Privacy Policy

1. Data controller

The data controller is CLİCKSEM BİL.HİZ.İNTÜZEPAZ.VE TİC.LTD.ŞTİ. (ClickSEM Ltd.; brand name: Clicksem), a company established in Türkiye. Address: Bağlarbaşı Mah. Sakarya Sk. No:35 İç Kapı No:42, 34844 Maltepe/İstanbul, Türkiye. Contact person: Özden Özbey. Email: clicksem.net@gmail.com

Controller and processor roles

Clicksem is the controller for account data, website and contact-form data, and session and security logs.

Agencies and restaurants can bring data into the Service: Square or Toast records, the costs and expenses they enter, and the data of the Google Ads accounts they connect. Clicksem processes any personal data in this data on behalf of, and under the instructions of, that agency or restaurant. The agency or restaurant is the controller of that data, and Clicksem is its processor (KVKK: veri işleyen; US state laws: service provider). If you are a customer or employee of a restaurant and want to exercise your rights over this data, please contact the restaurant or agency. If you contact us, we will forward your request and help them answer it.

Whatever our role, we always handle Google user data as described in section 3 and in line with the Google API Services User Data Policy.

2. About the Service

Clicksem Analytics is a multi-tenant reporting platform for agencies. It combines restaurants' Square or Toast sales data, product costs, expenses and Google Ads spend to show net profit.

3. Google user data

When you connect a Google Ads account to Clicksem Analytics, you sign in with Google and grant access through Google OAuth (scope: https://www.googleapis.com/auth/adwords). We then access the following data through the Google Ads API.

Data we access

• Google Ads account and customer IDs, account name, currency and time zone
• Campaign, ad group and keyword names
• Performance metrics: impressions, clicks, cost and conversions
• Manager account (MCC) hierarchy

Read-only access

Google's adwords scope technically includes write permission. Clicksem does not use it. Our access is read-only: we do not create accounts, and we do not create, change or delete campaigns, budgets, bids, ads or keywords.

How we use it

We use Google user data only to provide and improve the reporting features you see in Clicksem Analytics. These features show you (the agency and the restaurant it has authorized) reports that combine advertising spend with sales and profitability. The same rule applies to any data we aggregate, anonymize or derive from Google user data.

How we store and protect it

• Google Ads data and OAuth tokens are stored in our database on servers of our hosting provider, Hostinger, in France (EU).
• OAuth refresh tokens are stored encrypted. All data in transit is protected with TLS (HTTPS).
• Only users authorized by an agency can see that agency's data. Staff access is role-based and recorded in an audit log.

How we share it

We do not transfer Google user data to third parties. Our hosting provider, Hostinger, stores it only on our behalf and does not use it for its own purposes. We transfer Google user data only where the Google API Services User Data Policy allows it: to provide features you see in the app, with your consent; for security purposes, such as investigating abuse; to comply with applicable law; or as part of a merger, acquisition or sale of assets, and only after obtaining your explicit prior consent.

Retention and deletion

• We keep Google Ads data only while the connection is active and only as long as needed to show your reports.
• When you remove the Google Ads connection in Clicksem Analytics, we delete the stored OAuth tokens immediately and stop accessing your account. The stored Google Ads data is deleted or anonymized within 90 days at the latest.
• If you revoke access at https://myaccount.google.com/permissions, we can no longer access your account. We delete the token as soon as we detect that it is no longer valid. The stored data is deleted within 90 days at the latest.
• If you ask us to delete your data, we do so within 30 days at the latest.

Limited Use disclosure

Clicksem's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we do not do

• We do not sell Google user data or transfer it to advertising platforms, data brokers or information resellers.
• We do not use it to serve ads, including retargeting and personalized or interest-based advertising.
• We do not use it to determine creditworthiness or for lending purposes.
• We do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

Human access

No one reads your Google user data unless: you have first given your affirmative agreement for specific data (for example, in a support request); it is necessary for security purposes, such as investigating a bug or abuse; it is necessary to comply with applicable law; or the data is aggregated and used for internal operations in line with applicable privacy law. Our employees, agents and contractors are required to follow these rules.

4. Other data we process

Besides Google user data, we process the following data. The source of each item is shown in square brackets.

• Account data: name, email address, password hash (we never store the password itself), two-factor authentication settings, your role and the agency or restaurant you belong to. [From you, or from the agency that invites you.]
• Square and Toast data: sales, payment and product data from the accounts you connect. [From Square or Toast, through the connection you authorize.] These records are mainly business data. If they contain personal data about a restaurant's customers or staff, we process it only as a processor for the restaurant or agency (see section 1).
• Data you enter: product costs and expenses. [From you.]
• Session and security logs: IP address, browser information and audit log. [Collected automatically when you use the Service.]
• Contact form and WhatsApp: the name, contact details and message you send through clicksem.net, and your messages if you contact us on WhatsApp. The form runs on FormWhats (formwhats.app), Clicksem's own form and ad-attribution tool. [From you.]
• Website visit data: on clicksem.net, our FormWhats script records which ad campaign and search term brought you to the site and which pages you view, using a visitor identifier that changes daily. [Collected automatically.]
• Exchange rates: Central Bank of the Republic of Türkiye (TCMB) rates. This is not personal data.

