Data Processing Agreement
Last updated:
- This is the current version, 1.0, dated 2026-10-17. It applies to every business customer of KutayGO, without a signature, as part of our Terms of Service.
- It covers the personal data we process for you when we measure your domain: what is on your public pages, in the AI answers about it and in the profile you approve.
- If you need a signed copy for your records, write to [email protected].
1. Parties and scope
This agreement is between the customer who uses KutayGO under our Terms of Service ("you", the controller) andC3T Teknoloji A.S., Istanbul, Turkey ("we", the processor). It applies to the personal data we process on your behalf to provide the service, under the EU General Data Protection Regulation (GDPR) Article 28 and, where it applies, the Turkish Personal Data Protection Law No. 6698 (KVKK) Article 12.
It does not cover the data we process as a controller ourselves: your account, sign-in, billing and the visits to our websites. Those are described in our Privacy Policy.
2. Subject matter and duration
The subject matter is the measurement of what AI answer engines say about the domains you add and verify, as the Terms of Service describe it. This agreement lasts as long as you use the service, and after that until the data is deleted or returned under section 10.
3. Nature and purpose of the processing
- Reading up to 30 public pages of each verified domain and storing their text and metadata.
- Extracting facts about the company from that text, for a profile you review and approve.
- Asking AI answer engines fixed questions that name the domain, and storing their answers and the sources they cite.
- Checking each answer against your approved profile, and storing the result and the scores computed from it.
- Showing all of this to you in the service and emailing you when a scan finishes.
We process the data only for this purpose, and never to train AI models or for advertising.
4. Types of personal data and data subjects
- Data subjects: people named on your public website or in AI answers about it, for example founders, staff and contact persons.
- Personal data: what your public pages and the AI answers say about them, typically names, roles and business contact details, and the facts about them you approve in your profile.
- We do not ask for special categories of personal data (GDPR Article 9; KVKK Article 6), and the service is not designed to process them. If your pages contain them, they are processed only as part of the page text.
5. Your instructions
We process the data only on your documented instructions: the Terms of Service, this agreement and the way you use the service (the domains you add, the scans you start, the profile you approve). We tell you if we believe an instruction breaks data protection law. If the law requires us to process the data otherwise, we tell you first, unless that law forbids it.
6. Confidentiality
Everyone at KutayGO who can access the data is bound to confidentiality. Our staff read your data only to help with a request you made, to investigate security or abuse, or where the law requires it.
7. Security measures
- Our APIs accept no direct connections from the internet; traffic reaches them through an encrypted Cloudflare tunnel.
- The database is reachable only from our own services on the same server.
- Customer data is stored per organization, and the database itself limits the customer-facing queries on domains, scans, crawled pages and profiles to the caller's own organization.
- Login codes and sign-in tokens are stored only as keyed hashes.
- Email leaves our servers over an encrypted connection.
- A domain is scanned only after you have proved you control it, and that proof is checked again every day.
8. Sub-processors
You authorise us to use the sub-processors below. We tell you by email before we add or replace one, and you may object on reasonable data protection grounds before the change applies; if we cannot resolve the objection, you may end the agreement and we refund the unused part of a period you paid for. We impose on each sub-processor, by written contract, data protection obligations that protect the data as this agreement does, and we remain responsible to you for them.
| Sub-processor | What it does for us | Location |
|---|---|---|
| Hetzner | The server that runs our APIs, scans and database. | Germany |
| Cloudflare | Delivering and protecting our websites, DNS, the encrypted tunnels to our servers, and storage for database backups. | Global network |
| Amazon Web Services (Amazon SES) | Sending email: login codes, scan notifications, and inquiries to our team. | EU (Stockholm region) |
| OpenAI, Anthropic, Google | AI answer engines and fact extraction (section 3). | United States |
| Google (Google Drive) | A second copy of our database backups. | Google's data centers |
| Better Stack | Storing and searching our server logs. | Better Stack's data centers |
The AI model that checks each answer against your profile runs on a dedicated server that we operate ourselves, in Istanbul, Turkey. No third party operates it, so it is not a sub-processor.
9. Assistance
- Requests from data subjects. We help you answer requests to access, correct, delete or restrict data, and forward to you any request we receive that concerns your data.
- Breaches. We tell you without undue delay after we become aware of a personal data breach that affects your data, with what we know about it, and we help you meet your own notification duties.
- Impact assessments. We give you the information about our processing you need for a data protection impact assessment or a consultation with an authority.
10. Deletion or return at the end
When the agreement ends, we delete your data, or return it to you first if you ask before then. Copies in our database backups are deleted within 6 months of the end, unless you ask us otherwise; records the law requires us to keep, such as payment and invoice records, are kept for the period the law sets (ourPrivacy Policy, section 8).
11. Information and audits
We give you the information you need to show that this agreement is kept. You may audit it, yourself or through an independent auditor bound to confidentiality, once a year and after a breach, with 30 days' notice, at your cost and in a way that does not disturb the service or other customers' data.
12. Transfers abroad
We are in Turkey, and some sub-processors are in the European Union, the United States or other countries. Each transfer relies on the sub-processor's data processing terms, which include the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), as our Privacy Policy lists them (section 6). Where you are established in the European Economic Area, the transfer of your data to us is governed by those standard contractual clauses, Module Two (controller to processor), which are incorporated into this agreement by reference, with you as data exporter and us as data importer.
13. Liability, precedence and law
Liability under this agreement is subject to the limits in section 12 of the Terms of Service. On data protection, this agreement takes precedence over the Terms where they differ. It is governed by the same law as the Terms (section 14).
14. Contact
C3T Teknoloji A.S., Istanbul, Turkey. [email protected].