Privacy Notice

1. Controller

Searchestra is operated by Searchestra Yazılım ve Bilişim Teknolojileri Anonim Şirketi ("Searchestra", "we"). We are the controller of the personal data described in this notice, except where section 7 says that we act as a processor for our customers.

Searchestra Yazılım ve Bilişim Teknolojileri Anonim Şirketi
Fulya, Yeşilçimen Sokağı, Bağımsız Bölüm 12/430
34394 Şişli, İstanbul, Türkiye

2. Scope

This notice covers searchestra.com, the Searchestra panel, the documentation and blog sites, the API and the MCP server. It serves as the information notice required by Article 10 of the Turkish Personal Data Protection Law (KVKK) and by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

Searchestra is a business product. It measures how AI platforms describe brands and categories. It is not designed to collect information about private individuals.

3. Data subjects

• Account holders: people who use Searchestra as a member of a customer organization.
• Invitees: people a customer has invited who have not created an account yet.
• People who contact us: people who request a report or a demo, ask for security documents, send a privacy request or report a vulnerability.
• Customer contacts: the legal and security contacts a customer registers for notifications.
• Viewers of shared links: people who open a report or presentation a customer shared with them.
• People in customer content: visitors of a customer's website whose visit records the customer sends us, and people named in public content, such as authors and brand representatives. We process this data for the customer (section 7).

4. Data categories

• Identity and contact: name, email address, and a phone number if you give one for marketing messages.
• Account and sign-in: hashed password, multi-factor and passkey records, single sign-on identifiers, sessions and recognised devices.
• Organization: the organization you belong to, your role and your permissions.
• Subscription and payment: plan, invoices and payment status. Card details are entered with our payment provider; we do not store them.
• Security and audit: sign-in history, security events and audit log entries, including IP address and browser type.
• Consent and legal records: which version of the Terms you accepted, which notices you were shown, your marketing consent and its withdrawal.
• Requests and feedback: what you write in a form, a privacy request, a vulnerability report or product feedback.
• Customer content: the brands, markets, competitors and prompts a customer sets up, the AI answers we collect for them, the content and reports produced, the knowledge sources and connected accounts, and website visit records a customer sends for AI crawler analysis.

We do not ask for special categories of personal data, such as health data, biometric data or data about beliefs. Please do not enter them in Searchestra unless your organization has an expressly approved arrangement with us.

5. Processing purposes

• To create and run accounts, sign-in, organization membership and access through the API.
• To provide the service: collecting AI answers for a customer's prompts, analysing them, generating content and agent work, auditing the customer's website and producing reports.
• To manage subscriptions, take payments and keep invoices.
• To keep the service secure: detecting abuse and account compromise, keeping the audit trail, handling security incidents and vulnerability reports.
• To answer the requests people send us from our website and to share security documents with prospective customers.
• To send marketing emails to people who agreed to receive them.
• To meet our legal duties: answering privacy requests, publishing our list of providers, notifying customers and authorities about incidents, deleting data when its retention period ends and keeping evidence of it.
• To keep backups and restore the service after an incident.
• To run beta programmes and collect product feedback.

We do not sell personal data.

6. Legal bases

We rely on the following bases under Article 6 of the GDPR and Article 5 of the KVKK:

• Performance of a contract: accounts and access, the service itself, subscriptions and payments, the security controls a customer configures, and the record of which Terms you accepted.
• Legitimate interests: security monitoring and the audit trail, sending invitations a customer addresses to you, answering report and demo requests, sharing security documents, handling vulnerability reports, access reviews, backups, beta programmes and product feedback. You can object to this processing (section 15).
• Legal obligation: invoices and payment records, answering privacy requests, incident records and notifications, the published list of providers, records of marketing consent, and deleting data on time.
• Consent: marketing emails. Consent is optional and can be withdrawn at any time (section 17).

7. Controller and processor activities

As a controller, we decide why and how we process the data about accounts, subscriptions, security, requests sent to us and marketing. This notice describes that processing.

As a processor, we process customer content on the customer's instructions and under our data processing agreement with that customer. This includes the customer's measurement setup, collected AI answers and their analysis, generated content and agent work, website audits and visit records, reports, shared links, exports and the backups of that content. For this data the customer is the controller. If your data is part of a customer's content, please send your request to that customer; if you send it to us, we pass it on.

8. Sources

• From you: what you enter when you sign up, use the product or write to us.
• From your organization: an administrator who invites you, or your company's identity provider when it creates your account through single sign-on or SCIM.
• From accounts you connect: the data an integration needs from a connected account, such as Google Search Console or a WordPress site.
• From public sources, for customers: the public pages of a customer's website, the answers AI platforms give to the customer's prompts, and search results.
• From our payment provider: whether a payment succeeded and the invoice details.

