Data Processing Terms

1. Roles — who is responsible for what

These terms are an integral annex to the Terms of Service and apply to every customer using Tecrübe, whether or not signed separately.

Parties: the customer using the service (“you”) and Hero Invest Ltd (“Tecrübe”), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom · Country of registration: United Kingdom (England and Wales) · Company number: 14955675. The legal entity that takes on the processor's obligations is Hero Invest Ltd; “Tecrübe” in these terms means that company.

CUSTOMER DATA (your own customers' data: contact lists, incoming messages, conversion records): here you are the controller and Tecrübe is the processor. You decide what you collect, on what legal basis you process it, and what you tell whom; Tecrübe processes only on your instructions.

ACCOUNT DATA (your and your team's names, e-mails, session records, billing details): here Tecrübe is the controller and the Privacy Policy applies. The distinction matters: one product, two legal roles, and your rights differ by which data is involved.

Tecrübe never uses Customer Data for its own purposes — product development, model training, marketing. There is no exception; if there were, it would be written here.

2. Subject matter, duration, nature and purpose

Subject matter: provision of the Tecrübe service. Duration: for as long as your subscription lasts, plus the return/deletion period in section 10.

Processing activities: storage, organisation, retrieval, transmission (to the platforms you connect), deletion, and text generation with AI models.

Data categories: contact details (name, e-mail, phone), message content, behavioural and conversion data, and the lists and content you upload.

Categories of data subjects: your customers, prospects, people who message you, and members of your team.

Special-category data: the service is not designed to process it. If you upload it, the additional protections and explicit-consent obligations are yours.

3. Processing on instructions

Tecrübe processes Customer Data only on your documented instructions. Your use of the service — launching a campaign, uploading a list, enabling an automation — constitutes such an instruction.

If we believe an instruction infringes applicable law, we will inform you and may stop carrying it out.

If law compels processing (a court order, an administrative demand) and notification is not prohibited, we inform you before processing.

4. Confidentiality and security

Everyone with access to Customer Data is bound by confidentiality, and access is limited to the narrowest scope the work requires.

Technical measures in place: encryption in transit and at rest, tenant isolation enforced at the database level with row-level security, argon2id password hashing, provider secrets encrypted with a separate key, role-based access, and an audit record of every privileged action.

Organisational measures: staff access is logged; a support view of a tenant is shown with a visible banner to both the viewer and the tenant; regular backups with restore drills.

These measures may change over time; a change may not lower the level of security.

5. Sub-processors

Tecrübe uses sub-processors to provide the service. The current list — who they are, for what purpose and in which country — is published by name in section 9 of the Privacy Policy.

New sub-processors are announced by in-product notice. If you object on reasonable grounds, we will consider your objection; if it cannot be resolved, you may terminate without penalty and receive a refund for the unused period.

Each sub-processor is bound by a contract with obligations equivalent to these terms. Tecrübe remains liable for a sub-processor's acts as for its own.

Data sent to AI providers is limited to what the requested job needs: brand profile, campaign context and, when a reply draft is requested, the text of the relevant message. Customers’ names, phone numbers and e-mail addresses — including those inside the message text — are masked before sending (e.g. “Customer #ab12cd”, “+90 5 * **12”). These providers (OpenAI and, where used, Anthropic) are in the USA; the transfer is made under the safeguards in clause 6.

6. International transfers

Some sub-processors are outside the United Kingdom, the European Economic Area and Türkiye (notably AI providers and ad platforms). Transfers are made under the UK GDPR, Chapter V of the GDPR and Article 9 of the KVKK, relying as applicable on standard contractual clauses (with the UK International Data Transfer Addendum), an adequacy decision or explicit consent.

Which sub-processor processes in which country is stated next to each entry in the Privacy Policy list.

7. Data-subject requests and assistance to you

If a data subject contacts Tecrübe directly, we do not answer on your behalf — we refer them to you, since you are the controller for that data.

The tools you need to satisfy access, rectification, erasure and portability requests are in the product: a machine-readable copy can be downloaded as a ZIP under Settings › Security › “Download my data” (at most 3 times in 24 hours), and erasure requests are completed within 30 days. Where the tooling is not enough, we provide reasonable technical assistance.

If you must carry out a data protection impact assessment (Article 35), we provide the information we hold, to a reasonable extent.

8. Breach notification

We notify you of a security breach affecting Customer Data without undue delay and within 24 hours at the latest of becoming aware of it. That window is deliberately short so that you can meet your own 72-hour notification duty.

The notice includes: the nature of the breach, the categories of data and approximate number of records affected, likely consequences, measures taken and planned, and a contact point.

If not everything is known at first notice, the missing information follows without delay; waiting is not a substitute for notifying.

9. Audit

On request we provide the information needed to demonstrate compliance with these terms.

Once a year, on reasonable notice and during business hours, you may audit using an auditor bound by confidentiality. An audit may not involve access to other customers' data and is conducted so as not to disrupt the service.

10. Return and deletion at the end

When your subscription ends, Customer Data remains exportable for thirty days; you can download it from the panel during that time.

At the end of the thirty days the data is deleted. Deletion is irreversible and is announced by e-mail seven days in advance.

Copies in backups age out with the backup cycle (at most ninety days); during that time they remain encrypted and inaccessible.

Records that law requires us to keep (invoices, the audit log) are retained for their statutory period and processed for that purpose only.