Privacy Policy

1. Overview

This Privacy Policy explains how Senitix Teknoloji LTD. ŞTİ. (“Senitix,” “we,” “us” or “our”) collects, uses, discloses and protects personal information when you visit senitix.com, sign up for or use the Senitix application (including app.senitix.com and crm.senitix.com), connect another service to it, or contact us. It also explains the choices and rights you have.

Senitix is a service for businesses and other organizations. The people who use it do so on behalf of the organization that holds the subscription, and this policy is written with that in mind.

Key points

• Apart from the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag on our website, we do not sell or share personal information, and we do not use it for targeted advertising. If you visit our English site from the United States, all three run until you opt out through the “Your Privacy Choices” link in the footer of every page, “Reject all” in our cookie banner, or a Global Privacy Control signal.
• Our website sets Google Analytics cookies only after you consent, wherever you are. Unless your browser sends a Global Privacy Control signal, Google’s tag also loads on every page before you choose, in a cookieless mode that sets no cookie and sends Google only cookieless pings. The Meta Pixel and the LinkedIn Insight Tag load, and the Google Ads tag sets its cookies, only after you consent too, except for U.S. visitors to our English site, for whom they run until they opt out. You can change your choice at any time; see section 8.
• Our website also loads a live chat, provided by Crisp, with every page, without waiting for a cookie choice, so that you can write to us; see section 8.
• The Senitix service is hosted on Amazon Web Services (AWS) in Frankfurt, Germany, with disaster-recovery copies in Ireland. Senitix itself is a company based in Türkiye.
• For the information our customers keep in Senitix, such as the contacts and deals in a CRM workspace, the customer decides how it is used and we process it on the customer’s behalf.
• We do not use your data, or what you give Senitix AI, to train AI models.
• You can ask to access, correct or delete your personal information by writing to privacy@senitix.com.

This policy does not cover websites or services run by others, including services you connect to Senitix. Their own privacy policies apply to them.

2. Who we are

Senitix Teknoloji LTD. ŞTİ. is a limited liability company registered in Türkiye, MERSİS No. 0478-1132-3580-0001. It provides Senitix in every market and decides how the personal information described in this policy is used. Customers in the United States contract with this company.

• Registered address: Cevizli Mah. Zuhal Cad. A Blok No:46 İç Kapı No:50, Maltepe, İstanbul, Türkiye
• Privacy questions and requests: privacy@senitix.com
• Company details: Company information

3. Our two roles: controller and processor

Senitix handles personal information in two different capacities. Which one applies decides whose rules govern the information and where you should send a request about it.

When we decide how information is used

We are the controller (in the terms of U.S. state privacy laws, the “business”) for the information we collect for our own purposes:

• your Senitix account and profile, and your sign-in and security records;
• billing, payment and invoicing records;
• visits to our website and the messages you send through our contact and sales forms and our live chat;
• support requests and other correspondence with us; and
• marketing email you have agreed to receive.

This policy describes how we handle that information.

When we act for our customers

Our customers use Senitix to store and work with their own information: for example, the contacts, leads, accounts, deals, emails, calendar events, files and notes in a CRM workspace, the conversations in its Inbox and the submissions to its forms, and what its users give Senitix AI. We call this Customer Data. For Customer Data, the customer is the controller (the “business”) and Senitix is its processor (under U.S. state laws, its “service provider” or “processor”). We process Customer Data only to provide the service and as the customer instructs, under our Data Processing Agreement and Terms of Service. We do not sell it, and we do not use it for our own marketing.

If your information is in a Senitix customer’s workspace, for example because you are a contact of a company that uses Senitix, that company’s privacy notice explains how it uses your information, and your request should go to that company. If you send the request to us, we will pass it to the customer when we can identify it, and we will help the customer respond. Senitix gives customers tools to find, export and erase the information about one person across the service, including messages and attachments that arrived through a connected channel, and to put a legal hold on a contact or lead whose information the law requires them to keep.

If you use Senitix through your employer

Your identity record (name, email address, password hash, MFA enrollment and sign-in history) is controlled by Senitix: you can have it deleted by writing to privacy@senitix.com once your account is closed. Your membership of a workspace, your role in it and your activity inside it are Customer Data: that request goes to the organization that runs the workspace, which has 30 days to respond.

