1. Who we are and what this policy covers
This Privacy Policy explains how Trusapien Yapay Zeka ve Bilişim Teknolojileri A.Ş. (“Trusapien”, “we”) processes personal data as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable to individuals in the European Economic Area, the GDPR.
It is a single policy covering three surfaces, each addressed in its own section below:
trusapien.com — our marketing website (Section A1);
the Trusapien platform — the agentic AI workspace used by our customers' teams (Section A2);
store.trusapien.com — the Trusapien Agent Store (Section A3).
Registered office: AOSB 1. Kısım Mah. 40. Cad. No: 4 İç Kapı No: 203, Döşemealtı / ANTALYA 07190, Türkiye. Contact for privacy matters: Section 12.
2. The data controller
For all three surfaces, the data controller is Trusapien Yapay Zeka ve Bilişim Teknolojileri A.Ş. Where a customer organisation uses the Trusapien platform to process its own content (documents, connectors, workspace data), that customer is the data controller of that content and Trusapien acts as data processor on the customer's documented instructions; that processing is governed by the customer agreement and data processing terms, not by this policy. This policy governs the data for which Trusapien itself determines purposes and means.
3. Surface-specific processing
A1 — trusapien.com (marketing site)
Contact and demo request forms: name, work e-mail, company, message. Purpose: responding to your inquiry and pre-contractual steps. Legal basis: KVKK Art. 5/2(c) (steps prior to a contract) and Art. 5/2(f) (legitimate interest in responding).
Server logs: IP address, user agent, timestamps. Purpose: security, abuse prevention, service integrity. Legal basis: Art. 5/2(f).
A2 — Trusapien platform
Account and workspace administration data: name, work e-mail, role, workspace and instance identifiers, audit and access logs. Purpose: providing the contracted service, access control, security, billing. Legal basis: Art. 5/2(c) (performance of contract), Art. 5/2(ç) (legal obligations, e.g. bookkeeping), Art. 5/2(f).
Customer content processed through the platform (including content routed to large-language-model providers through our LLM gateway) is processed on behalf of the customer as described in Section 2 and in the applicable data processing terms.
A3 — store.trusapien.com (Agent Store)
At account creation and use of the Store we collect:
Work e-mail (free e-mail providers are not accepted) — account identity and communication;
Full name and company name — account identity and B2B contract administration;
An “I am 18 or older” declaration — confirming contract capacity; the declaration is recorded as part of the acceptance record and no age data is collected;
Instance ID — linking Store installs to your Trusapien instance;
Publisher waitlist submissions: name, work e-mail, free-text description — evaluating publisher applications;
Acceptance records: user ID, timestamp, and the version identifier of each accepted document — proving acceptance of the Terms and this Policy. Legal basis: Art. 5/2(c) and 5/2(f); retained as evidence per Section 9.
Legal bases for the Store data above: performance of a contract and steps prior to it (Art. 5/2(c)); compliance with legal obligations (Art. 5/2(ç)); legitimate interests in service security and record-keeping (Art. 5/2(f)). Where none of these applies to a given processing operation, we will request your explicit consent separately and in accordance with the Turkish DPA Board's principle decision 2026/347; we do not request consent for processing that rests on another legal basis.
4. Google user data and Limited Use
Where you connect a Google account (for example to access Google Ads data through OAuth), our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
we use Google user data only to provide and improve the user-facing features of the connected functionality you have enabled;
we do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice;
we do not use Google user data for advertising purposes; and
we do not permit humans to read this data except with your affirmative agreement, where necessary for security or legal compliance, or where the data has been aggregated and anonymised.
This policy is the same document linked from our homepage and from the Google OAuth consent screen.
5. Third-party marketplace listings
The Agent Store contains listings published by third-party publishers. When you install or use a third-party listing, the publisher processes your data under its own privacy policy. Trusapien does not control, and is not responsible for, the privacy practices of third-party publishers. Review the publisher's policy linked from the listing before use. Where a Module transmits your content to a third-party provider's systems, the specific disclosure presented in-product at the point of authorisation applies in addition to this policy.
6. Recipients and sharing
Infrastructure and hosting providers (Section 7);
Large-language-model providers, only as needed to deliver requested functionality, under contractual restrictions;
Payment providers for paid Store transactions;
Professional advisers (legal, accounting) and public authorities where the law requires disclosure;
We do not sell personal data and do not share it for third-party advertising.
7. Hosting and cross-border transfers
Our services are hosted partly on KoçSistem infrastructure located in Türkiye and partly on Hetzner infrastructure located in Germany and Finland.
