Privacy Policy

1. Data Controller

This privacy policy concerns the talep.io platform operated by Talep Teknoloji A.Ş. The data controller responsible for processing your personal data is Talep Teknoloji A.Ş. Contact: info@talep.io

2. Data We Collect

• Account details: first name, last name, work email address, company name, job title
• Usage data: session durations, pages accessed, click and interaction logs
• Transaction data: purchase requests, approval records, invoice and contract documents
• Technical data: IP address, browser type, device information
• Communication data: support requests, feedback

3. Purposes of Processing

• Providing and maintaining the platform service
• User authentication and account management
• Running approval flows, notifications and business processes
• Meeting legal obligations
• Security, fraud prevention and maintaining system integrity
• Improving service quality (using anonymized data)

4. Legal Basis

Your personal data is processed on one of the following legal bases: performance of a contract (KVKK Art. 5/2-c), legitimate interest (KVKK Art. 5/2-f), legal obligation (KVKK Art. 5/2-ç) and explicit consent (KVKK Art. 5/1). For users within the scope of the GDPR, this processing is carried out under Article 6 of the EU GDPR.

5. Sharing Data with Third Parties

Your data is shared only with the following infrastructure providers that are essential to providing the service:

• Supabase (database, file storage and authentication), EU servers (Frankfurt, Germany)
• Resend (transactional emails)
• Vercel (application hosting)
• Sentry (error tracking; user identity and cookies are removed before sending), EU servers (Germany)
• Cloudflare (bot protection on the sign-in, sign-up and password reset screens, Turnstile)
• Anthropic (AI-assisted features; the relevant content is sent only when these features are used, and data may be processed in the US)
• Google (Google Analytics, only on marketing pages and only if you consent; data may be processed in the US)

Data processing agreements (DPAs) are in place with these providers. Your data is not shared for third-party advertising or marketing. The current list, the data each provider processes and change notices are on the Trust Center page: talep.io/trust-center

6. Retention Periods

• Account data: until the account is deleted, plus 30 days
• Transaction records (requests, approvals, invoices): 10 years (legal obligation)
• Technical logs: 90 days
• Support correspondence: 3 years

7. Your Rights

Under KVKK and the GDPR you have the following rights:

• Right of access: you can request a copy of your data
• Right to rectification: you can ask for incorrect data to be updated
• Right to erasure: under certain conditions you can request that your data be deleted
• Right to object: you can object to processing based on legitimate interest
• Right to portability: you can receive your data in a machine-readable format
• Right to complain: you can apply to the KVKK Authority in Türkiye or the relevant Data Protection Authority in the EU

To exercise your rights, write to info@talep.io. Requests are answered within 30 days.

8. Cookies

Essential session cookies are used to sign in to the application; these do not require consent. On our marketing pages (home page, product pages, blog, process assessment test), Google Analytics cookies for visit statistics are used only with your explicit consent. No analytics cookies are used on the sign-in screens, the application or the supplier portal. No advertising or marketing cookies are used. Which cookie is kept for what purpose and for how long is listed on the Cookie Policy page; you can change your preference at any time from the "Cookie preferences" link at the bottom of the page.

9. Security

All data is encrypted with AES-256 at rest and TLS in transit. Bank details and messages are additionally encrypted a second time at the application level with a separate key. Database access is restricted by role-based authorization (RLS). For reporting security vulnerabilities: security@talep.io

10. Policy Updates

When this policy changes, a notice will be sent to your registered email address. Significant changes will also be announced within the platform. You can always review the current version of the policy on this page.

11. Contact

For any questions and requests about privacy: Email: info@talep.io Address: Talep Teknoloji A.Ş., Istanbul, Türkiye