Data Protection Notice

1. Controller and scope

Controller: Hero Invest Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact: info@tecrube.com.

This notice is prepared under Turkish Law No. 6698 (“KVKK”), related communiqués, GDPR/UK GDPR and other applicable data-protection regimes.

Scope: site visitors, account users, prospects, support contacts, event/communication records and other data subjects via the Service.

2. Categories of personal data

Identity: name; national/tax IDs only when required for invoicing or law.

Contact: e-mail, phone, address, company, title, country.

Customer transaction: account, subscription, invoice, support, campaign/automation/CRM/workspace usage records.

Outreach channels: e-mail/SMS/WhatsApp/DM/voice logs, call recordings and transcripts (if enabled), lead/recipient lists.

Brand/assets: brand kit, creatives and uploaded media metadata.

Measurement: pixel/CAPI/server-side events and consent signals.

Marketing: consent/opt-out, preferences and campaign interactions where applicable.

Security: IP, logs, device/browser, cookies, sessions, security events.

Finance: invoice lines, payment status; card data is processed by our Merchant of Record, Creem, and is not stored by Tecrübe.

Audio/visual: support recordings or media you upload, if any, limited to purpose.

3. Collection methods

Data may be collected via web forms, registration, cookies, logs, support channels, payment infrastructure, connected third-party APIs, measurement tags and lawfully obtained public sources, fully or partly by automated means.

4. Purposes

Contract formation/performance; Service delivery across Setup–Action hubs; account/workspace role management; running campaign/automation/outreach/CRM tools; support; billing; security; abuse prevention; audit trails; legal duties; product improvement and legitimate-interest analytics.

Where based on consent: informational and marketing communications.

We do not aim to guarantee outcomes or perform solely automated decisions with legal effects.

5. Legal bases

KVKK Arts. 5–6: legal provision, contract, legal obligation, data made public by the data subject, establishment/exercise/defence of rights, legitimate interests, explicit consent.

GDPR Art. 6 (EEA/UK): contract, legal obligation, legitimate interests, consent and other bases where applicable. Special-category data is not processed by default.

6. Transfers and cross-border

Recipients may include hosting/CDN/security, payment, messaging, analytics, auth and ad/social vendors; competent authorities; and parties to corporate transactions under confidentiality.

Cross-border transfers use KVKK Art. 9, GDPR SCCs, UK IDTA/Addendum and supplementary measures. Global SaaS delivery may make transfers necessary.

Transfers to accounts you connect follow your instructions and platform terms.

Only the content needed to do the requested job is sent to AI providers (OpenAI, L.L.C. and, where used, Anthropic PBC; USA): brand profile, campaign context and, when a reply draft is requested, the text of the relevant message. Your customers’ names, phone numbers and e-mail addresses are masked before sending (e.g. “Customer #ab12cd”, “+90 5 * **12”), and contact or identity details inside the message text are masked the same way. This is an international transfer made under the safeguards of KVKK Art. 9 and GDPR Chapter V.

The recipients to whom personal data is transferred are listed one by one in section 9 of the Privacy Policy, with name, purpose, country of processing and data category. Those required for the service to work are: Armitage Labs OÜ (Creem); DGN Teknoloji A.Ş. (data centre and server hosting); The server's own mail service (SMTP, on the same hosting). The others (AI providers, the ad and messaging platforms you connect, sign-in providers) receive data only when you use the relevant feature.

7. Retention

Purpose limitation plus commercial/tax retention, limitation periods and security-log needs. Then deletion, destruction or anonymisation.

Customer Data retention also follows the account contract and your instructions; after termination it is cleaned within a reasonable technical period (legal duties reserved).

Automatic deletion periods: revoked or expired session records 30 days; password reset, e-mail verification and authorisation records 7 days; sent notifications 90 days (those containing a reset link 7 days); assistant (MCP) call records 1 year; site contact messages, assistant chats and the customer inbox 2 years (immediately when the account is deleted); waitlist entries 1 year. After that they are deleted automatically. Audit records are anonymised after 2 years and deleted after 5 years.

Erasure requests are completed within 30 days at the latest. Invoices are issued and kept by our Merchant of Record, Creem, under its own legal obligations; Hero Invest Ltd keeps its billing and accounting records for 6 years from the end of the relevant accounting period, as required by UK company and tax law (Companies Act 2006 ss.386–388 and HMRC record-keeping rules), limited to the data the law requires. When an account is deleted, the records of the consents you gave are kept for evidentiary purposes with an irreversible hash of your e-mail address instead of the address itself.

8. Data-subject rights and requests

Under KVKK Art. 11 and GDPR Arts. 12–22: access, information, rectification, erasure, restriction, objection, portability, contesting automated decisions, compensation and withdrawal of consent.

Requests: info@tecrube.com with identity details and request scope. Response times follow KVKK/GDPR.

Complaints: Turkish Personal Data Protection Board and/or your local supervisory authority.

You can download a machine-readable copy of your data as a ZIP file in the panel under Settings › Security › “Download my data” (at most 3 times in 24 hours). You can withdraw or give again your consent to marketing e-mails at any time with the Settings › Notifications › “Marketing e-mails” switch; account, security and billing e-mails are not affected by this choice.

9. User / controller duties

For bulk messaging and recipient lists, consent/opt-out records, notices and legality are your responsibility. All consequences of unlawful lists are yours.

You represent you have a lawful basis for data you transfer; otherwise you will defend and indemnify Tecrube.

10. Security measures

Under KVKK Art. 12 and GDPR Art. 32 we apply access control, encryption where appropriate, logging, monitoring, staff confidentiality and vendor controls.

Absolute security is not guaranteed; measures are proportionate and kept current.

11. Updates

This notice may be updated. The current version is published on the site. Contact: info@tecrube.com.