Privacy Policy
Last updated:
- We collect only what each feature needs: mostly an email address, the domains you add, and what our scans read and measure.
- We run no analytics or advertising trackers, and our servers set no cookies on the public website or the GEO app.
- Your payment card is entered on iyzico's page and never reaches our servers.
- To measure what AI answer engines say about a domain, we send them questions that name the domain. Text from the domain's public pages is sent to Google's Gemini model to extract business facts.
- You can ask us at any time what we hold about you, and ask us to correct or delete it: [email protected].
1. Who we are
KutayGO is operated by C3T Teknoloji A.S., Istanbul, Turkey ("we", "us"). We are the data controller for the personal data described here. Contact: [email protected].
This policy covers kutaygo.com, the product sites geo.kutaygo.com, seo.kutaygo.com, intel.kutaygo.com and content.kutaygo.com, the GEO application at app.geo.kutaygo.com, and the APIs behind them. It is written for the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies to you, the EU General Data Protection Regulation (GDPR).
2. What we collect, and why
Visiting our websites
We do not use analytics, advertising pixels, session recording or error-tracking scripts on our websites. Your browser's requests reach us through Cloudflare, which processes your IP address to deliver the pages and protect them from abuse (see section 4).
On the kutaygo.com homepage, a short offer line for cards issued in Turkey appears if your browser's language is Turkish or its time zone is Europe/Istanbul. That check happens in your browser; nothing about it is sent to us.
Free visibility report (check.kutaygo.com)
You enter a domain name, and nothing else. We store the domain, the time and the result, and we do not store your IP address or any other information about who asked. Our crawler, which identifies itself as KutayGO-ScanBot, reads that domain's public pages and files (for example robots.txt, llms.txt, the sitemap and the home page) to report measured checks. No AI answer engine is asked anything for this report. A result is reused for 24 hours for the same domain. If you ask to be emailed when a report is ready, we store that email address with the report and use it to send you that message.
Waitlist
We store your email address, the product you chose (for example SEO or the full suite), the plan and billing period if you chose one, and the time. We use it to tell you when that product opens. Joining the waitlist does not create an account. We do not store your IP address with the entry.
Enterprise inquiries
We store your email address, the domain if you give one, the text you write (up to 4,000 characters) and the time, and we email the inquiry to our team so that someone can reply to you. We do not store your IP address with it. Please do not include other people's personal data in the text.
Your GEO account
- Sign-in. You sign in with your email address and a six-digit code we email to you. We store your email address, when the account was created and when you last signed in. A new account also creates an organization, which is named after your email address until you change it.
- Login codes. We store only a keyed hash of each code, never the code itself. A code is valid for 10 minutes and is deleted 24 hours after it expires or is used.
- Staying signed in. A refresh token, valid for 30 days, is kept in your browser's local storage. We store only a keyed hash of it, and delete that 30 days after it expires or you sign out.
- We do not store your IP address or browser details with your account, your sign-ins or your tokens.
Domains and domain verification
You add the domains you want measured and prove you control each one with a DNS TXT record, an HTML meta tag or a file on the site. We store the domain, its verification token and a record of each verification check, including the DNS records or HTTP status our check saw. Verified domains are re-checked daily. Verification check records are deleted after 180 days.
Scans and results
- Crawling. A scan reads up to 30 public pages of your verified domain. We store each page's address, status, metadata, structured data and its readable text (up to 40,000 characters per page).
- Your business profile. Facts are extracted from that text (for example your company's legal name, location or products), each with the sentence and page it came from. A fact enters your profile only after you accept it.
- AI answers. We ask AI answer engines a fixed set of questions about your domain and store each question, the engine's full answer, the sources it cited and our verdict on each fact. See section 3.
- Email notifications. We email you when a scan finishes and if proof of control of a domain disappears.
Pages and answers can contain personal data that is published on your website or that an AI engine chose to mention, such as the name of a founder. We process it only as part of measuring your domain.
Payments
Payments are handled by iyzico. You enter your card on iyzico's own secure payment page; the full card number and the security code never reach our servers, and our systems have no field that could hold them. What we store:
- Billing profile: name, email address, phone number (optional), national identity number (optional), address, city, country and postal code. iyzico requires a buyer's details for each payment, including the renewals we charge without you being present, so we keep them for that.
- Card reference: iyzico's token for your saved card, and the card's first six to eight digits, last four digits, type, brand, issuing bank and expiry date. We use these to renew your subscription and to show you which card is on file.
- Billing records: your plan, billing period, amounts, currency, payment status, payment identifiers from iyzico, coupons you redeemed, and the history of changes to your subscription.
When you pay in the app, your IP address is passed to iyzico with the payment, as iyzico requires. We do not store it.
Technical logs and abuse protection
Our servers write technical logs to find and fix faults. Some log lines contain an email address, for example when a login code is sent. To protect our forms and APIs from abuse, we count requests per IP address in memory; those counts are not stored. Section 6 says how long logs are kept.
Our legal bases
- To provide what you asked for, before and under a contract (KVKK Article 5(2)(c); GDPR Article 6(1)(b)): your account, scans, payments, waitlist entries, inquiries and the free analysis.
- Legal obligations (the legal-obligation ground of KVKK Article 5(2); GDPR Article 6(1)(c)): records of payments that the law requires us to keep.
