Privacy Policy

Nurşat Bülbül is the data controller for Lite ASO account and service operations, operating under the Lite ASO brand in Türkiye. Contact: [email protected]. This notice covers the website, account, workspace, APIs, native AI, MCP connections and related support.

For workspace personal data you submit on behalf of others, your organization may separately act as controller and Lite ASO may process it on your instructions. This notice is not a substitute for a data-processing agreement where one is needed. Paddle independently handles data for its payment, tax, fraud and buyer-support responsibilities under its own notice.

The KVKK disclosures in this notice apply to processing subject to Turkish law in Türkiye. They are not presented as a worldwide privacy-law regime; rights under other applicable jurisdictions remain unaffected.

We receive account details such as email, profile name, password hash where password sign-in is used, authentication-provider identifiers, passkey public credentials, security settings and acceptance/consent records. A passkey's private key remains with your authenticator; Lite ASO does not receive your fingerprint or face image for passkey verification.

Workspace data includes selected apps and markets, keywords, competitors, drafts, notes, reviews/replies, reports, alert settings and support messages. Public app-store data may include reviewer names and review text. Store connections involve the credentials or keys you deliberately submit.

AI data includes prompts, selected workspace context, relevant task history, drafts, generated outputs, approvals and credit usage. Integration data includes OAuth grants, client identifiers, permitted tool activity and revocation records. Technical data includes IP addresses, device/browser information, timestamps, security events and diagnostic logs.

Paddle checkout collects billing and payment details directly. Lite ASO receives relevant customer, order, subscription, transaction, tax/amount, payment-status and refund references needed to provide access and reconcile billing. We do not receive or store your full payment-card number or card security code through Paddle checkout. This also includes the trial activation status and start/end dates needed to apply the one-time 14-day trial and manage the transition to paid access. The trial payment method is collected by Paddle; Lite ASO does not store full card details.

Google Sign-In is optional. We request only openid, email and profile: a Google account identifier, email/verification status and basic profile information such as name and an available profile image. These identify your account, complete sign-in and account linking, and support account/security communications. Sign-in does not grant Gmail, Drive, Calendar, Contacts or Google Play Console access.

Google Play connections are separate: you explicitly provide a service-account credential and grant your selected app permissions. The Android Publisher scope is used to verify the app connection and for enabled store operations you request; relevant app/review data may be processed. Your Google login is not a grant to manage every app. Public Google Play listing research is distinct from private Google account/API access.

Google API user data is used for the disclosed user-facing functionality, not sold, sent to advertising platforms, used for credit scoring, or used to develop or train generalized/non-personalized AI or ML models. Google sign-in identity data and authentication tokens are not included in native AI prompts. Any supported transfer of other Google API data for a requested feature must follow the applicable user-consent and Limited Use conditions; unrelated provider-training permissions do not override these restrictions.

Lite ASO’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements where applicable. Human access to covered data is restricted to permitted circumstances, such as your affirmative agreement for specific support, necessary security investigation, legal requirements or permitted aggregated internal operations.

Account identifiers/profile records and relevant authorization records are retained for account operation under the retention rules below. You can revoke Google access in your Google Account connections, disconnect a linked login where account settings support it, and request deletion at [email protected]. Revoking Google authorization stops future authorized access; it does not itself delete existing Lite ASO records or cancel paid billing. Ensure another sign-in method remains available before disconnecting.

Account authentication, requested workspace features, AI tasks and subscription fulfilment rely on processing necessary to enter into or perform a contract. Security, abuse prevention, service diagnostics and defending claims rely on applicable legitimate-interest grounds where the balancing requirements are met. Tax, accounting and lawful disclosures rely on legal obligations.

Where Turkish law applies, the relevant conditions include KVKK Article 5(2)(c) for contractual necessity, 5(2)(ç) for legal obligations, 5(2)(e) for establishing, exercising or protecting a right, and 5(2)(f) for legitimate interests without prejudicing fundamental rights. Consent under Article 5(1) is used where required for optional processing. Other applicable privacy laws may provide corresponding grounds.

Optional analytics/advertising technologies and marketing emails require the appropriate preferences or consent where applicable. Declining them does not prevent account use. Withdrawal applies prospectively and does not invalidate earlier lawful processing. Transactional security, billing and requested alert messages are distinct from marketing.

