Privacy Policy

1. Data controller

Your personal data is processed by Pumpmedya Yazılım ve Dijital Pazarlama Anonim Şirketi (Konutkent Mahallesi Dumlupınar Bulvarı Sisa Kule No: 381/AK, 06810 Çankaya/Ankara, Türkiye) as data controller, under Turkish Personal Data Protection Law no. 6698 (KVKK). This text is the privacy notice required by article 10 of that law.

For employee, customer and supplier data that companies enter into the service, the company concerned is the data controller and Pumpmedya is its data processor. Please send requests about that data to that company first.

2. Data we process and why

Account data (name, email, phone, company name): to create your account, authenticate you and provide support.

Security data (two-step verification settings, trusted devices, operator screen PIN, bot check result): to protect your account.

Usage records (sign-in time, IP address, audit log, error log): security, abuse prevention, the audit trail and improving the service.

Billing data: to run your subscription and meet statutory record-keeping duties. Card details never reach us; they are handled by the payment provider.

Production data you enter: only to provide the service. We do not access its content except at your request for support, or where legally required.

AI content (questions you write to AI Assistant; part models, drawings and instructions you upload to AI CAM): to produce the answer or the CNC program.

Support and contact records (support tickets, correspondence, contact form): to answer your request.

Acquisition data (at sign-up): which channel brought you to our site (for example a search engine, social media or an ad), campaign tags, the first page you landed on, country and device type. Purpose: to measure which marketing efforts work. The value of ad click identifiers is not stored.

3. How we collect data and legal basis

Data is collected electronically through sign-up and application forms, support and contact forms, email, and automatically by the site (server logs, cookies and browser storage).

We process data on the legal bases in article 5 of the KVKK: entering into and performing the contract, complying with legal obligations, establishing, exercising or defending a right, and legitimate interest.

Google Analytics and persistent acquisition data rely only on your explicit consent. You can withdraw consent at any time from the "Cookie preferences" link.

4. Sharing

Data is shared only as necessary with the providers we use to run the service: Hetzner Online GmbH (Germany; server hosting), Cloudflare, Inc. (USA; network, security, bot checks and cookieless site statistics), Google (USA; email delivery and, if you allow it, Google Analytics), Paddle.com (United Kingdom; payment and invoicing), Anthropic PBC (USA; AI tasks).

Some of these providers are outside Türkiye. Transfers abroad are made with the appropriate safeguards set out in article 9 of the KVKK (standard contracts).

Data may be disclosed to competent public authorities only on request and to the extent required by law.

5. Retention

Data is kept while your account is active and for the retention periods required by law, then deleted, destroyed or anonymised.

Invoice and payment records are kept for 10 years as required by tax and commercial law.

6. Your rights

Under article 11 of the KVKK you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to ask for correction of incomplete or inaccurate data; to ask for deletion or destruction under the conditions of article 7; to ask that corrections and deletions be notified to those third parties; to object to an outcome against you that results solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

Send requests from the email address registered with us to [email protected], or in writing to our postal address above. We answer within 30 days at the latest, free of charge. If you are not satisfied with our answer you may complain to the Turkish Personal Data Protection Board.

7. Cookies

We use strictly necessary cookies and browser storage to keep you signed in and remember your language; these do not depend on your consent.

If you tick "remember this device" during two-step verification, a trust token valid for 30 days is kept in your browser. It stops working when your password changes or your sessions are signed out.

Sign-in and sign-up pages run a Cloudflare Turnstile bot check to prevent abuse.

Visit statistics are cookieless: nothing is written to your device and your IP address is not stored; we use a summary that tells visitors apart for that day only and cannot be linked across days. Raw records are deleted after 30 days; only daily totals are kept. If your browser sends a "do not track" signal (DNT or GPC), you are not counted. We also use Cloudflare Web Analytics, which sets no cookies.

If you allow it, which channel first brought you to our site is kept in the local storage of your browser for one year, so visits on different days can be joined. If you do not, this is kept only in the open page and is not written to your device.

If you allow it, Google Analytics 4 runs on the public pages (home, product, pricing, blog and similar). Google collects statistics such as visit counts, pages and sources with its own cookies; IP addresses are truncated on Google's side, ad personalization and Google signals are off. Inside the application (after sign-in) Google Analytics is never loaded. If you do not allow it, or your browser sends a DNT or GPC signal, no request is sent to Google. Google's privacy terms: https://policies.google.com/privacy

We do not use marketing or advertising tracking cookies.

You can change your choice at any time from the "Cookie preferences" link at the bottom of the page. We ask again after one year.

8. Security

Data travels over encrypted connections (HTTPS). Each company's data is kept separate; access depends on permissions and important actions are logged.