AllSoon.ai takes your privacy seriously. This policy explains in plain language which personal data we collect, why we use it, on what legal basis, who receives it, how long we keep it and what rights you have. It is intended to provide the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) to the extent the GDPR applies to our processing. Information under Turkish law is available in the KVKK Information Notice (Turkish).
1. Scope and data controller
This policy applies to the website at allsoon.com.tr, the dashboard and the AI-assisted project creation and hosting services. The controller of your personal data is:
- Legal name
- [Company information not yet entered]
- Address
- [Company information not yet entered]
- Registry / tax number
- [Company information not yet entered]
- [Company information not yet entered]
If an EU representative or a data protection contact is listed above, you may also use those details for questions about this policy or to exercise your rights.
2. What data we collect and where it comes from
- Data you provide: username, e-mail address and password at sign-up; your profile preferences; your projects, files and whatever you write to the AI assistant; your message in the contact form; your marketing consent, if you give it.
- Data generated while you use the service: credit transactions and usage records; chat history, memory records and scheduled tasks; backups.
- Data collected automatically: IP address, browser and device information, sign-in and activity times, session and security records, and cookies (see our Cookie Policy).
- Services you connect: if you connect Telegram or WhatsApp, your chat ID or phone number; if you connect a domain, the domain name and DNS records.
We obtain this data from you directly or it is generated through your use of the service. Your password is stored only as an irreversible hash; nobody, including us, can see it in plain text. We do not ask for special categories of personal data (health, religion, biometric data and similar) in order to provide the service.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account, creating and hosting your projects, running the AI assistant, tracking your credits | Art. 6(1)(b): performance of the contract with you |
| Protecting your account and the platform, preventing abuse, fraud and attacks, finding and fixing errors, keeping the service reliable | Art. 6(1)(f): our legitimate interests |
| Complying with legal obligations, answering requests from competent authorities, handling your privacy requests | Art. 6(1)(c): legal obligation |
| Keeping consent and transaction records as evidence in possible disputes | Art. 6(1)(f): our legitimate interest in establishing, exercising or defending legal claims |
| Sending product news and campaigns by e-mail | Art. 6(1)(a): your consent (optional, withdrawable at any time) |
| Sending your prompts and project content to AI providers outside Turkey, where your explicit consent is the mechanism relied on for the transfer | Art. 6(1)(b) for the service itself; Art. 49(1)(a) for the transfer: your explicit consent |
We do not use your data for purposes incompatible with those above and we do not sell it to third parties for marketing.
4. Our legitimate interests
Where we rely on Art. 6(1)(f), our legitimate interests are: keeping the platform, your account and other users secure; detecting and preventing abuse, fraud, unauthorised access and attacks; diagnosing technical problems; and establishing, exercising or defending legal claims. We use only the data needed for these purposes (for example sign-in attempts, session and audit records, IP addresses) and keep it only for the periods shown in the retention table. You may object to processing based on legitimate interests at any time (see "Your rights and how to use them" below); we will then stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed for legal claims.
5. AI assistant and what is sent to AI providers
Whenever you talk to the assistant, the prompts you write, the project content the assistant reads to carry out its task (files, database structure and similar) and the generated replies are sent to an AI provider so that a reply can be produced: DeepSeek. These providers may be located outside Turkey (see the recipients table below).
- The platform administrator decides which provider is used. The providers' own privacy policies and data processing terms also apply; how long submitted content is kept by a provider and whether it is used to improve models depends on those terms.
- Please do not write passwords, secret keys, identity numbers, health data or other sensitive data to the assistant or into your projects.
- AI replies may be wrong or incomplete; check them before relying on them. Replies are shown only to you. This service does not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22).
For this transfer we ask for your separate consent at sign-up (see the Consent notice). You can withdraw it from your profile at any time; if you do, the AI features can no longer be provided.
6. Who receives your data
We share your data only to the extent necessary to provide the service, with the service providers below, and with competent authorities, courts and legal advisers where the law requires or permits it:
| Recipient / service provider | Service and data transferred | Location |
|---|---|---|
| [Company information not yet entered] | Hosting and infrastructure: account data, projects, files, databases and logs are stored on this provider's servers. | [Company information not yet entered] |
| 127.0.0.1 | E-mail delivery: your e-mail address, username and message content (verification, password reset, notifications). | — |
| DeepSeek | AI processing: the prompts you write to the assistant, the related project content the assistant reads, and the generated replies. | China (outside turkey) |
| Cloudflare | Domain/DNS management, firewall and (if enabled) bot verification: domain, DNS records, IP address and request metadata. | USA (outside turkey) |
| Microlink, thum.io | When the assistant's site preview (screenshot) tool is used, only the related public page address is sent. | Outside Turkey |
Services that you choose to connect yourself (for example Telegram or WhatsApp) are subject to their own terms and privacy policies.
7. Transfers outside Turkey and the EU/EEA
Some of our service providers operate servers outside Turkey: DeepSeek (China), Cloudflare (USA) and Microlink, thum.io. Your personal data, in particular the prompts and project content sent to AI providers, may therefore be transferred to and processed in countries whose level of data protection may differ from that of your country.