4. Notice at collection

This section summarizes, for each category of personal information we collect as a controller, where it comes from, why we use it, to whom we disclose it for a business purpose and how long we keep it. The categories are those used by the California Consumer Privacy Act (CCPA). During the 12 months before this policy took effect, we collected the same categories from the same sources, for the same purposes, and disclosed them to the same categories of recipients, except that our previous website also used Google Analytics and Crisp live chat for visitors who agreed to them (see section 8).

Category	What it includes	Where it comes from	Why we use it	Disclosed for a business purpose to	How long we keep it
Identifiers	Name, email address, phone number, account and workspace IDs, IP address, session identifiers	You; your organization, when it invites you; a sign-in provider you choose; your device; our live chat, on every page of our website	Create and secure accounts, provide the service, communicate with you, answer inquiries, bill, prevent fraud and abuse, comply with law	Hosting and network providers; email and SMS delivery providers; security and error-monitoring providers; our live chat provider; our payment processor; your organization’s administrators; professional advisers; authorities where the law requires	While your account exists; unverified sign-ups are deleted after 30 days (see section 14)
Customer records (Cal. Civ. Code § 1798.80(e))	Billing name and address, billing contact, a tax number where invoicing requires one, payment card details	You; our payment processor	Take payments, issue invoices, keep accounting and tax records, prevent fraud	Our payment processor (card details go only to it); hosting providers; accountants and auditors; tax authorities where the law requires	Invoices and billing records: 10 years. We do not store full card numbers.
Commercial information	Plan, number of users, subscription and payment history, invoices; in a sales inquiry, the plan you are interested in, company size and number of CRM users	You; our records of your purchases	Provide and bill the service, answer sales inquiries, comply with tax law	Our payment processor; hosting providers; our email provider; professional advisers	Billing records: 10 years; inquiries: as described in section 14
Internet or other electronic network activity	Website request logs (IP address, browser, page, time); sign-in history; actions recorded in your account’s audit log; error reports; delivery, and where tracking is enabled, opens and clicks of emails we send; and, on our website, unless your browser sends a Global Privacy Control signal, the address of the page you view, the site you came from, your browser and device type, the time, your IP address and whether a page view or the start of a free-trial sign-up happened, sent to Google as cookieless pings before you choose and after you refuse (section 8); and, only if you accept analytics on our website, the pages you view, the site or search engine you arrived from, your device, browser and language, your approximate city-level location (derived by Google from your IP address, which it does not log or store), and whether you submitted our contact, sales or free-trial sign-up form or clicked through to sign up; and, only while our website’s Marketing category is on (section 8), the pages you view, the page you came from, your IP address, browser and device details, the identifiers in Meta’s _fbp and _fbc cookies, Google’s _gcl_au and _gcl_aw cookies and LinkedIn’s identifiers (including the li_fat_id and li_giant cookies), the buttons you click and how long you stay on a page (for LinkedIn), whether you submitted our contact or sales form or started a free-trial sign-up, and, for Google, a hash of the email address you entered at sign-up (enhanced conversions) and, if you arrived from one of our Google ads, a notice from our server that your trial account was created; for Meta, notices from our server that you started a free-trial sign-up, that your account was created, that your trial started and of your first payment (its amount and currency), with one-way hashes of the email address you verified and, once your account is created, of your phone number and name; and, if you turn on Analytics or Marketing and then sign up, where you came from (campaign parameters, landing page and referring site with Analytics; ad click identifiers with Marketing); and, on every page of our website, the page you view, the page you came from, your IP address, browser and device details and your chat session identifier, received by our live chat provider, Crisp	Your browser and device; our systems; our email delivery provider; Google’s tag, which loads on every page unless your browser sends a Global Privacy Control signal (without cookies until you accept), and Google Analytics, with cookies if you accept analytics; the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag, while Marketing is on; the sx_attr cookie, if you turn on Analytics or Marketing; our live chat, on every page	Deliver and protect the website and service, detect abuse, fix errors, keep audit trails, understand how features are used; site analytics, to understand how visitors use our website: with your consent for cookies and, for the cookieless measurement before you choose, our legitimate interest (you can object with a Global Privacy Control signal); measuring our own advertising and, with the LinkedIn Insight Tag, showing our ads on LinkedIn to people who visited our website, while Marketing is on: with your consent or, for U.S. visitors to our English site, until you opt out; offering a live chat on our website and keeping a chat session working	Hosting and network providers; our error-monitoring and email delivery providers; your organization’s administrators (audit log); Google, as our service provider for analytics and as the recipient of the cookieless pings described in section 8; Meta, Google (Google Ads) and LinkedIn, while Marketing is on (see below); Crisp, as our service provider for the live chat	Server and application logs: 30 days, and 14 days for the real-time connection and status services; sign-in attempts: 30 days; audit logs: 7 years; analytics data: 14 months in Google Analytics; the Meta Pixel’s and the Google Ads tag’s cookies: 90 days, and the LinkedIn Insight Tag’s first-party cookies: 30 days (li_fat_id) and 7 days (li_giant), and LinkedIn website audiences at most 30 days after the last visit, while Meta, Google and LinkedIn keep what they receive under their own policies; ad click identifiers passed with a sign-up: kept with the account’s sign-up details (deleted within 72 hours if the sign-up is not completed); the sx_attr cookie: 90 days; your consent choice: 180 days; your language choice: 1 year; the live chat’s session cookies: about 6 months (182 days) and about 2 days
Geolocation data (approximate only)	Country, region and city inferred from the IP address used to sign in; the country you choose at sign-up	Your IP address, through our IP-lookup provider; you	Detect unusual sign-ins; set up your account for your country	Our IP-lookup provider; hosting providers	With the sign-in, session or account record it belongs to
Professional or employment-related information	Company name, job title, industry, company size	You; your organization	Set up your account, answer sales inquiries, make our communication relevant to you	Hosting providers; our email provider	While your account exists; inquiries: as described in section 14
Communications and content you provide	Messages you send through our forms, our live chat or by email, support conversations and attachments, files you send in the live chat, feedback; a profile photo if you add one	You	Answer you, provide support, show your profile to your team, improve our service and help content, keep a record of our dealings	Our email provider; our email delivery provider; our live chat provider; hosting providers	As long as needed to handle the matter and follow up (section 14)
Sensitive personal information	Account log-in credentials (email address and password, stored only as a one-way hash); your card number and security code when you pay by card	You	Authenticate you, secure your account, take payments; never to infer characteristics about you	Our payment processor (card details only); hosting providers	Password hash: while your account exists; card details: not stored by us