- Legitimate interests (KVKK Article 5(2)(f); GDPR Article 6(1)(f)): security logs, abuse protection, and backups.
3. AI answer engines and models
Measuring what AI says about your domain means asking AI. This is what each part receives.
| Provider | What it is used for | What it receives |
|---|---|---|
| OpenAI, Google (Gemini) and Anthropic | Answer engines we measure. A scan asks one or more of them. | Fixed questions with your domain filled in, such as "What do you know about yourbrand.com?", plus up to two questions built from your sector after you have accepted it. No text from your pages is put into these questions. Our requests to OpenAI ask it not to store the response. |
| Google (Gemini) | Reading your crawled pages and extracting facts and your sector. | The address and readable text of the pages we crawled on your domain. |
| Our own model server | Checking each AI answer against your profile. | Your domain, the AI's answer and the list of facts being checked. It runs on hardware we operate in our own office, reached through an encrypted Cloudflare tunnel, not on a third party's AI service. |
4. Who processes data for us
We do not sell personal data. These providers process it on our behalf, each only for the purpose shown.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner | The server that runs our APIs, scans and database. | Germany |
| Cloudflare | Delivering and protecting our websites, DNS, the encrypted tunnels to our servers, and storage for database backups. | Global network |
| Amazon Web Services (Amazon SES) | Sending email: login codes, scan notifications, and inquiries to our team. | EU (Stockholm region) |
| iyzico | Card payments and saved cards. | Turkey |
| OpenAI, Anthropic, Google | AI answer engines and fact extraction (section 3). | United States |
| Google (Google Drive) | A second copy of our database backups. | Google's data centers |
| Better Stack | Storing and searching our server logs. | Better Stack's data centers |
| Google Fonts | Typefaces on the GEO app, the product sites and a few kutaygo.com pages (not the homepage). Your browser requests them from Google, which receives your IP address. | Google's network |
Our staff sign in to our internal admin panel with Google Workspace accounts. Customers never sign in with Google.
5. International transfers
We are in Turkey. Our main server is in Germany, and some providers above process data in the United States and elsewhere outside Turkey and the European Economic Area. Each of these is a transfer abroad under KVKK and, for EU users, under the GDPR. You can ask us which safeguard a particular transfer relies on by writing to[email protected].
6. Cookies and browser storage
Our servers do not set cookies on the public websites or the GEO app. The pages store these items in your browser themselves:
| Name | Where | What it is for | How long |
|---|---|---|---|
kutaygo.refreshToken (local storage) | app.geo.kutaygo.com | Keeps you signed in. | Until you sign out; the token itself expires after 30 days. |
kg-campaign-dismissed (local storage) | kutaygo.com | Remembers that you closed the card offer line. | Until you clear your browser storage. |
kg-theme (local storage) | Product sites and some kutaygo.com pages | Remembers light or dark mode, if you choose one. | Until you clear your browser storage. |
None of these is used for tracking or advertising, and none is sent to a third party. Cloudflare may set its own strictly necessary security cookies when it checks whether a visitor is a bot.
7. How long we keep data
| Data | Kept for |
|---|---|
| Login codes | Deleted 24 hours after they expire or are used (they are valid for 10 minutes). |
| Sign-in tokens | Deleted 30 days after they expire or are revoked. |
| Domain verification check records | Deleted after 180 days. |
| Free analysis results | Reused for 24 hours; stored until we delete them on request. |
| Account, organization, domains, scans, profile, billing profile | While your account exists, and until you ask us to delete them. |
| Waitlist entries and enterprise inquiries | Until you ask us to delete them. |
| Payment records | As long as the law requires us to keep them. |
| Server logs | On our server, a fixed size per service (the oldest lines are overwritten); a copy is held by Better Stack. |
| Database backups | Copies on our server are deleted after 30 days. We have not yet set a fixed deletion period for the off-site copies; when we do, this page will say it. |
When we delete data at your request, it is removed from the live database, but it can remain in backups until those backups are deleted.
8. Your rights
Under KVKK (Article 11) and, where it applies to you, the GDPR, you can ask us whether we process your personal data and for a copy of it; to correct it; to delete it; to know who we have shared it with, including abroad; to object to processing based on our legitimate interests; to restrict processing; and, under the GDPR, to receive your data in a portable form. You can also object to a decision that affects you and is made only by automated means.
To use any of these rights, email [email protected] from the address your data is held under, or tell us how we can confirm it is you. We answer within 30 days, free of charge.
Deleting your account. The GEO app does not have a delete button yet. Email us and we will delete your account, organization, domains, scans, profile and billing profile, keeping only the payment records the law requires us to keep, and confirm when it is done.
If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (the KVKK authority) or, in the EU, to the data protection authority where you live or work.
9. Security
- Login codes and sign-in tokens are stored only as keyed hashes.
- Our APIs accept no direct connections from the internet; traffic reaches them through an encrypted Cloudflare tunnel.
- The database is reachable only from our own services on the same server.
- Email leaves our servers over an encrypted connection.
- Card numbers and security codes never reach our systems.
10. A service for businesses
KutayGO is built for businesses measuring their own domains. It is not directed at children.
11. Changes to this policy
When what we collect or who processes it changes, we update this page and the date at the top.
12. Contact
C3T Teknoloji A.S., Istanbul, Turkey. [email protected]. See also ourTerms of Service.