Such transfers rely on one of the mechanisms available under Chapter V of the GDPR (and the corresponding rules of Turkish law where applicable): an adequacy decision, appropriate safeguards such as standard contractual clauses, or, for the specific transfer you request, your explicit consent. Details of the mechanism used for a particular recipient, and a copy of the safeguards where applicable, are available on request through the contact details below.
Where consent is the mechanism relied on, you give it separately at sign-up and may withdraw it at any time from your profile. Withdrawal does not affect the lawfulness of processing before withdrawal.
8. Personal data inside your projects
For personal data of third parties that you host or process in your projects (for example information about your own customers), you are the controller and we act as your processor. The legal obligations of a controller (providing notices, having a legal basis, securing the data and so on) are yours. We access and process this data only to provide hosting and backup services. If you need a separate data processing agreement, please contact us.
9. Security measures
- Connections are encrypted with HTTPS; passwords are stored as irreversible hashes and AI provider keys are stored encrypted.
- Two-step verification is mandatory for administrators; you can enable it for your account as well.
- Each project runs under a separate system user; backups are kept outside the web root with restricted permissions.
- Sign-in attempts are rate-limited and important actions are written to an audit log.
No system is completely free of risk. If a personal data breach affects your data, we will notify the competent authority and, where required, you, within the periods set by law.
10. How long we keep your data
We keep personal data only as long as needed for the purposes described above and for the periods required by law. After that it is deleted, destroyed or anonymised.
| Data | Retention period |
|---|---|
| Account data (username, e-mail, language, security settings) | While your account is open. After a deletion request a 7 days waiting period applies; then the data is deleted or anonymised. |
| Projects, files, databases | While your account is open. A deleted project is kept in a recoverable archive for 30 days, then permanently deleted. |
| Backups | The latest 5 backups per project; deleted together with the project. |
| Chat history, memory records, scheduled tasks | While your account is open |
| Session records | 30 days from the last activity; deleted when expired. |
| E-mail verification / reset tokens | Deleted 7 days after use or expiry (only a hash is stored). |
| Contact form messages | 12 months |
| Audit (security) logs | 12 months; IP addresses are truncated after 90 days. |
| Activity logs | 12 months |
| Job records and notifications | Job records 30 days, notifications 90 days |
| Data export (download) files | 24 hours |
| Credit ledger and usage records | Kept after account deletion with personal fields removed (only the internal user number remains) for accounting integrity and possible disputes, for the applicable limitation periods. |
| Consent records | Kept as proof of consent and its withdrawal, with IP/device data removed, for the applicable limitation periods. |
| Your requests | Deleted 36 months after closure. |
11. Your rights and how to use them
Subject to the conditions and exceptions in the law, you have the following rights:
- Access (Art. 15): to obtain confirmation of whether we process your data and a copy of it, together with the information in this policy;
- Rectification (Art. 16): to have inaccurate data corrected and incomplete data completed;
- Erasure (Art. 17): to have your data deleted where one of the legal grounds applies;
- Restriction (Art. 18): to have processing restricted in the cases provided by law;
- Data portability (Art. 20): to receive the data you provided in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means;
- Objection (Art. 21): to object at any time, on grounds relating to your situation, to processing based on legitimate interests, and to object at any time to marketing;
- Withdrawal of consent (Art. 7(3)): to withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal;
- Automated decision-making (Art. 22): this service does not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Self-service tools in your profile:
- Download my data: request all of your data as a ZIP file.
- Delete my account: confirm with your password. During the 7-day waiting period you can cancel using the link in the e-mail we send; when it ends, your projects, databases and files are permanently deleted.
- Marketing opt-out: withdraw your marketing consent at any time.
Other requests: use the request form or write to [Company information not yet entered]. We may need to verify your identity before acting on a request. We will respond free of charge within one month of receiving your request; where necessary, taking into account the complexity and number of requests, this period may be extended by up to two further months, in which case we will tell you within the first month (Art. 12(3)).
12. Right to lodge a complaint
If you believe that we process your personal data in breach of the law, you have the right to lodge a complaint with a supervisory authority (GDPR Art. 77). In Turkey, this is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) and its decision-making body, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, KVKK). If you live or work in the European Union or the European Economic Area, or the alleged infringement took place there, you may complain to the data protection supervisory authority of your country. We would appreciate the chance to address your concern first, so please contact us as well.
13. Is providing data mandatory?
Providing your username, e-mail address and password is necessary to create an account and use the service under our Terms of Service; without it we cannot provide the service. Some data is processed because the law requires it. Marketing consent is optional, and refusing or withdrawing it does not affect your use of the service. Consent to the transfer of your prompts and project content to AI providers outside Turkey is required for the AI features to be provided; without it those features cannot be offered.
14. Children
The service is not intended for anyone under 18. If we find an account that belongs to a person under 18, we will delete the account and its data.
15. Changes to this policy
When we update this policy, we publish the new version and show its version number and effective date at the top of the page. For material changes we ask for your confirmation again the next time you sign in.
16. Contact
For questions about this policy or your data: [Company information not yet entered] or the contact form.