Privacy Policy

1. Introduction and global scope

This Privacy Policy applies to tecrube.com, subdomains, dashboards, APIs, apps, plugins and marketing-automation / ad-management services (together the “Service”) operated by Hero Invest Ltd (“Tecrube”, “we”, “us”).

It is drafted for users worldwide, including Türkiye, the EEA, UK, US, Middle East and Asia-Pacific. Where mandatory local law (KVKK, GDPR, UK GDPR, CCPA/CPRA, etc.) is stricter, that law prevails; otherwise this Policy applies.

By using the Service or providing personal data you confirm you have read and understood this Policy. If you disagree, do not use the Service.

2. Controller and contact

Controller: Hero Invest Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Official contact: info@tecrube.com.

Privacy requests, breach notices and privacy questions are accepted only at info@tecrube.com. Requests are not completed without identity verification.

For third-party data you upload (customers, leads, recipient lists), you may be controller and Tecrube a processor acting on your instructions, depending on the contract and factual control.

EU representative (GDPR Art. 27): Hero Invest Ltd is not established in the European Union. If an EU representative is appointed under Article 27 GDPR, their name and contact details are given in the company details and in this section; until then, data subjects in the EU may send any request to info@tecrube.com. Transfers from the European Economic Area to the United Kingdom rely on the European Commission's adequacy decision for the United Kingdom.

3. Definitions

“Personal data”: any information relating to an identified or identifiable natural person.

“Processing”: any operation on personal data, including collection, storage, alteration, transfer and deletion.

“Customer Data”: content and personal data you upload or pull into the Service from connected accounts.

“Account Data”: your subscription, billing, identity, support and usage records.

4. Categories of data we collect

Identity and contact: name, e-mail, phone, company, title, country/region, language.

Account and transaction: roles, sessions, plan, billing/tax data, payment status; card details are processed by our payment provider and Merchant of Record, Creem, and are not stored by Tecrube.

Service and integrations: across Setup, Analysis, Management, Ads, Growth, Outreach and Action hubs — campaign, spend, performance, audience, content, conversion, inventory, form, task, CRM, automation and workspace data from connected ad, social, analytics and messaging accounts.

Brand and assets: brand kit (logo, colours, fonts, tone, rules), creatives, briefs and media you upload.

Messaging channels: e-mail/SMS/WhatsApp/voice logs, call recordings and transcripts (if enabled), chat/DM content, lead and recipient lists.

Measurement: pixels, CAPI, UET, server-side tracking, UTM, consent signals and related events.

Support: forms, e-mail, chat and ticket content.

Technical and security: IP, device/browser, OS, referrer, session IDs, logs, cookies, error records, fraud/security signals.

Marketing preferences: consent, opt-out and commercial-message records where applicable.

5. Sources of data

We obtain data from you directly (registration, forms, support, brand kit), automatically from your device, from connected third-party platforms, payment providers, lawfully available public sources and lists you upload.

Competitor-analysis and similar tools rely only on lawful public sources or sources you authorise; unauthorised access or ToS violations are your responsibility.

Data from third-party platforms is subject to their terms and your authorisations. Tecrube is not liable for incomplete, inaccurate or unauthorised transfers from those platforms.

6. Purposes of processing

To provide, configure, secure and improve the Service; run campaign/automation/reporting/CRM/outreach/action features; support you; bill you; prevent abuse, spam and fraud; meet legal duties; and improve products via anonymised/aggregated analytics where possible.

Marketing communications occur only with consent or where law allows; you may opt out at any time.

We do not process personal data to guarantee outcomes (ROAS, sales, leads, etc.); performance metrics are informational.

7. Legal bases (KVKK / GDPR / similar)

Contract performance; legal obligation; legitimate interests (security, product improvement, network protection — without overriding your rights); and consent where required.

For EEA/UK users, GDPR Art. 6 / UK GDPR bases apply. Special-category data is not processed by default; if needed, explicit consent or a statutory exception is required.

For call recording, location or similarly sensitive features, additional notice/consent duties under local law are yours.

Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

8. Automated processing, actions and AI

The Service may use automation and AI for creatives, targeting, optimisation, chat/voice agents and approved automated actions. Outputs are decision-support or automation you authorised; final responsibility is yours.

You may expose account data to external chat/AI connectors (e.g. ChatGPT/Claude-like tools) under your instruction; that transfer risk is yours.

We do not as a rule make solely automated decisions that produce legal or similarly significant effects. If we do, applicable rights to contest and obtain human review remain available.

Only the content needed to do the requested job is sent to AI providers (OpenAI, L.L.C. and, where used, Anthropic PBC; USA): brand profile, campaign context and, when a reply draft is requested, the text of the relevant message. Your customers’ names, phone numbers and e-mail addresses are masked before sending (e.g. “Customer #ab12cd”, “+90 5 * **12”), and contact or identity details inside the message text are masked the same way. This is an international transfer made under the safeguards of KVKK Art. 9 and GDPR Chapter V.

9. Sharing, processors and disclosures

We do not sell personal data and do not “sell” or “share” it for cross-context behavioural advertising under CCPA/CPRA except as permitted for service providers / necessary disclosures.

Sharing occurs only with: (a) hosting, CDN, security, monitoring, payment, e-mail/SMS/WhatsApp/voice, analytics and auth vendors; (b) ad/social/measurement platforms you connect; (c) affiliates if any; (d) authorities when legally required; (e) corporate transactions; (f) protection of rights — and only as necessary.

We apply data-processing terms with vendors. Third-party platform policies also apply; Tecrube does not control them.

The sub-processors below access data for the stated purpose and no other. Those marked “only if you connect” receive nothing unless you connect that account. This list is updated whenever a provider is added, and changes are announced by in-product notice.

OpenAI, L.L.C. — Text and content generation, classification. Processing region: USA. Data transferred: Prompt text: brand profile, campaign context and, when a reply draft is requested, the text of the relevant message. Customers’ names, phone numbers and e-mail addresses (including those inside the message) are masked before sending.

Anthropic PBC — Text and content generation, decision explanations. Processing region: USA. Data transferred: Prompt text: brand profile, campaign context and, when a reply draft is requested, the text of the relevant message. Customers’ names, phone numbers and e-mail addresses (including those inside the message) are masked before sending.

Google LLC (Gemini API) — Text generation and summarisation. Processing region: USA / EU. Data transferred: Prompt text: brand profile, campaign context and, when a reply draft is requested, the text of the relevant message. Customers’ names, phone numbers and e-mail addresses (including those inside the message) are masked before sending.

Groq, Inc. — Low-latency text generation. Processing region: USA. Data transferred: Prompt text: brand profile, campaign context and, when a reply draft is requested, the text of the relevant message. Customers’ names, phone numbers and e-mail addresses (including those inside the message) are masked before sending.

OpenRouter, Inc. — Model routing (only if an administrator selects it). Processing region: USA. Data transferred: Prompt text (customer names, phone numbers and e-mail addresses masked), forwarded to the selected model.

Armitage Labs OÜ (Creem) — Order processing, payment collection, tax, invoicing and refunds as Merchant of Record. Processing region: EU. Data transferred: Name, e-mail, country and postcode, tax ID where given, payment details (card details never reach Tecrübe). As Merchant of Record, Creem also processes this data under its own privacy policy. This transfer is necessary for the service to function.

Google Ireland Ltd. (Google Ads, Analytics) — Ad delivery and measurement — only if you connect your account. Processing region: EU / USA. Data transferred: Ad account ID, campaign and conversion data, through the account you connect.

Meta Platforms Ireland Ltd. — Ad delivery, Instagram/Messenger messaging — only if you connect. Processing region: EU / USA. Data transferred: Ad account ID, campaign data, message contents.

WhatsApp Business Platform (Meta) — Customer messaging — only if you connect. Processing region: EU / USA. Data transferred: Phone number and message content.

TikTok Technology Ltd. — Ad delivery — only if you connect. Processing region: EU / Singapore. Data transferred: Ad account ID and campaign data.

Microsoft Ireland Operations Ltd. (Microsoft Advertising) — Ad delivery and measurement — only if you connect. Processing region: EU / USA. Data transferred: Ad account ID, campaign and conversion data.