Personal data hosted on KoçSistem remains within Türkiye and does not constitute a cross-border transfer. Personal data processed on Hetzner infrastructure is transferred outside Türkiye; those transfers are carried out under KVKK Article 9 on the basis of the standard contract published by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), executed with the data importer and notified to the Authority within five business days of signature. For individuals subject to the GDPR, transfers within the EEA (Germany, Finland) do not constitute third-country transfers.
8. Sub-processors
Current sub-processors engaged for the processing described in this policy: KoçSistem Bilgi ve İletişim Hizmetleri A.Ş. (hosting, TR); Hetzner Online GmbH (hosting, DE/FI); OpenAI (large-language-model provider, via the Trusapien LLM Gateway). We will update this section when the list changes.
9. Retention
We retain personal data for the periods below, then delete or anonymise it.
Data category Retention Rationale
Marketing site inquiries 10 years —
Store account data (name, company, work e-mail) Duration of account + 10 years Turkish Code of Obligations general limitation period for contract claims
Acceptance records (user ID, timestamp, doc version) Duration of account + 10 years Evidence of contract formation
Instance ID Duration of account + 10 years Aligned with account data
Publisher waitlist submissions 10 years —
Platform audit/access logs 10 years —
Server logs (IP, user agent) 10 years —
Billing and invoice data 10 years Tax Procedure Law and commercial bookkeeping obligations
Analytics data 10 years —
10. Your rights (KVKK Article 11)
You may apply to us at any time to: learn whether your personal data is processed; request information about that processing; learn the purpose and whether data is used accordingly; know the third parties to whom data is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request notification of correction/deletion to transfer recipients; object to a result produced exclusively by automated analysis that is against you; and claim compensation for damage caused by unlawful processing.
Applications: in writing to our registered address, or by e-mail to support@trusapien.com from the e-mail address registered with us. We respond within thirty days at the latest, free of charge unless a fee is prescribed by the Board's tariff. EEA individuals may additionally exercise GDPR rights, including lodging a complaint with a supervisory authority.
11. Cookies and analytics
store.trusapien.com uses, in addition to the strictly necessary cookies required for sign-in and security, analytics cookies. Non-essential cookies are set only after your consent, given through the cookie banner shown on your first visit; you may withdraw consent at any time via the Cookie Settings link in the footer. Strictly necessary cookies do not require consent.
trusapien.com uses strictly necessary cookies and, subject to the same consent banner, marketing cookies delivered through Google Tag Manager. No cookie is set before consent is given. The Trusapien platform uses only strictly necessary cookies.
12. Contact
Data controller: Trusapien Yapay Zeka ve Bilişim Teknolojileri A.Ş., AOSB 1. Kısım Mah. 40. Cad. No: 4 İç Kapı No: 203, Döşemealtı / ANTALYA 07190, Türkiye. Privacy contact: support@trusapien.com.
13. Changes to this policy
We may update this policy. Each version carries a version identifier and effective date, shown at the top of this page and embedded machine-readably in the page source. Material changes affecting Store users will be notified before they take effect; continued use after the effective date constitutes acceptance where the law permits, and re-acceptance will be collected where it does not. Prior versions are available on request.
14. Minors
Our services are directed to businesses and their personnel. We do not knowingly collect personal data from anyone under 18. Store signup requires an “I am 18 or older” declaration; no age data is collected.
15. Data deletion — connected Meta accounts
This section covers the data Trusapien processes when a customer connects their Meta (Facebook and Instagram) advertising account through Facebook Login for Business. Trusapien accesses Meta ads data in read-only mode to provide analysis and reporting; it does not create or modify campaigns. The data involved is: the access token Meta issues when the account is connected; the identifiers of the connected business and ad accounts; and the ad performance data retrieved to answer the user's requests.
We do not sell Meta data, and we use it only to provide the service to the customer who connected the account.
Removing Trusapien's access
In Trusapien: Integrations → Connected → MCP → Meta Ads → Disconnect. Every user can remove their own connection; other members of the workspace are not affected.
On Facebook: Settings & privacy → Settings → Business integrations → select “Trusapien” → Remove.
Removing access immediately stops any further data retrieval. Workspace administrators can also remove the Meta Ads integration for the whole workspace (Delete server); this deletes the stored Meta access tokens of all members.
Requesting deletion of stored data
To have data that is already stored deleted, e-mail support@trusapien.com with the subject “Meta data deletion request”, from the e-mail address associated with your Trusapien account, and include your company name.
We confirm receipt, delete the stored Meta access tokens and all Meta-sourced data for that account, and send you a confirmation within 30 days.
What happens when you disconnect
When you disconnect Meta Ads in Trusapien, Trusapien immediately revokes its authorisation on Meta's side and deletes the access token stored for you. Ad data already retrieved to answer earlier requests is not removed by disconnecting; it stays until it is deleted on request, as described above.