We collect data electronically: through forms on our website and in the app, through API connections you authorize (Google, Square, Toast), and through server logs and the scripts described in section 12.

We do not ask for special categories of personal data (such as health or biometric data). Please do not enter such data in the Service.

You must provide account data to create an account and use the Service. Without it, we cannot provide the Service. Connecting Google Ads, Square or Toast is optional, but the reports that rely on that data will not work without the connection.

5. Purposes and legal bases

• Creating and managing your account and providing the Service and its reports (including Google, Square and Toast data): performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)). Where we process data as a processor for an agency or restaurant, that controller determines the legal basis.
• Security, abuse prevention and audit logs: our legitimate interest in keeping the Service and accounts secure (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)) and, where applicable, legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
• Answering contact-form and WhatsApp messages: steps taken at your request before entering into a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)) and our legitimate interest in answering business enquiries (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• Measuring which ads bring visitors to clicksem.net (FormWhats): our legitimate interest in measuring our advertising (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• Billing, accounting and tax records (if the Service is paid): legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
• Service notices (security alerts, policy changes): performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• Establishing, exercising or defending legal claims: KVKK Art. 5(2)(e); GDPR Art. 6(1)(f).

Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it. You can object to processing based on legitimate interest.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. Who we share data with

• Hostinger (hosting, France/EU): stores all data of the Service, our website and our FormWhats tool on our behalf.
• Google (Google Fonts): when you open clicksem.net, your browser loads fonts from Google's servers, and Google receives your IP address and browser information.
• WhatsApp (Meta): only if you choose to contact us on WhatsApp. WhatsApp's own privacy policy then applies.
• Google, Square and Toast: we send only what is needed to authenticate and request data from the accounts you connect (API requests with access tokens).
• Users of your agency and the restaurants it authorizes: inside the app, as the agency configures.
• Authorities and courts: when the law requires it.
• A buyer or successor in a merger, acquisition or sale of assets: under the same protections. Google user data is transferred only with your explicit prior consent.

FormWhats is Clicksem's own tool, so data that goes to FormWhats is not disclosed to a third party. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

7. International transfers

Clicksem is established in Türkiye. Data of the Service, our website and our FormWhats tool is hosted by Hostinger on servers in France (EU). Personal data collected in Türkiye is therefore transferred abroad, to France. Google (Google Fonts) and WhatsApp (Meta) may also process data in other countries, including the United States.

• Transfers from Türkiye: We transfer personal data abroad only in line with Article 9 of KVKK. Unless the Personal Data Protection Board has issued an adequacy decision for France, we make the transfer to Hostinger under the standard contract published by the Board. We notify the contract to the Personal Data Protection Authority within five business days of signing. For occasional transfers, we rely on the exceptions in Article 9(6).
• Users in the EU and UK: Your data is hosted inside the EU, in France. When data is transferred to a country without an adequacy decision, for example when our team in Türkiye accesses it, we use the European Commission's Standard Contractual Clauses or the UK IDTA or Addendum, to the extent GDPR requires.

You can ask for a copy of these safeguards at clicksem.net@gmail.com.

8. Retention and security

Retention

• When you remove a connection or close your account: the related data (account data, Google Ads, Square and Toast data, and the costs and expenses you entered) is deleted or anonymized within 90 days at the latest.
• When you ask us to delete data: we do so within 30 days at the latest.
• Google OAuth tokens: deleted immediately when you remove the connection. If you revoke access in your Google account, the token is deleted as soon as we detect that it is no longer valid.
• Session and security logs: 1 year.
• Contact-form and WhatsApp messages: 2 years after our last contact. If you become a customer, the account-data period applies.
• Backups: deleted data may remain in backups for up to 90 days. After that, the backups are overwritten.
• Legal retention: Records that the law requires us to keep are kept for the required periods. For example, invoices and tax records are kept for 5 years under Article 253 of the Turkish Tax Procedure Law, and commercial books and documents for 10 years under Article 82 of the Turkish Commercial Code. After that, these records are deleted, destroyed or anonymized.

Security

• OAuth refresh tokens are stored encrypted.
• All data in transit is protected with TLS (HTTPS).
• Passwords are stored only as hashes. Two-factor authentication is available.
• Each agency's data is kept separate and is accessible only to its authorized users. Access is role-based, and significant actions are written to an audit log.

If a personal data breach occurs, we notify the Personal Data Protection Board, the competent supervisory authority and affected people as the law requires (KVKK Art. 12(5); GDPR Arts. 33–34). Where we act as a processor, we inform the agency or restaurant without undue delay.

9. Your rights and how to exercise them

Managing connections

• You can remove a Google Ads, Square or Toast connection at any time from within Clicksem Analytics.
• You can also revoke Google access at https://myaccount.google.com/permissions.
• Send requests to access, correct, delete or export your data to clicksem.net@gmail.com.