Sign-in providers (Google, Apple, Meta, LinkedIn, X) — Single sign-on — only if you use it. Processing region: USA / EU. Data transferred: Name, e-mail and provider user ID.

DGN Teknoloji A.Ş. (data centre and server hosting) — Hosting the server that runs the application, the database and backups. Processing region: Türkiye. Data transferred: All data processed by the service; passwords and provider secrets encrypted. This transfer is necessary for the service to function.

The server's own mail service (SMTP, on the same hosting) — Transactional e-mail: verification, payment and renewal reminders, alerts. If an external e-mail provider is brought in, it is added to this list by name. Processing region: Türkiye. Data transferred: E-mail address and message content. This transfer is necessary for the service to function.

10. International transfers

Data may be processed in Türkiye, the EEA, the US or other countries where infrastructure is located. Where no adequacy decision exists, we use GDPR Standard Contractual Clauses, UK IDTA/Addendum, KVKK Art. 9 safeguards and supplementary measures as needed.

Transfers may be inherent to a global SaaS and integrated platforms. By using the Service you acknowledge such transfers, subject to mandatory local consent rules.

11. Retention

We retain data while your account and contract are active; for statutory billing/tax periods; and as needed for disputes and security logging.

When the purpose ends, data is deleted, destroyed, anonymised or legally archived. Deletion from backups completes within a reasonable technical cycle.

Automatic deletion periods: revoked or expired session records 30 days; password reset, e-mail verification and authorisation records 7 days; sent notifications 90 days (those containing a reset link 7 days); assistant (MCP) call records 1 year; site contact messages, assistant chats and the customer inbox 2 years (immediately when the account is deleted); waitlist entries 1 year. After that they are deleted automatically. Audit records are anonymised after 2 years and deleted after 5 years.

Erasure requests are completed within 30 days at the latest. Invoices are issued and kept by our Merchant of Record, Creem, under its own legal obligations; Hero Invest Ltd keeps its billing and accounting records for 6 years from the end of the relevant accounting period, as required by UK company and tax law (Companies Act 2006 ss.386–388 and HMRC record-keeping rules), limited to the data the law requires. When an account is deleted, the records of the consents you gave are kept for evidentiary purposes with an irreversible hash of your e-mail address instead of the address itself.

12. Security

We apply TLS, access control, authorisation, logging, encryption where appropriate, environment segregation and monitoring. No system is 100% secure.

We notify incidents as required by law. You remain responsible for account security (password, 2FA, API keys).

13. Your rights (global)

Depending on applicable law: access, rectification, erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority (e.g. Turkish Board, EEA DPA, ICO).

Under US state laws such as CCPA/CPRA (if applicable): know, delete, correct, opt out of sale/share and non-discrimination. Requests: info@tecrube.com.

We may verify identity. Unfounded, repetitive or excessive requests may be refused or charged. Response times follow applicable law (typically 30 days / CCPA statutory period).

You can download a machine-readable copy of your data as a ZIP file in the panel under Settings › Security › “Download my data” (at most 3 times in 24 hours). You can withdraw or give again your consent to marketing e-mails at any time with the Settings › Notifications › “Marketing e-mails” switch; account, security and billing e-mails are not affected by this choice.

How to delete the data received from your Meta (Facebook, Instagram, WhatsApp) accounts is explained on the Data Deletion Instructions page.

14. Children

The Service is not directed to anyone under 18. We do not knowingly collect children’s data. If collected in error we will delete it. Parents/guardians should contact info@tecrube.com.

15. Third-party sites and Do Not Track

External links are governed by their own privacy practices; Tecrube is not responsible for them.

There is no uniform industry response to browser Do Not Track signals; we do not guarantee a uniform response unless required by law.

16. Changes

We may update this Policy. The current version is published with an “Updated” date. Material changes may be notified by e-mail or in-product notice.

Continued use after a change constitutes acceptance. If you disagree, close your account and stop using the Service.

17. Contact

Privacy and data requests: info@tecrube.com. This is also the primary channel for formal privacy notices.