Privacy Policy

Effective 8 August 2026

1. Who is responsible for your data

Frezpo is operated by Özer Yılmaztekin, a sole proprietorship (şahıs şirketi) registered in Türkiye.

We do not publish a street address. All privacy questions, data-subject requests and KVKK applications are handled at [email protected], which is monitored.

This policy covers both frezpo.com (our public site) and app.frezpo.com (the product).

2. What we collect

Account identity. Your email address and authentication credentials, held in Supabase Auth. If you sign in with a third-party provider, we receive the email address and basic profile that provider releases.

Campaign briefs and their outputs. Everything you type into a brief — product descriptions, audience definitions, positioning, tone notes — plus the strategy packs, copy specifications, design tokens and revision feedback the pipeline produces from it. This is the substance of the service, and it is the data we treat most carefully.

Run state. Pipeline checkpoints, thread identifiers and node outputs, stored so a run can be paused, resumed, revised and re-downloaded rather than restarted.

Subscription and usage data. Your plan, trial state, run counts against quota, and the billing status Polar reports back to us.

Technical data. IP address, browser and device type, request timestamps and error traces, collected automatically to keep the service running and to investigate abuse.

Analytics. On frezpo.com only, and only if you consent: aggregate page views and navigation events via Google Analytics. See our Cookie Policy.

Payment details are not collected by us. Polar acts as merchant of record and handles checkout. Your card number never reaches Frezpo's systems, and we cannot see it.

3. Why we process it, and on what legal basis

Under KVKK these map to Article 5 — contract necessity, legal obligation, legitimate interest, and explicit consent for analytics.

4. Who processes data on our behalf

Frezpo is built on third-party infrastructure. Every provider below is a processor acting on our instructions, and all of them operate outside Türkiye.

We do not sell your data, and we do not share it with advertisers or data brokers.

5. Sending your brief to AI providers

Generating a strategy pack means transmitting your brief to the model providers listed above. Two limits on that, stated precisely rather than reassuringly:

We do not use your briefs or outputs to train models, and we do not licence them to anyone for that purpose. Where a provider offers non-training and zero-retention terms for API traffic, we rely on those terms. We cannot make promises on a provider's behalf beyond what their API terms commit to, so we do not claim your data is never retained by anyone — only that we neither train on it nor permit training on it.

If your brief contains information you would not send to a third-party AI service, do not put it in a brief.

6. International transfers

All processors above are located outside Türkiye, so operating the service necessarily transfers personal data abroad. Transfers rely on the conditions in KVKK Article 9 — including your explicit consent where required — and, for personal data covered by the GDPR, on the European Commission's Standard Contractual Clauses or an adequacy decision.

7. How long we keep it

Deleting your account removes your briefs and generated packs on the schedule above. Statutory accounting records survive account deletion because we are not permitted to erase them.

8. Your rights

Under KVKK Article 11 you may ask whether we process your personal data, request information about that processing, learn its purpose, know which third parties receive it, have inaccurate data corrected, request erasure, object to a decision produced solely by automated analysis, and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you additionally have rights of access, rectification, erasure, restriction, portability and objection under Articles 15 to 22, and the right to complain to your supervisory authority. Residents of California and other US states with comparable laws may request access and deletion and may opt out of sale — we do not sell personal data.

To exercise any of these, write to [email protected]. We respond within 30 days. You can also export your generated packs from the app at any time without contacting us.

9. Security

Data is transmitted over TLS and stored in access-controlled managed databases. Our production API accepts no public traffic at all: it is reachable only through an authenticated private tunnel from our own front end. Access to production data is limited to the operator.

No system is perfectly secure. If a breach affects your personal data we will notify you and the Turkish Data Protection Authority (KVKK Kurumu) as the law requires.

10. Children

Frezpo is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.

11. Changes

We may update this policy as the service changes. The effective date at the top always reflects the current version, and we will notify account holders by email before a material change takes effect.

12. Contact

Questions, requests, or complaints: [email protected].