PRIVACY POLICY

A. WEBSITE PRIVACY POLICY

This Privacy Policy explains how Saastech collects, uses, shares, and protects your personal data when you visit our website (saastech.io) and use our services. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

DATA CONTROLLER

Saastech Temizlikyolda A.S. ("Company", "we", "us", or "our")

Address: Zumrutevler Akkayalar Sk. Fuaye Turkuaz A17 D2 Maltepe Istanbul, Turkey

Email: admin@saastech.io

The Company is the Data Controller as defined under the General Data Protection Regulation (GDPR) for the processing of your personal data under this Privacy Policy.

1. PERSONAL DATA WE COLLECT

1.1 Information You Provide

When you register for our services or contact us, we collect:

• Personal Information: Name, email address, phone number
• Company Information: Company name, business type, address
• Branding Assets: Logo and brand colors for custom applications
• Payment Information: Billing details processed through secure payment providers
• Communication Data: Messages sent through contact forms or support channels

1.2 Information Collected Through Platform Usage

• Customer Data: Information about your customers that you input into the platform
• Employee/Staff Data: Staff schedules and assignment data
• Transaction Data: Orders, appointments, invoices, and payments
• Service Data: Usage patterns, feature interactions, and preferences

1.3 Automatically Collected Information

When you visit our website, we automatically collect:

• Device Information: Device type, operating system, browser type and version
• Log Data: IP address, access times, pages viewed, referring URLs
• Location Data: General location based on IP address (country/city level)
• Interaction Data: Mouse movements, clicks, scrolling behavior (via analytics tools)

2. THIRD-PARTY SERVICES AND TECHNOLOGIES

We use the following third-party services to operate our website and improve user experience. Each service may collect data as described below:

2.1 Google Analytics 4

Provider: Google LLC (USA)

Purpose: Website traffic analysis, user behavior tracking, conversion measurement

Data Collected:

• Pages visited and time spent on each page
• Traffic sources and referral information
• Device and browser information
• Geographic location (country/city level)
• User interactions (clicks, scrolls, form submissions)

Retention Period: 14 months

Opt-out: You can opt out by installing the Google Analytics Opt-out Browser Add-on

Privacy Policy: Google Privacy Policy

2.2 Yandex.Metrica

Provider: Yandex LLC (Russia)

Purpose: Website analytics, user behavior analysis, session recording

Data Collected:

• Page views and navigation paths
• Click maps and heat maps
• Session recordings (Webvisor) - visual playback of user sessions
• Form interaction data
• Device and browser information

Important: Webvisor records user sessions including mouse movements, clicks, and scrolling. Sensitive form fields (passwords, credit card numbers) are automatically masked.

Opt-out: You can opt out at Yandex Metrica Opt-out

Privacy Policy: Yandex Privacy Policy

2.3 Google reCAPTCHA v3

Provider: Google LLC (USA)

Purpose: Spam and bot protection for contact forms

Data Collected:

• IP address
• Browser and device information
• Mouse movements and interaction patterns
• Time spent on page
• Cookies set by Google

How it works: reCAPTCHA v3 runs in the background and assigns a score based on user interactions to determine if the user is human or a bot. No CAPTCHA challenge is displayed to users.

Privacy Policy: Google Privacy Policy

Terms: Google Terms of Service

2.4 Vercel Speed Insights

Provider: Vercel Inc. (USA)

Purpose: Website performance monitoring and optimization

Data Collected:

• Page load times and performance metrics
• Core Web Vitals (LCP, FID, CLS)
• Geographic region (anonymized)
• Device type and connection speed

Privacy Policy: Vercel Privacy Policy

2.5 Google Fonts

Provider: Google LLC (USA)

Purpose: Web font delivery (Inter font family)

Data Collected:

• IP address
• Browser user agent
• Referring page URL

Note: Google Fonts are loaded from Google servers, which means Google receives the above information when fonts are requested.

Privacy Policy: Google Privacy Policy

2.6 WhatsApp Business

Provider: Meta Platforms Inc. (USA)

Purpose: Customer communication and support

Data Collected: When you click the WhatsApp button, your phone number and message content are shared with WhatsApp/Meta.

Privacy Policy: WhatsApp Privacy Policy

2.7 Vercel (Hosting)

Provider: Vercel Inc. (USA)

Purpose: Website hosting and content delivery

Data Collected: Server logs including IP addresses, request URLs, and timestamps

Privacy Policy: Vercel Privacy Policy

2.8 Investor Portal Analytics

Purpose: Track engagement and usage within the Investor Relations portal (pitch deck and KPI dashboard) to understand investor interest and improve the experience.

Scope: This tracking applies only to authenticated users who access the investor portal using an access key.

Data Collected:

• Session Information: IP address, approximate geolocation (country, city, region via hosting provider headers)
• Device & Browser: Browser name and version, operating system, device type (desktop/mobile/tablet), screen dimensions
• Browsing Behavior: Pages and slides viewed, time spent on each page, navigation sequence
• Preferences: Language setting, timezone, referrer URL

Storage: Data is stored in our database (hosted on Neon/PostgreSQL, EU region). It is not shared with third parties.

Access: Only administrators can view session logs through a protected dashboard.

