Privacy policy and KVKK notice

This notice explains which of your personal data is processed, and why, when you use SEO Rapor, under the Turkish Personal Data Protection Law No. 6698 (KVKK, the Turkish equivalent of the GDPR).

1. Data controller

Data controller: ALATLI CREATIVE (Ozan Alatlı, sole proprietorship), Mecidiyeköy, Şişli, Istanbul, Türkiye. E-mail: ozan@alatli.dev.

2. Data we process

• Account data: name, e-mail address, a one-way hash of your password (the password itself is not stored).
• Session and security data: session duration, IP address and browser information; sign-in and registration attempts (IP address, e-mail). For security and to prevent abuse.
• Order data: the package purchased and the payment status. Your card details never reach us; Paddle receives the payment.
• Service data: the domains you add, verification records, scan results and your token movements.
• If you gave consent for announcements (e.g. "Agency plan: Notify me"): your e-mail address, the time consent was given, the page and language, and the version of the consent text shown to you; if you sign up without an account, a confirmation e-mail is sent to your address and the time of confirmation is also recorded.
• Abuse-prevention record: so that the free preview cannot be used again, the normalized form of your e-mail address and the scanned domain.

Our role: we are the data controller for your account, session and payment data. For the scan results of the sites you add to your account, we act as a data processor on your behalf and on your instructions.

3. Purposes and legal bases

• Creating your account, providing the service and showing you your reports (performance of the contract).
• Managing payments and your token balance (performance of the contract, legal obligation).
• Keeping accounts secure and preventing abuse (legitimate interest).
• Sending service-related e-mails: verification, password reset, scan-finished notification.
• Sending announcement e-mails (explicit consent, see section 9).
• Answering support requests, checking the quality of the service and reviewing the errors you report (e.g. "Is this finding wrong?" reports): for these purposes our authorized staff can view your scan reports read-only. Views are logged together with the authorized person who viewed them and the time; opening the same report again within one hour counts as one record (legitimate interest).

3.1 Access to your reports

Your scan reports are private to your account. Only our authorized staff can view them, solely for support, quality control and reviewing error reports; reports that contain errors may be put into this review automatically to check their accuracy. This access is read-only and recorded in the admin log. Apart from what is transferred to the providers in section 4, to the extent stated there, your reports are not shared with third parties.

4. Transfers

Your data is not sold and is not shared for advertising. To provide the service it is transferred, only to the extent necessary, to the following providers:

• Paddle (payment and invoicing, United Kingdom/USA): name, e-mail, order information. Card details never reach us.
• Resend (e-mail delivery, USA): your e-mail address and the content of the service e-mail.
• Hetzner (hosting and database, Germany): all data of the service.
• Hostinger (e-mail hosting): the e-mails you send us for support and requests, and our replies.
• Anthropic (report commentary, USA; only when the report commentary feature is switched on): a summary of the scan findings (domain, finding messages and counts), up to 5 example page addresses per finding type, and a speed summary. Your account details and the full content of pages are not sent.
• Google PageSpeed Insights (speed measurement, USA): the addresses of the pages measured.

Transfers abroad are made under the conditions of Article 9 of KVKK.

5. Retention

Data whose period has expired is deleted, destroyed or anonymized by the automatic clean-up above and by a periodic destruction carried out at least every 6 months.

6. Sites we scan

Our crawler identifies itself as "AlatliSEO", obeys robots.txt rules and sends requests to the site at a polite rate. Verifying site ownership is not mandatory; unverified sites get a lower speed and page limit, and site owners can block scanning using the methods on the bot page.

Our crawler reads only publicly accessible pages; it does not enter areas that require a sign-in and does not try to get around access restrictions. From the pages we store only the technical fields needed for SEO analysis (such as title, meta description, status code, links, image sizes and response time); we do not store the full text of pages. If any of these fields contains information about a person, it is kept only for the report and for the same period as the report. Site owners can ask us to stop scanning and to delete the records, using robots.txt or by writing to ozan@alatli.dev.

7. Your rights

Under Article 11 of KVKK you have the right to learn whether your data is processed, to request correction or deletion, to object to processing, and to claim compensation if you suffer damage. You can also delete your account and data yourself on the Account page of the panel. You can send your application from your registered e-mail address to ozan@alatli.dev, or by a wet-signed petition to Mecidiyeköy, Şişli, Istanbul. Applications are concluded free of charge within 30 days at the latest; if the process requires a separate cost, the tariff set by the Board (Kurul) may be applied.

8. Cookies, visit statistics and error logging

Our site uses only the cookies and browser storage entries below, all of them to run the service or to remember your preferences. No advertising or tracking cookies are used.

On the Pricing page and on the Tokens page of the panel, Paddle's checkout script is loaded to show prices and take payment. This script connects to addresses belonging to Paddle (cdn.paddle.com, api.paddle.com, public.profitwell.com), so your IP address and browser information reach this provider. No cookie is set on our own domain on these pages; Paddle may set a short-lived security cookie (__cf_bm) on its own domain. The checkout window belongs to Paddle; Paddle's privacy notice applies to the cookies used there.

We count visits with a cookieless analytics tool (Umami) that runs on our own server (analiz.alatli.dev). For each page view, the page path, referring address, browser, operating system, device type, screen size, language and country are recorded. No cookies are used for this and your IP address is not recorded: the country is derived from the IP address, and visits are grouped using an irreversible identifier derived from the IP address and browser information. Site names and identifiers in panel addresses (including the referring address) and panel page titles are not sent; if your browser has "Do Not Track" enabled, nothing is measured.

We log technical errors in the service with an error logging tool (Bugsink) that also runs on our own server (hata.alatli.dev): the error message, where in the code it occurred, and the browser and operating system type. User details, cookies, request headers, e-mail addresses and the addresses of scanned sites are removed before anything is logged.

9. Commercial messages

Service e-mails such as account verification, password reset and scan-finished notices do not need consent. Campaign and new-feature announcements (e.g. "Agency plan coming soon, notify me") are sent only with your explicit consent; you can withdraw your consent with one click using the link in every such e-mail.