Privacy Notice (KVKK)

This notice is provided under Article 10 of the Turkish Personal Data Protection Law (KVKK) and informs you how Guardbee.ai processes your personal data.

Last updated: 8 August 2026

1. Data controller

Guardbee.ai (“we”, “us”) is the data controller. Contact: privacy@guardbee.ai · Location: Türkiye.

2. Categories of personal data

Identity / contact: name, email address
Account: password hash, role, email verification status
Optional profile: company name, website URL, avatar image
Technical: IP address, user agent, session identifiers, cookies
Usage: scan targets, scan results, crawl reports, activity / audit logs
Communications: messages you send via contact or support channels
Consent records: cookie preferences, terms acceptance, and scan authorizations

We do not request national ID numbers (TCKN), biometric data, or payment card data through our standard registration or profile forms.

3. Purposes of processing

Creating and managing your account
Providing website / AI security scanning, traffic discovery crawls, and related recommendations
Sending transactional emails (verification, password reset, scan notices)
Securing the platform (authentication, fraud prevention, audit trails)
Responding to support and KVKK data-subject requests
Improving the product based on aggregated usage patterns
Where you consent: analytics cookies and optional marketing communications

3a. Authorized scanning of targets

We only scan or crawl hosts you submit after you confirm authority. Brand hostnames must match your corporate email domain. Scan/crawl outputs may incidentally include personal data exposed by the target site; we process them to deliver security findings and retain them while your account is active unless you delete them.

4. Legal bases (KVKK Art. 5)

Performance of a contract — account and scan services
Legitimate interest — security, abuse prevention, product improvement
Legal obligation — where applicable
Explicit consent — non-essential cookies, optional marketing

5. Retention

Account data: for the life of the account, then deleted or anonymised within a reasonable period after closure
Scan data: retained while your account is active unless you delete scans
Logs / security records: typically up to 12 months unless a longer period is required for investigations
Consent records: retained for the duration needed to demonstrate compliance

6. Recipients / processors

We may share data with processors that help us operate the service, such as:

Hosting / infrastructure providers
Transactional email providers (e.g. Resend / SMTP)
Database and backup services
Payment providers (PayTR)
Google LLC (USA) — Google Tag Manager / Google Analytics (only if you consent to analytics via the cookie banner); purpose: site usage and performance measurement
Meta Platforms, Inc. (USA) — Meta-related measurement / marketing technologies (only where relevant consent is given); purpose: measurement and optional marketing

We do not sell personal data.

6a. Cross-border transfers (KVKK Art. 9 / GDPR Chapter V where applicable)

Some of the processors above are established outside Türkiye / the EEA (in particular in the USA) or process data in those countries. Such transfers are carried out under KVKK Art. 9 (and GDPR Arts. 44–49 where the GDPR applies). Where applicable:

Standard Contractual Clauses (SCCs) / provider commitments and appropriate technical and organisational measures are used,
Non-essential analytics and marketing tools require your explicit consent (cookie banner / preference centre),
The purpose of the transfer is limited to providing the service, securing the platform, and consented measurement or communications.

Destination country (e.g. USA), recipients (Google, Meta and other processors), purposes and safeguard mechanisms are stated in this section. See also the Cookie Policy for cookie details.