Retention Period: Investor portal session data is retained for 24 months, then automatically purged.

Consent: By entering your access key and accepting the Privacy Policy, you consent to this data collection. You may request deletion of your session data at any time by contacting admin@saastech.io.

2.9 Brevo (Transactional Email)

Provider: Brevo (formerly Sendinblue), France

Purpose: Sending transactional emails such as access approval notifications to investor portal users.

Data Shared: Recipient email address, display name

Privacy Policy: Brevo Privacy Policy

3. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to collect and store information. Here is a detailed breakdown:

3.1 Essential Cookies

These cookies are necessary for the website to function and cannot be disabled.

3.2 Analytics Cookies

These cookies help us understand how visitors interact with our website.

3.3 Security Cookies

3.4 Managing Cookies

You can control cookies through your browser settings:

• Chrome: Settings > Privacy and Security > Cookies
• Firefox: Options > Privacy & Security > Cookies
• Safari: Preferences > Privacy > Cookies
• Edge: Settings > Privacy & Security > Cookies

For more information about cookies, visit www.allaboutcookies.org

4. PURPOSES OF DATA PROCESSING

We process your data for the following purposes:

• Provide, maintain, and improve our services
• Create and manage your account and custom applications
• Process scheduling, appointments, and payments
• Send service-related notifications and updates
• Provide customer support and respond to inquiries
• Analyze usage patterns to improve our services
• Protect against fraud, abuse, and security threats
• Comply with legal obligations
• Conduct marketing activities (with your consent)

5. LEGAL BASIS FOR PROCESSING (GDPR)

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our services
• Legitimate Interests: Analytics, security, and service improvement
• Legal Obligation: Compliance with applicable laws
• Consent: Marketing communications and optional features

6. DATA SHARING

We do not sell your personal information.

We may share data with:

• Service Providers: Cloud hosting (Vercel), analytics (Google, Yandex), security (Google reCAPTCHA)
• Payment Processors: For secure payment processing
• Legal Authorities: When required by law or to protect our rights

All service providers are bound by data processing agreements and confidentiality obligations.

7. INTERNATIONAL DATA TRANSFERS

Your data may be transferred to and processed in countries outside your residence, including:

• United States: Google, Vercel, Meta (WhatsApp)
• Russia: Yandex

We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all third-party providers
• Compliance with applicable data protection frameworks

8. YOUR RIGHTS

Under GDPR and other applicable laws, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request limitation of processing in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Complaint: Lodge a complaint with a supervisory authority

To exercise your rights, contact us at admin@saastech.io

9. CALIFORNIA PRIVACY RIGHTS (CCPA)

If you are a California resident, you have additional rights:

• Right to Know: Request disclosure of personal information collected, used, and shared
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt out of the sale of personal information (we do not sell personal information)
• Non-Discrimination: Right not to be discriminated against for exercising privacy rights

10. DATA RETENTION

• Active Accounts: Data retained while your account is active
• After Termination: Account data deleted within 30 days, backups within 6 months
• Analytics Data: Google Analytics retains data for 14 months
• Investor Portal Sessions: Session logs (pages viewed, IP, device info) retained for 24 months
• Legal Requirements: Some data retained as required by law

11. DATA SECURITY

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Automated backups every 2 hours
• Security monitoring and incident response procedures
• Confidentiality agreements with staff and service providers

12. DO NOT TRACK

Our website does not currently respond to "Do Not Track" browser signals. However, you can opt out of analytics tracking using the methods described in Section 2.

B. MOBILE APP PRIVACY POLICY

This section describes additional data collection when you use our mobile applications (iOS and Android).

1. DATA COLLECTED THROUGH APPS

• Account Information: Email, password (encrypted), profile data
• Location Data: GPS location (when permitted) for routing and service delivery
• Device Information: Device type, operating system, unique device identifiers
• Usage Data: App interactions, features used, session duration
• Push Notification Tokens: For sending notifications

2. APP PERMISSIONS

Our apps may request the following permissions:

• Location: For location-based services and route optimization
• Camera: To upload profile pictures and documents
• Photos/Gallery: To access and upload images
• Notifications: To send service updates and alerts
• Calendar: To sync appointments and schedules

You can manage these permissions through your device settings at any time.

3. APP ANALYTICS

Our mobile apps may use analytics services to understand app usage. Data collected includes:

• App opens and screen views
• Feature usage and interactions
• Crash reports and error logs
• Performance metrics

4. PUSH NOTIFICATIONS

If enabled, you will receive notifications about:

• Service updates and confirmations
• New bookings and schedule changes
• Messages from customers or staff
• Important account information

You can disable push notifications in your device settings.

C. CHILDREN'S PRIVACY

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information.

D. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. We will:

• Update the version number and date at the top of this policy
• Notify you of material changes via email or through our services
• Post the updated policy on our website

We encourage you to review this Privacy Policy regularly.

E. CONTACT US

For questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern:

Saastech Temizlikyolda A.S.

Email: admin@saastech.io

Address: Zumrutevler Akkayalar Sk. Fuaye Turkuaz A17 D2 Maltepe Istanbul, Turkey

Website: www.saastech.io

We aim to respond to all privacy-related inquiries within 30 days.