Sale and sharing. Apart from the Meta Pixel (with our server’s notices to Meta), the Google Ads tag and the LinkedIn Insight Tag described in this paragraph, we do not sell personal information, and we do not share it for cross-context behavioral advertising or use it for targeted advertising. Our current website sets Google Analytics cookies only after a visitor consents in the cookie banner described in section 8, and uses Google Analytics only as our service provider under a contract that limits Google to providing analytics to us, with Google Signals and ads personalization off; we do not consider this a sale or share of personal information. While the Marketing category is on, our website also loads the Meta Pixel, which sends Meta identifiers (your IP address and the identifiers in Meta’s cookies) and internet activity (the pages you view and whether you submitted a form or started a free-trial sign-up) so we can measure our ads. If you then start a free-trial sign-up, our server also sends Meta the same kind of identifiers (your IP address, browser details and the identifiers in Meta’s cookies, with your country and a random sign-up code hashed, and one-way hashes of the email address you verified and, once your account is created, of your phone number and name) and commercial information (that your account was created, that your trial started, and the amount and currency of your first payment). It also loads the Google Ads tag, which sends Google similar identifiers and internet activity (the identifiers in Google’s _gcl_au and _gcl_aw cookies and whether you started a free-trial sign-up) and, with enhanced conversions, a hash of your sign-up email address. Before Marketing is on, Google’s tag sends Google only cookieless pings with no cookie identifier (section 8), and it does not load at all under a Global Privacy Control signal. It also loads the LinkedIn Insight Tag, which sends LinkedIn identifiers (your IP address and LinkedIn’s own identifiers, including the li_fat_id click identifier if you arrived from one of our LinkedIn ads) and internet activity (the pages you view, the buttons you click and whether you started a free-trial sign-up), and, if you are signed in to LinkedIn, LinkedIn can link the visit to your LinkedIn account. We also use the LinkedIn Insight Tag to show our ads on LinkedIn to people who visited our website (LinkedIn website audiences); this is “sharing” for cross-context behavioral advertising and “targeted advertising” under U.S. state privacy laws. Because Meta, Google and LinkedIn may also use this information for their own purposes, some U.S. state privacy laws may treat it as a “sale” or “sharing” of personal information, or as targeted advertising. For most visitors, Marketing is off unless they turn it on. For U.S. visitors to our English site, Marketing is on from the first page view, so the Pixel, the Google Ads tag and the LinkedIn Insight Tag send this information to Meta, Google and LinkedIn until you opt out through the “Your Privacy Choices” link in the footer of every page, “Reject all” in our cookie banner, or a Global Privacy Control signal, which keeps all three from loading at all. Section 8 explains how it works. Before this policy took effect, our previous website used Google Analytics and Crisp live chat for visitors who agreed to them in a cookie banner. That website has been replaced. We do not knowingly sell or share the personal information of anyone under 16.

