Trusapien Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Trusapien Yapay Zeka ve Bilişim Teknolojileri A.Ş. (“Trusapien”, “we”) processes personal data as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable to individuals in the European Economic Area, the GDPR.

It is a single policy covering three surfaces, each addressed in its own section below:

• trusapien.com — our marketing website (Section A1);
• the Trusapien platform — the agentic AI workspace used by our customers' teams (Section A2);
• store.trusapien.com — the Trusapien Agent Store (Section A3).

Registered office: Antalya Teknokenti, Antalya, Türkiye. Contact for privacy matters: Section 12.

2. The data controller

For all three surfaces, the data controller is Trusapien Yapay Zeka ve Bilişim Teknolojileri A.Ş. Where a customer organisation uses the Trusapien platform to process its own content (documents, connectors, workspace data), that customer is the data controller of that content and Trusapien acts as data processor on the customer's documented instructions; that processing is governed by the customer agreement and data processing terms, not by this policy. This policy governs the data for which Trusapien itself determines purposes and means.

3. Surface-specific processing

A1 — trusapien.com (marketing site)

• Contact and demo request forms: name, work e-mail, company, message. Purpose: responding to your inquiry and pre-contractual steps. Legal basis: KVKK Art. 5/2(c) (steps prior to a contract) and Art. 5/2(f) (legitimate interest in responding).
• Server logs: IP address, user agent, timestamps. Purpose: security, abuse prevention, service integrity. Legal basis: Art. 5/2(f).

A2 — Trusapien platform

• Account and workspace administration data: name, work e-mail, role, workspace and instance identifiers, audit and access logs. Purpose: providing the contracted service, access control, security, billing. Legal basis: Art. 5/2(c) (performance of contract), Art. 5/2(ç) (legal obligations, e.g. bookkeeping), Art. 5/2(f).
• Customer content processed through the platform (including content routed to large-language-model providers through our LLM gateway) is processed on behalf of the customer as described in Section 2 and in the applicable data processing terms.

A3 — store.trusapien.com (Agent Store)

At account creation and use of the Store we collect:

• Work e-mail (free e-mail providers are not accepted) — account identity and communication;
• Full name and company name — account identity and B2B contract administration;
• An “I am 18 or older” declaration — confirming contract capacity; the declaration is recorded as part of the acceptance record and no age data is collected;
• Instance ID — linking Store installs to your Trusapien instance;
• Publisher waitlist submissions: name, work e-mail, free-text description — evaluating publisher applications;
• Acceptance records: user ID, timestamp, and the version identifier of each accepted document — proving acceptance of the Terms and this Policy. Legal basis: Art. 5/2(c) and 5/2(f); retained as evidence per Section 9.

Legal bases for the Store data above: performance of a contract and steps prior to it (Art. 5/2(c)); compliance with legal obligations (Art. 5/2(ç)); legitimate interests in service security and record-keeping (Art. 5/2(f)). Where none of these applies to a given processing operation, we will request your explicit consent separately and in accordance with the Turkish DPA Board's principle decision 2026/347; we do not request consent for processing that rests on another legal basis.

4. Google user data and Limited Use

Where you connect a Google account (for example to access Google Ads data through OAuth), our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide and improve the user-facing features of the connected functionality you have enabled;
• we do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice;
• we do not use Google user data for advertising purposes; and
• we do not permit humans to read this data except with your affirmative agreement, where necessary for security or legal compliance, or where the data has been aggregated and anonymised.

This policy is the same document linked from our homepage and from the Google OAuth consent screen.

5. Third-party marketplace listings

The Agent Store contains listings published by third-party publishers. When you install or use a third-party listing, the publisher processes your data under its own privacy policy. Trusapien does not control, and is not responsible for, the privacy practices of third-party publishers. Review the publisher's policy linked from the listing before use. Where a Module transmits your content to a third-party provider's systems, the specific disclosure presented in-product at the point of authorisation applies in addition to this policy.

6. Recipients and sharing

• Infrastructure and hosting providers (Section 7);
• Large-language-model providers, only as needed to deliver requested functionality, under contractual restrictions;
• Payment providers for paid Store transactions;
• Professional advisers (legal, accounting) and public authorities where the law requires disclosure;
• We do not sell personal data and do not share it for third-party advertising.

7. Hosting and cross-border transfers

Our services are hosted partly on KoçSistem infrastructure located in Türkiye and partly on Hetzner infrastructure located in Germany and Finland.

Personal data hosted on KoçSistem remains within Türkiye and does not constitute a cross-border transfer. Personal data processed on Hetzner infrastructure is transferred outside Türkiye; those transfers are carried out under KVKK Article 9 on the basis of the standard contract published by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), executed with the data importer and notified to the Authority within five business days of signature. For individuals subject to the GDPR, transfers within the EEA (Germany, Finland) do not constitute third-country transfers.

8. Sub-processors

Current sub-processors engaged for the processing described in this policy: KoçSistem Bilgi ve İletişim Hizmetleri A.Ş. (hosting, TR); Hetzner Online GmbH (hosting, DE/FI); OpenAI (large-language-model provider, via the Trusapien LLM Gateway). We will update this section when the list changes.

9. Retention

We retain personal data for the periods below, then delete or anonymise it.

10. Your rights (KVKK Article 11)

You may apply to us at any time to: learn whether your personal data is processed; request information about that processing; learn the purpose and whether data is used accordingly; know the third parties to whom data is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request notification of correction/deletion to transfer recipients; object to a result produced exclusively by automated analysis that is against you; and claim compensation for damage caused by unlawful processing.

Applications: in writing to our registered address, or by e-mail to support@trusapien.com from the e-mail address registered with us. We respond within thirty days at the latest, free of charge unless a fee is prescribed by the Board's tariff. EEA individuals may additionally exercise GDPR rights, including lodging a complaint with a supervisory authority.

11. Cookies and analytics

store.trusapien.com uses, in addition to the strictly necessary cookies required for sign-in and security, analytics cookies. Non-essential cookies are set only after your consent, given through the cookie banner shown on your first visit; you may withdraw consent at any time via the Cookie Settings link in the footer. Strictly necessary cookies do not require consent.

trusapien.com uses strictly necessary cookies and, subject to the same consent banner, marketing cookies delivered through Google Tag Manager. No cookie is set before consent is given. The Trusapien platform uses only strictly necessary cookies.

12. Contact

Data controller: Trusapien Yapay Zeka ve Bilişim Teknolojileri A.Ş., Antalya Teknokenti, Antalya, Türkiye. Privacy contact: support@trusapien.com.

13. Changes to this policy

We may update this policy. Each version carries a version identifier and effective date, shown at the top of this page and embedded machine-readably in the page source. Material changes affecting Store users will be notified before they take effect; continued use after the effective date constitutes acceptance where the law permits, and re-acceptance will be collected where it does not. Prior versions are available on request.

14. Minors

Our services are directed to businesses and their personnel. We do not knowingly collect personal data from anyone under 18. Store signup requires an “I am 18 or older” declaration; no age data is collected.