Privacy Policy

This Privacy Policy explains how [COMPANY LEGAL NAME], registered at [COMPANY REGISTERED ADDRESS] ("we", "us", "our"), collects and processes personal data when you use WebBurrow. For data protection purposes, we act as the data controller. If you have any questions, contact [PRIVACY CONTACT EMAIL].

• Account data. Your email address. Your password is stored only as a secure hash — we never see or store it in plain text.
• Signup metadata. The IP address used at registration and your email domain, used for abuse prevention (multi-account and disposable-email detection).
• Query data. The URLs you submit for analysis, the query type and depth, timestamps, and the reports we generate for you.
• Payment data. Processed by Polar, our Merchant of Record. We do not store your full card details; we receive limited billing and subscription status from Polar.
• Technical logs. Minimal application logs (such as errors and job status) for reliability and security.

• to provide the Service — run analyses, deliver reports, and track your credit balance;
• to send transactional email (email verification, "your report is ready", and account notices) through our email provider;
• to prevent abuse and fraud and to enforce usage limits;
• to measure the cost and reliability of queries as aggregate telemetry; and
• to comply with our legal obligations.

We rely on the following legal bases: performance of our contract with you (providing the Service); our legitimate interests (security, abuse prevention, and product reliability); your consent where it is required; and compliance with legal obligations. Under Türkiye's KVKK, we process personal data on the corresponding lawful grounds, including performance of a contract, our legitimate interests, and legal obligations.

• Raw scrape artifacts (temporary technical byproducts of an analysis) are automatically deleted 30 days after the query.
• Reports remain in your account until you delete them or delete your account (self-service deletion).
• Account deletion results in full deletion of your personal data within 30 days, except for records we are legally required to keep (for example, invoices held by our payment processor for accounting purposes).

We do not sell your personal data. We share data with service providers who process it on our behalf, under contract and only on our instructions:

• Polar (Merchant of Record) — payments, billing, and tax.
• Resend — transactional email delivery.
• Hetzner — hosting and storage (EU).

Our infrastructure is hosted in the EU. Where personal data is transferred outside your region, we rely on appropriate safeguards (such as standard contractual clauses) as required by GDPR and KVKK.

Depending on your location, you may have the right to access, rectify, delete, restrict, or object to the processing of your personal data, and the right to data portability. To exercise these rights, email [PRIVACY / DSAR CONTACT EMAIL]. We commit to responding within 30 days.

You also have the right to lodge a complaint with your data protection authority — in Türkiye, the Personal Data Protection Authority (KVKK); in the EU, your local supervisory authority.

We use a single essential cookie to keep you signed in (your authentication session). We do not use advertising or third-party tracking cookies. Because this cookie is strictly necessary to provide the Service, it does not require consent; you can clear it through your browser, but you will be signed out.

We apply reasonable technical and organizational measures, including encryption in transit, hashed passwords, access controls, EU hosting, and regular backups. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

The Service is not directed to children under [16], and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app.

[COMPANY LEGAL NAME] · [COMPANY REGISTERED ADDRESS] · Privacy contact: [PRIVACY CONTACT EMAIL].

This policy is designed to align with KVKK (Türkiye) and GDPR (EU) and is pending final legal review.