt-out/negative replies are added to the Suppression List.
12. Security
The Company implements appropriate technical and organisational measures under Art. 12 KVKK and Art. 32 GDPR, including: row-level security (RLS) in the database so that each Customer can access only its own data; administrator rights restricted to a limited allowlist; service keys kept server-side only; HMAC verification of payment webhooks and secret-based verification of sending-provider webhooks and scheduled jobs; rate limiting; filtering of customer-supplied webhook URLs against requests to internal networks; TLS encryption in transit and encryption at rest by our providers; and event and audit logs. The full list is in Annex 2 of the Data Processing Agreement.
In the event of a personal data breach, under Art. 12(5) KVKK and the Turkish Personal Data Protection Board's Decision No. 2019/10 of 24 January 2019, the breach is notified to the Board within 72 hours of becoming aware of it and to affected data subjects as soon as reasonably possible.
13. Children
The Service is intended for businesses only; we do not knowingly process data of persons under 18.
14. Changes
We may update this Policy. Material changes will be announced to Customers by email or on the Platform a reasonable time before they take effect. The current version is always published on this page.
15. Language
The Turkish version of this Policy (Gizlilik Politikası) is authoritative. This English version is provided for information; in case of conflict, the Turkish version prevails.