Privacy notice
What personal data we process, why and for how long, who we share it with, and your rights.
01Who this notice is for
This notice covers three groups:
- visitors to auspector.com and app.auspector.com,
- people who request access,
- customers with an account.
A separate notice for businesses listed in our database will be published on its own page.
02Controller
- Controller: RSTECH DANIŞMANLIK A.Ş.. Address and registration details are on the imprint page.
- Contact: [email protected]
03What we process
When you visit the site
Requests pass through Cloudflare’s network and our server. Your IP address, browser details and the requested address are processed in technical logs. Server logs are deleted automatically as they reach a size limit and are kept for at most 12 months.
To stop forms being abused, your IP address is held briefly in server memory: one minute for the access form, 15 minutes for sign-in attempts, one hour for password-reset requests. These counters are never written to the database.
auspector.com sets no cookies. A theme and a language-suggestion preference are stored in your browser only when you choose them — see cookies.
We use Cloudflare Web Analytics on auspector.com for visit statistics. Measurements such as the page you open, the address you came from, your browser and device type, and how long the page took to load go to Cloudflare; we see only aggregate counts. It sets no cookies.
When you request access
We record:
- your email address,
- the language and name of the page you used,
- the dates of your first and latest request,
- the date we replied.
We do not add your IP address to that record.
When you open an account
- Your email address, your language and, if you give it, your name.
- An irreversible hash of your password (argon2id); we never store the password itself.
- For each session: IP address, browser details, when it started and when it was last seen. You can see your open sessions on the account page and close them all with one button. The session is carried by a cookie: HttpOnly, Secure, SameSite=Lax, 30 days.
- For email-verification and password-reset links: a hash of the link, the address it was sent to and the IP address the request came from.
- Your saved searches and watches, and when and with what result their emails were sent.
- The records you open: which record, when, and for how many credits. We need this so the same record is never charged twice.
- Your exports: format, filters, columns and row count.
- Your access rights: which section, their source (trial or subscription) and end date.
Payments
Payments are taken by our reseller Paddle.com, the Merchant of Record for our orders. Paddle processes your card and other payment method details; they are not passed to us. Paddle’s privacy notice applies to the data Paddle processes.
What we receive from Paddle and keep:
- your Paddle customer and subscription IDs, your plan, the subscription status and billing period,
- the ID, amount, date and any refund of each payment,
- the content of payment notifications Paddle sends us, which may include billing details such as your country.
The checkout window loads only when you click to buy a plan. The window belongs to Paddle, and Paddle’s cookie rules apply there.
04Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Running and securing the site | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Replying to your access request | Steps at your request before a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Managing your account and session | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Running your subscription and credits | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Sending the watch emails you set up | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Meeting legal obligations | Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)) |
05Recipients and transfers
- Cloudflare, Inc. (United States): network, content delivery, the encrypted tunnel to our server and visit statistics.
- Resend: email delivery (sending region Tokyo, AWS ap-northeast-1).
- Contabo Inc.: server hosting; the server is in the United States (St. Louis).
- Paddle (Paddle.com Market Limited, United Kingdom, and Paddle’s affiliates): payment, invoicing and tax as Merchant of Record.
Transfers rely on the data protection terms in these providers’ contracts, including the European Commission’s Standard Contractual Clauses. The standard contract and notification process under KVKK Art. 9 is being completed.
06Retention
- Technical logs: at most 12 months (server logs are deleted automatically at a size limit).
- Session records and email links: while your account is open; deleted with the account.
- Access requests: until you ask us to delete them; deleted within 30 days of your request.
- Account data: while your account is open; deleted within 30 days of your request to close it (except the records below that we must keep by law).
- Opening and credit records: for the statutory retention period for commercial records (10 years under the Turkish Commercial Code, Art. 82).
- Subscription and payment records and Paddle notifications: for the statutory retention period for commercial records (10 years under the Turkish Commercial Code, Art. 82).
07Your rights
Depending on where you are, you can ask for access, correction, erasure, restriction or portability of your data, object to processing, and complain to your data protection authority.
Under Türkiye’s KVKK (Art. 11) you can also learn whether and why your data is processed, who it was transferred to at home or abroad, and ask for those recipients to be notified of corrections and deletions.
08How to make a request
You can send your request by:
- Email: [email protected]
- Post: to the address on the imprint page
We answer within 30 days, free of charge.
09Changes
When this notice changes, the current version and its date are published on this page.