Skip to content

Privacy Policy

Effective Date: October 24, 2026  ·  Version: 1.10

0. Scope & Our Data Protection Roles

This Policy explains how SEZ YAZILIM DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ processes personal data:

  • Website Visitor & Platform User Data (Controller Role). We act as the Data Controller for data collected when you visit our website or playground, contact us, subscribe to our newsletter, or create and use a platform account. This includes account, billing, support, security, and related operational data.
  • End-Recipient / Contact List Data (Processor Role).When our customers upload or otherwise process contact lists and email through our services, we act as a Data Processor on their documented instructions. If a customer processes that data for another controller, we act as its sub-processor and the customer must have that controller's authorization. The same applies when customers enable inbound email on their domains: messages sent to those addresses (including sender details, message content, and attachments) are received, stored, and processed on the customer's behalf and under the customer's instructions. Customers must ensure that required notices, consents and commercial electronic message permissions are in place and coordinate data subject requests with the responsible controller. We assist under our Data Processing Addendum (DPA).

    If you are an end-recipient of an email sent through our customer, please contact the sender directly. Where appropriate, we may redirect your request to the relevant customer (controller) and/or process your request only to the extent required by applicable law and our DPA.

1. Data Controller Identity

  • Company Name: SEZ YAZILIM DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ
  • Tax ID: 7671308211
  • Registered Address: EVLİYA ÇELEBİ MAH. SADİ KONURALP CAD. IKSV VAKFI NO: 5 İÇ KAPI NO: 2 BEYOĞLU/ İSTANBUL
  • Contact (Privacy): support@sevk.io

1.1 Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

  • European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/sevk

2. Categories of Personal Data & Collection Methods

2.1 Website Visitors & Platform Users (Controller)

We may process:

  • Identity & Contact: first and last name, email, phone (if provided)
  • Profile (optional): title, department, location, avatar image (only if you fill them in on your profile page)
  • Account & Authentication: account identifiers, sign-in credentials, optional third-party sign-in identifiers, security settings, project memberships and roles, IP addresses, device information, and sign-in activity
  • Consent records: Terms of Service acceptance timestamp and marketing-communications consent flag
  • Billing: billing contact details, tax ID, billing address, payment status, and payment or subscription references. Paddle processes payment card data; we do not store it.
  • Support & Communications: contact form submissions (name, email, subject, and message), support tickets, quota-increase requests, and email correspondence
  • Newsletter: email address, signup source, and subscription records
  • Technical & Usage: IP addresses and browser information for security, service activity, errors, performance information, and diagnostic logs. We do not track your browsing history across external websites. See our Cookie Policy for diagnostics.
  • Cookies / Similar Tech: see Section 9 and our Cookie Policy

Collection methods: contact and newsletter forms, registration forms, profile and project settings, billing flow, customer support channels, and automatic service logging during use.

2.2 End-Recipients / Contact Lists (Processor)

Depending on the customer's use, we may process email addresses, subscription state, audience and segment membership, bounce and complaint history, message content and metadata (subject, status, timestamps, message ID, user-agent), and optional contact custom fields. For inbound mail, this includes sender details, headers, bodies and attachments. This processing provides the services on the customer's instructions.

Optional AI drafting shares your prompts, conversation history, draft and supplied images with the selected AI provider. We may store generated content and conversations for this feature. If you use your own provider key, your selected provider's terms apply. Providers and processing locations are listed on our Subprocessors page.

Optional Playground email sending forwards the sender, recipients, subject and message through our server to the email provider you select, using your own API key and provider account. The available providers and scope are listed on our Subprocessors page.

3. Purposes of Processing & Legal Bases

3.1 Website Visitors & Platform Users (Controller)

We process your data for:

  • Service provision & account management
  • Customer support & communications
  • Security, fraud prevention, abuse monitoring
  • Service improvement (where lawful)
  • Legal compliance (e.g., accounting, responding to lawful requests)
  • Marketing to platform users (only with opt-in where required)
  • KVKK legal bases: contract necessity, legal obligation, legitimate interests, and explicit consent where applicable.
  • GDPR legal bases (Art. 6): contract, legal obligation, legitimate interests, and consent where applicable.

We answer contact enquiries to take steps you request before a contract or, for other enquiries, on our legitimate interest in responding and providing support. We send newsletter updates with your consent; you can unsubscribe at any time. Form security checks help prevent abuse on the basis of our legitimate interests.

3.2 End-Recipients / Contact Lists (Processor)

We process end-recipient data as a processor under the customer's instructions and our DPA. The customer determines the relevant legal basis and provides required notices/consents.