Türkiye (KVKK)

Under Article 11 of Law No. 6698, you have the right to:

• learn whether your personal data is processed,
• request information about the processing if it is,
• learn the purpose of processing and whether the data is used for that purpose,
• know the third parties in Türkiye or abroad to whom your data is transferred,
• ask for incomplete or inaccurate data to be corrected,
• ask for your data to be deleted or destroyed under the conditions in Article 7,
• ask for corrections, deletions or destruction to be notified to third parties who received the data,
• object to a result against you that arises from analysis carried out solely by automated systems,
• claim compensation if you suffer damage from unlawful processing.

How to apply: You can send your request in writing with a wet signature to Bağlarbaşı Mah. Sakarya Sk. No:35 İç Kapı No:42, 34844 Maltepe/İstanbul, Türkiye; with a secure electronic or mobile signature; or by email from the address registered in our system to clicksem.net@gmail.com. Your request must include: your name and surname; your signature if the request is in writing; your Turkish ID number, or for foreign nationals your nationality and passport or ID number; your address for notices; your email address and phone number, if any; and the subject of your request.

We answer free of charge within 30 days at the latest. If the request involves an additional cost, we may charge the fee set by the Board. If we reject your request, if you find our answer insufficient, or if we do not answer in time, you may complain to the Personal Data Protection Board. You must do so within 30 days of learning our answer, and in any case within 60 days of your request.

EU and UK (GDPR / UK GDPR)

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection. In particular, you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw your consent at any time. We answer requests within one month. You can lodge a complaint with the data protection authority in the country where you live or work, or where the alleged infringement took place.

United States

Your rights under US state laws are explained in section 10.

10. US state privacy notice

This section applies to residents of California and other US states with comprehensive privacy laws, to the extent those laws apply to Clicksem. It is our notice at collection.

Categories of personal information collected in the last 12 months

• Identifiers (name, email, IP address, account ID). Sources: you, your agency, automatic collection. Purposes: providing the Service, security, communication. Disclosed to: hosting provider.
• Commercial information (sales, payment and product records from Square and Toast; costs and expenses you enter). Sources: Square and Toast through your connection; you. Purpose: reports. Disclosed to: hosting provider.
• Internet or other electronic network activity (session and security logs, website visit data). Source: automatic collection. Purposes: security, ad measurement. Disclosed to: hosting provider, Google Fonts.
• Professional information (your role and your agency or restaurant). Sources: you, your agency. Purpose: providing the Service. Disclosed to: hosting provider.
• Sensitive personal information: account login (email and a password stored as a hash). Used only to provide and secure the Service, not to infer characteristics about you.

Retention periods for each category are in section 8. In the last 12 months we have not sold personal information or shared it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16.

Your rights

Depending on the law that applies to you, you may have the right to: know and access the personal information we have collected about you, including specific pieces; delete it; correct it; get a portable copy; opt out of sale, sharing, targeted advertising and profiling (we do none of these); and limit the use of sensitive personal information (we use it only for permitted purposes).

How to submit a request and how we verify it

Email clicksem.net@gmail.com. We verify your identity by matching the request to the email address on your account and, if needed, by asking for more information. An authorized agent may submit a request for you. In that case we ask for your signed permission and may verify your identity directly with you. We respond within 45 days (deletion requests follow the 30-day period in section 8). If needed, we may extend this by another 45 days and will tell you if we do.

Appeals

If we deny your request, you can appeal by replying to our answer with the subject "Appeal". We will respond within the period your state's law requires. If we deny your appeal, you can contact your state Attorney General.

Non-discrimination

We will not discriminate against you for exercising your rights.

Restaurant customers' data

For consumer data in restaurants' POS records, we act as the restaurant's service provider. Please send requests about this data to the restaurant.

11. Children

The Service is for businesses and is not directed to children. Users must be at least 18 years old. We do not knowingly collect personal data of children under 16 (or under 13 under the US COPPA). If you believe we have collected such data, please contact us and we will delete it.

12. Cookies and similar technologies

• Clicksem Analytics: uses only strictly necessary session and CSRF security cookies. It does not use third-party analytics or advertising cookies.
• clicksem.net theme and language: your chosen theme and language are saved in your browser's local storage (localStorage), only on your device.
• Our FormWhats script (clicksem.net): measures which ad your visit came from and which pages you view. It does not use cookies and creates a visitor identifier that changes daily.
• Google Fonts (clicksem.net): fonts are loaded from Google's servers, and Google receives your IP address and browser information.

13. Changes

We may update this policy. The current version is always published on this page with its effective date. We will notify registered users of significant changes by email before they take effect. If we want to use Google user data in a way that this policy does not describe, we will first update this policy and ask for your consent before using the data in the new way.

14. Contact

CLİCKSEM BİL.HİZ.İNTÜZEPAZ.VE TİC.LTD.ŞTİ. (ClickSEM Ltd.) · Bağlarbaşı Mah. Sakarya Sk. No:35 İç Kapı No:42, 34844 Maltepe/İstanbul, Türkiye · clicksem.net@gmail.com