We do not collect precise geolocation, biometric information or characteristics of protected classifications, and we do not draw inferences from your information to build a profile about you. Your rights are explained in section 17 for U.S. states and section 18 for the EU, the UK and Türkiye.

5. Information we collect

Information you give us

• Account details. When you sign up: your name, work email address, company name and country, and the password you create from the link we email you; and, if you choose to give them, your phone number, language, time zone, industry, company size and the plan you pick. If someone invites you to a workspace, that person gives us your name and email address.
• Profile details. Anything you add to your profile, such as a job title or a photo.
• Billing details. Your organization’s billing name, address and contact, a tax number where invoicing requires one, and payment card details. Card details are collected for our payment processor, iyzico, and passed to it; we do not store full card numbers or security codes.
• Inquiries. What you enter in our contact or sales forms: your name, work email, phone number, company, job title, company size, number of CRM users, country, the plan you are interested in, the topic and your message. With it we record the acknowledgment you ticked and, if you chose it, your marketing opt-in, in the words shown to you, with the date, page and language.
• Live chat. What you write in the live chat on our website: the text of your messages, any files you send and, only if you type them, your name or email address.
• Support and correspondence. Messages you send to support@senitix.com or any of our other addresses, and their attachments.
• Marketing preferences. Whether you agreed to receive marketing email, and any later opt-out.

Information collected automatically

• Website visits. When you load a page on www.senitix.com, the providers that host and deliver the website, Amazon Web Services and its content delivery network Amazon CloudFront, receive your IP address, browser and device type, the page you asked for, the referring page and the time. Until you consent, the website sets no analytics or advertising cookie and, apart from Google’s tag in cookieless mode described below, loads no analytics or advertising code; the strictly necessary cookies listed in our Cookie Policy may be set. Unless your browser sends a Global Privacy Control signal, Google also receives part of this information through its tag even before you choose, in cookieless mode: the page address, the referring site, your browser and device type, the time, whether an event such as a page view or the start of a free-trial sign-up happened, and your IP address. If you accept analytics, Google Analytics also receives this information with its cookies, and while Marketing is on, so do Meta, through the Meta Pixel, Google, through the Google Ads tag, and LinkedIn, through the LinkedIn Insight Tag, as section 8 describes. Every page also loads our live chat, provided by Crisp, whatever you choose: Crisp receives your IP address, browser and device details, the page you are viewing and the page you came from, and stores a chat session identifier in your browser, as section 8 describes.
• Use of the service. When and how you sign in, the IP address you use and the approximate location (country, region and city) derived from it, your device and browser, and a record of actions taken in your account (the audit log).
• Error reports. When something fails, technical details such as the request involved, your browser, your IP address and an account identifier.
• Emails we send. Our email delivery provider records whether each email was delivered and, where tracking is enabled, whether it was opened or a link in it was clicked.
• