Privacy Policy

This policy explains which personal data Sonmezy (“we”) processes when you use Sonmezy (the “Service”) or visit this website, why, for how long, and what your rights are. It applies under the EU and UK General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK) and other applicable laws.

1. Controller and contact

The controller is Sonmezy. For privacy questions and requests write to jouletteflex@gmail.com or use the contact form with the topic “Privacy and data request”.

2. Data we process

Data	Purpose	Legal basis
Account: name, email address, password (stored only as a hash), two-factor secret (encrypted), team memberships and roles, settings	Providing your account and the Service	Contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
Etsy shop data: shop and listing details, listing statistics, orders aggregated per listing and day (no buyer names or addresses are stored), Etsy access tokens (encrypted)	Analyses, reports and the features you use	Contract
Content you create: keywords, competitors you add, drafts, approved suggestions, experiments, imported files, reports	Providing the Service	Contract
Billing: plan, invoices and payment status (no card details: the payment provider processes payments)	Billing and legal accounting duties	Contract; legal obligation (Art. 6(1)(c); KVKK Art. 5(2)(ç))
Security and usage records: sign-ins, important actions (audit log), IP address and browser in that log, failed sign-ins and blocked requests (IP addresses masked)	Protecting accounts and the Service, investigating misuse	Legitimate interests in security (Art. 6(1)(f); KVKK Art. 5(2)(f))
Support messages: name, email address, message	Answering your request	Contract or legitimate interests

We do not sell personal data, do not use it for advertising and do not use advertising or analytics trackers.

3. AI processing

When you use the AI SEO Writer, the listing data needed for the suggestion (title, tags, description, attributes and similar listing facts) is sent to our AI provider. Your name, email address and account details are not sent. Under the provider’s commercial terms, data sent through its API is not used to train its models. AI output is never published to Etsy without your approval.

4. Recipients (processors)

• Hosting: our hosting provider, which stores the Service’s data and backups.
• Etsy, Inc. (USA): we exchange data with Etsy through its API when you connect a shop. Etsy is an independent controller for data on its platform.
• Anthropic PBC (USA): AI provider for the AI SEO Writer (listing data only, see section 3).
• Paddle: payment provider and seller of record for paid plans; it processes payment and billing data under its own privacy policy.
• Email delivery: our email delivery provider, for account and notification emails.

Some recipients are outside the EU/EEA, the UK or Türkiye. Where no adequacy decision applies, transfers rely on standard contractual clauses or other safeguards provided by law; you can ask us for a copy.

5. How long we keep data

Data	Retention
Account and shop data	While your account exists. When you delete your account, it is deleted after a 30-day grace period in which you can cancel the deletion.
Etsy access tokens	Removed immediately when you disconnect a shop
Generated reports and exports	30 days and 7 days
Uploaded import files	Deleted after the import, at the latest after 24 hours
Invoices and billing records	As long as tax and commercial law requires (typically 10 years)
Audit log entries	Kept for accountability; IP address and browser are removed after 12 months, and your name and email address are removed when your account is deleted
Application and security logs	14 days (security log 90 days); personal data in logs is masked
Support messages	24 months after the request is resolved
Backups	Up to 12 months, encrypted; deleted data disappears from backups when they expire

6. Security

Data is transmitted over HTTPS only. Etsy tokens, two-factor secrets and sessions are encrypted; every customer’s data is separated in the application; administrative access requires two-factor authentication; access to personal data by our staff is logged. No method of transmission or storage is completely secure, but we work to protect your data and will inform you and the authorities of a breach as the law requires.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. Under KVKK Art. 11 you also have the right to learn whether your data is processed and to whom it was transferred. Many of these rights you can exercise yourself in Settings: download your data (machine-readable JSON) or delete your account. For other requests contact us (section 1); we answer within 30 days.

You can lodge a complaint with a supervisory authority, in particular in the EU/EEA country where you live, with the UK Information Commissioner’s Office, or with the Turkish Personal Data Protection Authority (KVKK).

8. Cookies

We use only cookies that are necessary for the Service to work. See the Cookie Policy.

9. Children

The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data.

10. Changes

We will update this policy when our processing changes and inform you of material changes by email or in the Service.