Privacy Policy

1. Data Controller

This Privacy Policy explains how we collect, use, and protect your personal data.

2. Data We Collect

We collect the following categories of data:

• Account info: Email, name, profile picture (for Google sign-in), password hash.
• Credit and payment data: Credit balance and activity. For online payments, card details are not stored by us; the payment provider processes them.
• Usage data: Analysis history, credit transactions, IP address (for rate limiting), session cookie.
• Analysis outputs: Copies of the tweets/profiles you analyze and the LLM outputs are stored on our server.

3. Purpose of Use

We use data only for the following purposes:

• Providing the service
• Billing and credit tracking
• Abuse detection, security
• Legal obligations

4. Third-Party Services

We share data with the following third parties:

• Microsoft Azure — Server hosting the application and data (USA).
• Cloudflare — Network security and page delivery; your IP address is processed for this purpose.
• Google — Optional sign-in with Google. Only email, name and profile picture are received.
• Google Gemini / Anthropic Claude — When you choose a cloud model, the analysed reply and post texts are sent to that provider. With the local model, texts do not leave our server.
• Mailjet — Forwarding new sign-ups and feedback to our team by email (your email address and message).
• Payment provider — When online credit purchases are available, payments are taken through the besimtech.com checkout and our contracted payment provider; card details are not stored by us.

5. Retention

Account data is kept while your account is open. When you delete your account in Settings, your data is deleted immediately; copies in backups disappear within 30 days at the latest (except records we must keep by law). Analysis outputs produced from public content are tied to the analysed post/account, not to you.

6. Your Rights

Under GDPR and KVKK you have the following rights:

• Access your data
• Request rectification
• Right to deletion
• Data portability
• Object to processing

7. Cookies

We use only a session cookie (login state) and a language preference cookie. No advertising or analytics tracking cookies.

8. Security

Passwords are hashed with PBKDF2-SHA256. All traffic uses HTTPS. Database access is restricted to the production server.

9. Minors

The service is not intended for users under 18. If we discover data from a user under 18, the account is deleted immediately.

10. Changes

We may update this policy. Material changes will be notified by email.