At Localghost, we process your personal data in accordance with the Personal Data Protection Law No. 6698 (KVKK) and the relevant secondary legislation. This document explains which data we process and for what purpose when you use the platform, our legal grounds, and your rights.
1. Data Controller
Within the scope of this document, the data controller is Localghost. You may submit your requests regarding data processing activities through our support email address.
2. Personal Data Processed
Depending on the nature of the service, the following categories of data may be processed:
- Identity and contact information (full name, email, phone)
- Account and subscription information (plan, billing, payment status)
- Transaction security data (IP, session records, device information)
- Support requests, content generation data, and usage logs
3. Purposes of Data Processing and Legal Grounds
Your data is processed for the following purposes:
- Account creation, authentication, and provision of the platform
- Carrying out subscription, payment, billing, and collection processes
- Error detection, security, auditing, and prevention of misuse
- Fulfilling obligations arising from legislation
Processing activities are based on the legal grounds of the establishment/performance of a contract, the fulfillment of a legal obligation, legitimate interest, and, where necessary, explicit consent (KVKK (Turkish Data Protection Law) Article 5).
4. Transfer of Data
To the extent necessary for the provision of the service, your data may be shared with hosting infrastructure, payment institutions, email/communication services, and public authorities authorized by law.
5. Retention Period
Your personal data is retained for the period required by the purpose of processing and for the retention periods stipulated in the relevant legislation; at the end of this period it is deleted, destroyed, or anonymized. Typical retention periods:
| Data Category | Retention Period |
|---|---|
| Account & profile information | As long as the account is active + anonymization after a deletion request |
| Security records (login, IP) | 90 days |
| Audit records (AuditLog) | 90 days |
| Email delivery records | 60 days |
| Error logs | 30 days |
| Impersonation records (audit) | 365 days (KVKK (Turkish Data Protection Law) Article 7 — legitimate interest) |
| Device fingerprint | 30-90 days (trial fraud prevention) |
| Billing records | Tax Procedure Law (VUK) Article 253 — 10 years |
5.1 List of Data Processors (Sub-Processors)
We share data with the following third-party service providers in order to deliver the service. All providers are subject to their own privacy policies and data processing agreements.
| Provider | Purpose | Location |
|---|---|---|
| Google (Business Profile API) | Business data synchronization | EU/Global |
| Iyzico | Payment and subscription management | Turkey |
| Amazon Web Services (SES) | Email delivery | EU (eu-central-1) |
| Cloudflare | CDN + R2 backup storage | Global |
| FingerprintJS | Trial fraud prevention | EU/US |
Data sent to AI providers: review texts, business name/description. This data is not used for model training; it is processed only for real-time response generation.
6. Data Security
Up-to-date technical and administrative measures are applied to prevent unauthorized access. Nevertheless, we emphasize that the absolute security of transmissions over the internet cannot be guaranteed.
7. Rights of the Data Subject
You may exercise your rights under Article 11 of the KVKK (access, rectification, erasure, objection, etc.) by submitting a duly made request. Applications are concluded within the periods set out in the legislation.
This disclosure text is part of the disclosure obligation fulfilled under KVKK (Turkish Data Protection Law) Article 10.
This is an English translation provided for convenience. In case of any discrepancy, the Turkish version shall prevail.