Privacy
Privacy notice
This notice explains how we process your personal data when you use Coleoid. It is prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Controller
Coleoid is operated by Eurosis Danışmanlık A.Ş. (Eurosis Consulting), which is the controller for the processing described here.
- Address
- Barbaros Mah. Halk Cad. Palladium Ofis ve Residence Binası No: 8/A Floor 2/3, 34746 Ataşehir / İstanbul, Türkiye
- Telephone
- +90 (216) 687 06 86
- MERSİS no
- 0383043840200016
- Registered email (KEP)
- eurosisdanismanlik@hs04.kep.tr
2. Who this notice covers
- visitors to coleoid.systems,
- people who create an account and are members of an organization,
- people invited to an organization,
- people who use the contact form or email us.
Information organizations enter. An organization enters its own roles, processes and people into Coleoid, such as employees' names, work emails, roles, start dates and People Operations records. For that information the organization (usually your employer) is the controller, and we process it only on its instructions, as processor. Your organization informs you about it. To exercise your rights, contact your organization first. If you write to us, we pass your request to that organization.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (KVKK) |
|---|---|---|
| Account: name, email, a hash of your password (never the password itself), optional profile image | Create and run your account; set up your first organization | Contract (Art. 5(2)(c)) |
| Sessions and security: session record, IP address, browser information (user agent), password reset record; an irreversible hash of IP and email for failed sign-in and reset attempts | Sign you in, protect your account, limit abuse | Contract (Art. 5(2)(c)); our data-security obligation (Art. 5(2)(ç)); legitimate interest (Art. 5(2)(f)) |
| Server logs: request time, requested page, IP address, browser information | Run the service; investigate faults and attacks | Legitimate interest (Art. 5(2)(f)) |
| Organization access: your memberships and access level (Owner, Admin, Editor, Viewer); if invited, your email and the member who invited you | Manage access to the organization; deliver the invitation | Contract for members (Art. 5(2)(c)); legitimate interest for invitees (Art. 5(2)(f)) |
| Contact: name, email, optional organization name, topic and message | Answer you; pre-contract discussions; support | Entering a contract (Art. 5(2)(c)); legitimate interest (Art. 5(2)(f)); legal obligation for rights requests (Art. 5(2)(ç)) |
| Service emails: your name, email and the email content (password reset, password changed, invitation, acknowledgement, a one-time welcome email after sign-up that you can reply to) | Send the notices the account and service need | Contract (Art. 5(2)(c)); legitimate interest for security notices (Art. 5(2)(f)) |
| Anonymous visit counts and speed measurements: page template instead of the full address, clicks on specific buttons, the steps of sign-up, sign-in, sign-out, password reset and the contact form, the referring site's domain, our own campaign tags, device and browser type, country, an approximate location the measurement supplier derives from the IP address (country, region and city; the IP address is then discarded), page speed readings | See in aggregate how much and how fast the site and product are used | Legitimate interest (Art. 5(2)(f)). How to object: section 7 |
| Detailed analytics and masked session recordings: your account ID, organization ID, whether your account belongs to our team, our consultants or a customer (worked out from your email domain; the email itself is not sent), actions in the product, clicks and heatmaps (without text or links), a masked recording of the screen, surveys you choose to answer, an approximate location derived from the IP address (country, region and city) | Understand in detail how the product is used and improve it | Only your explicit consent (Art. 5(1)), asked for in a separate text; Coleoid works the same if you say no |
| Error reports and performance traces: error details, browser and device information, the page address reduced to its route (no query string), and the page changes and requests leading up to the error; in the browser, performance traces with timings, sampled from about one in ten page loads and page changes | Find and fix errors; monitor the service's speed; keep the service secure | Legitimate interest (Art. 5(2)(f)); our data-security obligation (Art. 5(2)(ç)) |
| AI agent access (MCP): the name and an irreversible hash of a token you create; which tool was used and when | Authorize and audit agent access | Contract (Art. 5(2)(c)); legitimate interest (Art. 5(2)(f)) |
We may use what is needed from this data to establish or defend a legal claim (Art. 5(2)(e)). We give information to competent authorities when the law requires it (Art. 5(2)(ç)).
