Privacy Policy and KVKK/GDPR Notice

1. Controller

Your personal data is processed by the service provider named at the end of this page as data controller. For people you add to your organization you also carry responsibility as a customer and must inform them.

2. Data we process

To provide the service we process:

• Account: name (optional), email, password hash (the password itself is not stored), language preference, last sign-in time.
• Organization: organization name, members and roles, invitations, audit records.
• Monitored assets: domain and website addresses, tags, notes, ownership details, monitoring results (status, response time), SSL/DNS/technology observations.
• Integrations: Cloudflare tokens (encrypted), GitHub/Azure DevOps connection details and repo metadata, Google Analytics connection and aggregate metrics.
• Billing: subscription state, payment records, card brand and last four digits. Card numbers are not stored by WAM; they are processed by the payment provider.
• Technical: IP address and request logs (for security, abuse prevention and debugging).

3. Purposes and legal bases

Your data is processed to enter into and perform the contract (account, monitoring service, billing), to comply with legal obligations, for our legitimate interests (security, abuse prevention, improving the service) and, where required, with your consent. Your personal data is not sold to third parties or used for advertising profiles.

4. Recipients and service providers

Data is shared only as needed to provide the service, with the following providers; some are located abroad and transfers rely on the safeguards required by KVKK art. 9 and the GDPR:

• Payment provider: PayTR (card payments and recurring charges).
• Infrastructure and hosting providers, and the email delivery provider (transactional emails).
• Cloudflare: bot verification on the sign-up form (Turnstile) and, when you connect it, reading your Cloudflare account.
• Google: only when you connect Google Analytics, with read-only access.
• GitHub / Microsoft (Azure DevOps): only when you connect them, with metadata read permissions.

5. Retention

Data is kept as long as needed for its purpose:

• Detailed monitoring results for a short period (days), hourly summaries for 90 days, daily summaries for 13 months.
• Asset event history for 13 months, audit records for 2 years, notification records for 90 days.
• Account and organization data for the duration of membership; when your subscription ends your data is not deleted and the organization becomes read-only. On request it is deleted, subject to statutory retention duties.

6. Your rights

Under KVKK art. 11 and the GDPR you may learn whether your data is processed, request information, correction, deletion or restriction, object to processing, learn the recipients, request portability and claim compensation for damages. Send requests to the contact address below; they are answered within 30 days. You may also lodge a complaint with the Turkish Personal Data Protection Authority or the competent GDPR supervisory authority.

7. Cookies and similar technologies

WAM uses strictly necessary cookies only: an HttpOnly session cookie for renewing your sign-in, and your language/theme preferences. No advertising or tracking cookies are used. Cloudflare Turnstile bot verification may run on the sign-up form.

8. Security

Your data is isolated per organization, integration secrets are stored encrypted and connections use encrypted channels. See the Security and data page for details. In case of a breach, statutory notification duties are fulfilled.

9. Changes

This notice may be updated from time to time; material changes are announced by email.