A requested native AI task may send the prompt, selected app/market data and necessary workspace context to the configured model provider. Supported providers include OpenRouter and its selected upstream model provider, OpenAI and Anthropic. The provider/model used depends on enabled configuration; not every task uses every provider.

Prompts and results can be retained in your workspace so tasks can be reopened and reviewed. Provider storage, abuse monitoring and any permitted training use depend on the actual provider, endpoint and contractual settings. We do not promise universal zero retention or universal no-training treatment without a verified applicable arrangement. Avoid putting sensitive data or credentials in prompts; contact [email protected] if your data needs specific processing guarantees. The Google-data restrictions above take precedence for information obtained from Google APIs.

An assistant you connect through MCP can receive permitted tool results when you request them. Its operator then handles those results under its own terms and notice. OAuth consent grants access within the displayed scope; it is not blanket consent to every processing purpose. Revocation stops future authorized access but does not recall copies already received by a third party.

Data is shared as necessary with infrastructure and delivery services for hosting, databases, traffic/security, backups, operational email and notifications; payment provider Paddle; the AI providers involved in a requested task; and Apple or Google for store operations you request. Current service integrations include Cloudflare and Amazon SES; actual recipients depend on the feature used.

When enabled with your optional preferences, analytics and advertising recipients can include Amplitude, Google Analytics/Ads and Meta. The Cookie Policy describes the categories and controls. Support personnel and professional advisers receive information needed for their work. Competent authorities may receive information where legally required.

We do not sell personal data. Posting in the community makes your chosen public content available to others. A workspace integration or notification destination can also disclose data to the recipient you configure; review the destination and permissions before enabling it.

Paddle, AI providers and other service providers may process information outside Türkiye or your country, including in the United States and Europe. The recipient and processing location depend on the provider and service. A foreign provider's own terms are not, by themselves, proof of a lawful cross-border transfer mechanism.

International transfers must satisfy applicable requirements, including KVKK Article 9 where relevant: an applicable adequacy decision or an appropriate safeguard, or a legally available exception under its conditions. Contact [email protected] to request information about recipients, locations and the safeguard applicable to your processing. This notice does not assert that an unverified standard contract, approval or adequacy decision already exists.

We use password hashing, httpOnly session cookies, access and ownership checks, encryption of submitted store credentials at rest, HTTPS in production, restricted administrative access, rate limits and logging redaction. OAuth permissions and required operation approvals remain enforced. Security measures reduce risk but cannot guarantee that every incident is prevented.

Keep account recovery methods and connected-store permissions under your control. Report suspected unauthorized access to [email protected]. We assess incidents and make notifications to affected people and authorities when applicable law requires them.

Account and workspace records are retained while needed to provide the service. After deletion or closure, relevant records may remain for legal retention, billing reconciliation, fraud/security, disputes and backup recovery. We minimize or delete information when its purpose and required retention end; there is no unsupported promise that all systems and provider copies are erased immediately.

Financial and legal records may need to be kept after account deletion. Backup copies are retired through their retention cycle and should not be restored for unrelated routine use. A connected provider controls copies it lawfully received. Ask [email protected] for the applicable retention criteria or to request deletion; we verify identity and explain any lawful restriction.

Under KVKK Article 11, where applicable, you may learn whether personal data is processed; obtain information about processing, purposes and recipients; request correction or deletion under legal conditions and notification to recipients; object to an adverse result based exclusively on automated analysis; and seek compensation for unlawful processing. Applicable GDPR or other laws may also provide access, portability, restriction and objection rights.

Send requests to [email protected] using the email registered to your account where possible. State the request and enough information to identify the relevant records; do not send unnecessary identity documents. We may verify identity and respond through the procedures and deadlines required by law. Under KVKK, a valid application is resolved as soon as possible and within 30 days; this is a response deadline, not a promise that every record is deleted within 30 days.

You may also complain to the competent privacy authority under the applicable procedure. Privacy questions, optional-consent withdrawal and statutory complaints do not require buying a subscription.

The service is not directed to children under 16. If you believe an underage account exists, contact [email protected] so we can investigate. Paid purchases additionally require lawful contractual capacity or valid authorization.

We update this notice when service processing changes and communicate material changes where appropriate. A new notice does not automatically create consent for new optional purposes. Contact [email protected] for privacy, data access, deletion and processing-agreement requests.