We do not process special categories of personal data (such as health or criminal records). We make no decisions about you by automated means alone.
4. How we collect data
- From you: sign-up, sign-in and contact forms, and your emails.
- From your organization: your email and access level when a member invites you.
- Automatically: what your browser sends while you use the site and app (IP address, browser information, page visited).
Data is collected electronically, by wholly or partly automated means.
5. Who receives data
We do not sell data or use it for advertising. We share it only with these groups of recipients, and only as far as the purposes in section 3 require:
- Suppliers we use (processors): database, hosting, email delivery, product measurement and error tracking. Current suppliers are in section 6.
- Other members of your organization: members of the same organization see your name, email, access level and the changes you made in history.
- Competent public authorities: only when the law requires it.
6. Transfers abroad
Our servers are outside Türkiye, so all data in section 3 is transferred abroad:
| Supplier | For | Where the data is |
|---|---|---|
| Neon | Database | Germany (Frankfurt) |
| Vercel Inc. | Hosting, server logs, organization logos, page speed measurement | Germany (Frankfurt); page speed measurements are processed by Vercel and may be outside the EU |
| PostHog Inc. | Anonymous visit counts; with your consent, detailed analytics and session recordings | Germany (Frankfurt) |
| Sentry (Functional Software, Inc.) | Error reports and performance traces | Germany (Frankfurt) |
| Resend | Email delivery, including messages sent through the contact form | Ireland (EU) |
| Google (Google Workspace) | Our email inbox, including messages sent through the contact form | Google's data centres, which may be outside the EU, including in the US |
The application's database, product analytics, error reports and organization logos are stored in the EU, in Frankfurt; emails are sent from Ireland (EU).
Neon, Vercel, PostHog, Sentry, Resend and Google are US-based companies, and the Turkish Personal Data Protection Board has not issued an adequacy decision for these countries. We have not yet signed the standard contract announced by the Board under KVKK Art. 9 with these suppliers; we are working to conclude it with each of them and aim to complete this soon. We will update this notice once the contracts are signed and notified to the Personal Data Protection Authority.
Ask for the current position at hello@coleoid.systems.
When we review aggregate product analytics we use an AI assistant (Anthropic, USA). We instruct it to work only with aggregate numbers and do not use it to view recordings or individual people.
7. Cookies, measurement and your choices
- Necessary cookies: the cookie that keeps you signed in, and cookies that remember the language or sidebar setting you chose. The service does not work without them.
- Anonymous visit counts and speed measurements: nothing that identifies you is stored on your device. A visitor is counted on the measurement supplier's server with a hash of the IP address, browser information and a key that changes every day; the key is deleted daily, so days cannot be linked. You can object with "Don't count my visits" on this page. If your browser sends a Global Privacy Control signal, we treat that as your objection. After an objection no visit counts or speed measurements are sent from this device. Only this choice is stored on your device.
- Organization usage milestones: our server computes usage milestones for each organization, such as its first role or first approved proposal, changes of its daily usage stage and a weekly summary from the database (stage changes and the weekly summary also carry its number of members and of members active in the last seven days, as ranges only), and sends them to our measurement supplier identified only by the organization's ID, without names or email addresses. Nothing is read from your device when they are sent, so this does not depend on your choice.
- Organization profile and sign-up source: we store with each organization its owner's optional answers to two questions (what they use Coleoid for and the organization's size) and where the sign-up that created it began (the first page, the referring website's domain and our own campaign tags), and send them with the statistics above. The sign-up source is taken only from the browser's memory at sign-up, and is recorded only if at that moment you had not declined analytics or objected with "Don't count my visits" and your browser sent no Global Privacy Control signal. Once recorded, it stays with the organization and is sent with its statistics until the organization is deleted. Owners can change the answers in Settings → General.