4. Special Categories of Personal Data

We do not require or request special categories of personal data. Customers and users must not upload or include special category data in free-text fields or mailing lists.

If we become aware of such data, we may restrict access, suspend processing, or delete the content as permitted by law, our Terms, and our DPA, and may notify the customer. We do not automatically scan email content for special category data.

Any exception (if ever) must be explicitly agreed in writing and documented with appropriate safeguards.

5. Data Sharing (Recipients of Personal Data)

5.1 For Website Visitors & Platform Users (Controller)

We may share personal data with:

  • Service providers for hosting, storage, email delivery, diagnostics, bot protection, optional AI drafting, and aggregate website analytics, as described in our provider list.
  • GitHub or Google when you choose their sign-in option, under their applicable account and privacy terms; and Paddle as Merchant of Record and a separate controller for payment, tax and billing processing.
  • Authorized public bodies when required by law
  • Corporate transactions, subject to lawful safeguards

Provider names, roles, and processing locations are listed on our Subprocessors page.

Our website loads a service-status badge from Better Stack, and the Playground offers sample images from Unsplash. When these resources load, your browser connects to the relevant provider and sends technical request data, including your IP address and browser information, and may send referring-page information.

5.2 For End-Recipients (Processor)

We may engage approved subprocessors to provide our services (e.g., cloud infrastructure, deliverability tooling). Details are provided in our DPA and subprocessor list.

6. International Data Transfers

sevk is established in Türkiye and uses providers in the countries listed on our Subprocessors page. International transfers are subject to the safeguards below.

Türkiye (KVKK): Transfers from Türkiye, including to EU hosting locations, require a mechanism permitted by KVKK Article 9. Where a Turkish standard contract is used, the parties must execute the applicable form and notify the Authority within five business days after signatures are completed. EU SCCs and publication of this policy do not replace those steps. Contact us for the safeguards applicable to a particular transfer.

EU/EEA (GDPR): Transfers outside the EEA require an applicable Chapter V mechanism, such as an adequacy decision or EU Commission Standard Contractual Clauses with any necessary supplementary measures. The mechanism depends on the parties, roles and destination; provider terms are referenced on our Subprocessors page.

7. Data Retention

We retain personal data only as long as necessary for these purposes and legal obligations.

  • Account data: retained while the account is active. Account deletion removes the live profile and sign-in sessions; other records follow the periods below. Shared projects remain available to their other owners.
  • Deletion records: minimal records of deletion operations are retained for three years after completion. The contact email used to communicate the outcome is removed from the account-deletion record when the review is completed. These records do not contain copies of email bodies or attachments.
  • Contact enquiries: retained as needed to respond, handle follow-up, and meet applicable legal obligations.
  • Newsletter subscriptions: retained while subscribed. After you unsubscribe, limited consent and opt-out records may be retained under the suppression and legal-evidence rules below.
  • Audiences, contacts, broadcasts, templates, and domains: retained until the responsible project owner deletes them, subject to the retained-copy rules in this section. Leaving a shared project or deleting one member's account does not delete other members' project data.
  • Deleted projects: deleting a project removes its live records and opens a review of remaining storage and history copies, due within 30 days. Necessary legal evidence is reviewed before erasure, with its reason, case reference and next review date recorded. Copies without a continuing lawful basis are erased through the review. This does not extend the retention periods below or applicable request deadlines.
  • Billing/financial records: retained for statutory periods under applicable tax/accounting laws (typically several years under Turkish tax law).
  • Security and operational logs: retained for a limited period aligned with security needs and legal requirements.
  • Turkish Law No. 5651: where we qualify as a hosting provider under Turkish law, relevant traffic/access logs are retained for the period required by the law (between one and two years).
  • End-recipient data (processor): retained according to the customer's instructions and our DPA (including deletion timelines and backup cycles). Upon deletion requests, data is deleted, destroyed, or anonymized where applicable, subject to lawful retention obligations.
  • Outgoing message content: message bodies and per-send attachment copies are retained for up to 30 days after handoff to the delivery provider, final failure, or cancellation. Pending and scheduled messages remain available while delivery processing is necessary. Opens and clicks do not restart this period. Reusable templates, broadcast source content, uploaded files and inbound messages follow their separate project-deletion rules.
  • Email delivery summaries: retained for up to 90 days from the same sending outcome. After this period, unresolved billing reconciliation retains only the technical and financial evidence needed to settle the reservation, without message bodies, subject lines or sender/recipient addresses. Activity history and backups follow the separate periods below.
  • Delivery queues: completed job payloads are removed within 24 hours of completion; terminal failed job payloads within 7 days of final failure. Active, waiting, scheduled and retrying jobs remain available until processing ends or they are cancelled.
  • Tracked links: destination URLs and their technical routing identifiers remain until project deletion so links in previously delivered messages continue to work. Destination URLs may contain identifiers supplied by the customer.
  • Activity timeline: the managed-service retention policy is 2 years for individual open, click, bounce and complaint events.
  • Email analytics: aggregate totals are retained for the lifetime of the project. Records that identify a recipient remain subject to the applicable retention periods and verified erasure requests.
  • Website analytics: detailed events and daily summaries are retained for historical reporting without automatic age-based deletion.
  • Error reports: filtered reports and summaries are retained for historical diagnosis without automatic age-based deletion.
  • Backups: our policy requires deletion of restricted backup copies within 30 days after deletion from live systems, unless retention is required by law. Erasure instructions must be reapplied before restored data returns to normal use.
  • Suppression and legal evidence: limited data may be retained for an identified opt-out, security, or legal purpose, with a lawful basis, restricted access, and a retention or review date.

8. Security Measures

We use access controls, encryption, monitoring, and incident response measures appropriate to the risk. Their scope is described on our Security page. No system can guarantee absolute security.

9. Cookies & Similar Technologies

We use cookies and similar technologies for sign-in, security, payments, and preferences. We do not use marketing cookies or cross-site advertising.

We collect filtered error reports to diagnose service problems. Reports include application version, error details and the affected page, without account identifiers, customer content or session recordings. Filtering does not guarantee anonymity.

Website analytics measures page views, referring domains, campaign tags and approximate daily visitors. It processes IP addresses and browser type without retaining raw IP addresses in analytics records. Analytics respects Do Not Track and uses no cookies, browser storage or cross-site tracking. It does not collect dashboard visits, account details, form content or customer messages. Security logs are separate.

For details and cookie management options, please see our Cookie Policy.

10. Your Rights & How to Exercise Them

10.1 Website Visitors & Platform Users (Controller)

  • learning whether personal data is processed;
  • requesting information if processed;
  • learning the purpose of processing and whether used in line with that purpose;
  • knowing third parties to whom data is transferred (domestic/abroad);
  • requesting correction of incomplete/incorrect data;
  • requesting deletion/destruction where conditions are met;
  • requesting notification of correction/deletion to third parties to whom data was transferred;
  • objecting to results arising against you through analysis by automated systems;
  • requesting compensation if you suffer damage due to unlawful processing;
  • under GDPR, where applicable: restriction and data portability;
  • where processing relies on your consent, withdrawing that consent at any time without affecting the lawfulness of processing before withdrawal.

Right to object (GDPR, where applicable): You may object to processing based on legitimate interests on grounds relating to your situation. You may object to direct marketing at any time, and we will stop processing your data for that purpose. These rights include related profiling.

You can request account deletion in your account settings or contact us for erasure or assistance. Unresolved payments or shared projects may require separate action, but do not by themselves justify retaining unrelated personal data.

To exercise your rights, contact us at: support@sevk.io

We may request proportionate information to verify your identity and authority over the requested data. Verified erasure is reviewed separately from ordinary contact or project deletion, including relevant providers and backup copies. We respond within the applicable statutory period (maximum 30 days under KVKK, or one month under GDPR, subject to any lawful extension and required notice). If a specific retention obligation prevents full erasure, we explain the scope and reason where legally permitted. You may complain to the competent supervisory authority if you disagree with the response or do not receive one within the applicable period.

  • For users in Türkiye: You may file a complaint with the Personal Data Protection Board within 30 days of learning our response, and in any event within 60 days of your application date.
  • For users in the EU/EEA or UK: You have the right to lodge a complaint with your local Data Protection Authority (DPA) in the country of your habitual residence, place of work, or place of the alleged infringement.

10.2 End-Recipients (Customer's Controller)

If you received an email sent by one of our customers, please use the unsubscribe link in that email or contact the sender (our customer). If you contact us directly, we may redirect your request to the relevant customer.

11. Updates to This Policy

We may update this Policy from time to time. Material changes will be notified through reasonable means (e.g., in-app notice or email). The effective date will be updated accordingly.

12. Data Processing Addendum (DPA)

Our Data Processing Addendum governs how we process customer-controlled data on your instructions. It forms part of the Agreement and prevails over conflicting terms about that processing.

By using sevk.io, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy, our Terms of Service, our Data Processing Addendum, and our Cookie Policy.