9. Recipients and processors

We share personal data only with the recipients below, and only as far as each of them needs it:

• Providers that process data for us: hosting and storage, email delivery, AI providers, search data providers and, where a customer uses them, connected services and customer-managed encryption keys. The current list, with the country and the role of each provider, is on our Sub-processors page.
• Our payment provider, which sells the subscription as merchant of record and is a controller in its own right for the payment data it handles.
• Your organization: its administrators can see members, roles and the audit log of the organization.
• People a customer shares a link with: they see the report or presentation that was shared.
• Authorities, where the law requires it, for example a data protection authority in the case of a data breach.

10. AI providers

Searchestra uses third-party AI providers in two ways:

• Collecting answers. We send a customer's prompts to AI platforms and search engines and store what they answer. These prompts are questions about a category or a brand.
• Analysis and generation. We send collected answers, the public content of a customer's website and the brand information a customer enters to language models, to score and summarise them and to generate content and agent work.

The providers, and the country where each one processes data, are listed on our Sub-processors page. Searchestra does not use customer content to train AI models. Output produced by AI is marked as such in the product.

11. International transfers

Our application, database and file storage run in Germany. Some providers process data in other countries, including the United States and China. For people in Türkiye, storage in Germany is itself a transfer abroad under Article 9 of the KVKK.

The Sub-processors page shows, for each provider, the country and the legal mechanism the transfer relies on. Where we are still verifying a mechanism, the page says so instead of naming one.

12. Retention

• Account data: while your account exists. When you ask us to delete your account, it is locked at once and deleted after a 14-day waiting period.
• Customer content: while the organization exists. When an owner closes the organization, its content is deleted after a 30-day waiting period.
• Security and audit records: for a fixed period set per record type, after which they are deleted automatically.
• Invoices and payment records, consent records and evidence of accepted Terms: for the period the law requires.
• Requests sent from our website: for a fixed period after the request is handled.
• Backups: Deleted data may remain in encrypted backups for up to 45 days.

Every category of data we store has a documented retention period, and time-based deletion runs automatically. Ask us for the period that applies to a specific category.

13. Security

We protect personal data with technical and organisational measures, including encryption in transit, hashed passwords, multi-factor authentication, separation between organizations and a tamper-evident audit log. The controls we run today, and the evidence behind them, are listed in our Trust Center.

14. Automated and AI processing

Searchestra uses AI to score, summarise and generate content about brands and categories for its customers. We do not make decisions about individuals that have legal or similarly significant effects based solely on automated processing.

15. Your rights

Under the GDPR and Article 11 of the KVKK you have the right to:

• learn whether we process your personal data and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted, or its processing restricted;
• object to processing that is based on our legitimate interests;
• receive the data you gave us in a machine-readable format;
• withdraw a consent you have given, without affecting earlier processing;
• learn which third parties your data was transferred to, in Türkiye or abroad;
• object to a result that arises against you solely through automated analysis, and claim compensation for damage caused by unlawful processing.

You can also lodge a complaint with a data protection authority: in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); in the EU, the authority of the country where you live or work.

16. How to make a request

• In the product: account holders can download their data or ask for their account to be deleted under Settings.
• By form: anyone can use our privacy request form.
• By email or post: write to the address in section 21.

We may ask you to confirm your identity before we act. We answer within 30 days. Requests are free of charge; if answering causes an additional cost, we may charge the fee set by the Personal Data Protection Board.

17. Marketing

We send marketing emails only to people who agreed to receive them. Consent is asked separately from the Terms, is never pre-selected, and is not a condition for using Searchestra. You can withdraw it at any time with the link in every email or, if you have an account, in your settings. We record each consent and withdrawal and, where Turkish law requires it, register it with the Message Management System (İYS).

Messages about your account, security or the service itself are not marketing and are sent regardless of this choice.

18. Cookies and local storage

We use only the cookies and local storage needed to keep you signed in, protect your session and remember choices you make, such as your theme. We do not use analytics or advertising trackers, and our pages do not load resources from third-party servers. The full list is in our Cookie and Similar Technologies Notice.

19. Children

Searchestra is a product for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

20. Changes

Each version of this notice is numbered and dated. When we make a change that matters to you, account holders are told in the product before or when it takes effect. Earlier versions are available on request.

21. Contact

Searchestra Yazılım ve Bilişim Teknolojileri Anonim Şirketi
Fulya, Yeşilçimen Sokağı, Bağımsız Bölüm 12/430
34394 Şişli, İstanbul, Türkiye

Questions about this notice: team@searchestra.com. To exercise your rights, use the privacy request form.

Last updated: 1 October 2026.