- Detailed analytics and masked session recordings: run only if you allow them through a separate consent text. Recordings mask all text on screen and everything you type; console logs and network content are not captured. People Operations pages, the people directory and person pages are not recorded. Organization owners can turn recordings off for their whole organization in Settings → General, whatever each person chose. You can withdraw at any time from "Privacy settings" in the account menu, the footer link or this page; withdrawal does not affect processing before it.
- Error reports and performance traces: sent to run and secure the service, and do not depend on the choices above. They contain no session recordings.
Your choice is stored on this device; each answer is also recorded as an event with our measurement supplier, without identity if you decline, as proof of your choice. The switch below stops anonymous visit counts and speed measurements at once and withdraws any analytics permission; a Global Privacy Control signal from your browser has the same effect.
We ask for permission in a small card with two equal answers, Decline and Allow. The card stays open until you choose; meanwhile nothing is collected beyond essential cookies and anonymous visit counting. On public pages it appears when you arrive; in the product only after you have created your first role or used it for a few minutes, and never in present mode or over an open dialog. If you decline, we ask again after about six months; everyone is asked again when what we collect changes.
What each choice covers, and the explicit consent text for detailed analytics: What we collect. To have your analytics data deleted, see Data rights.
8. How long we keep data
We keep data only as long as its purpose requires, then delete or anonymize it.
| Data | Period |
|---|---|
| Account | Until your account is deleted. Ask for deletion through section 9. |
| Session | Valid for 7 days after your last use; signing out ends it. |
| Password reset link | 30 minutes |
| Failed sign-in and reset limits | Up to 1 hour |
| Invitation link | Valid for 7 days |
| Contact messages | Kept in our email inbox and deleted at the latest 2 years after the last message in the conversation. Our email delivery supplier keeps sent messages for the period its plan provides (we are confirming it). |
| Detailed analytics events | 1 year |
| Masked session recordings | 30 days |
| Survey answers | 12 months; we check every month and delete answers older than that |
| Error reports and performance traces | The supplier's retention period for our plan, at most 90 days |
| Organization profile answers and sign-up source | Until the organization is deleted |
Your organization's change history is kept until the organization is deleted. If you do not want your name shown in history, we anonymize it to "Unknown" before your account is deleted.
We protect data with organization-scoped access, authenticated sessions and monitoring. See Security & Data.
9. Your rights and how to apply
Under KVKK Art. 11 you have the right to:
- learn whether your personal data is processed,
- request information about it if it is,
- learn the purpose of processing and whether data is used for that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- ask for incomplete or inaccurate data to be corrected,
- ask for deletion or destruction under the conditions in KVKK Art. 7,
- ask that corrections, deletions or destructions are notified to the third parties who received the data,
- object to a result against you that arises solely from automated analysis,
- claim compensation if you suffer damage from unlawful processing.
How to apply. Under the Communiqué on the Procedures and Principles of Application to the Data Controller you can apply:
- in writing, with a wet-ink signature, to the address in section 1,
- by registered email (KEP) to eurosisdanismanlik@hs04.kep.tr, secure electronic signature or mobile signature,
- by email to hello@coleoid.systems from the email address registered in your Coleoid account.
Your application must include your name and surname, your signature for written applications, your Turkish ID number (for foreign nationals, nationality and passport number), your address for notifications, your email and telephone number if any, and the subject of your request. We may ask for more information to verify your identity.
We conclude applications within 30 days at the latest, free of charge as a rule. If a written answer exceeds 10 pages, 1 TRY per extra page may be charged; if the answer is given on a storage medium, its cost may be charged.
If your application is refused, you find the answer insufficient, or we do not answer in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer, and in any case within 60 days of your application (KVKK Art. 14).
10. Additional information for users in the European Union
If you are in the EU, the General Data Protection Regulation (GDPR) also applies. Our legal bases are contract (GDPR Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)) and, for detailed analytics, consent (Art. 6(1)(a)). You can exercise your rights of access, rectification, erasure, restriction, objection and data portability through section 9. You may complain to the supervisory authority of the EU country where you live.
11. Children
Coleoid is for business use and is not intended for children.
12. Changes
We update this notice and its effective date when our purposes, suppliers or legal obligations change. We inform you before we process data for a new purpose.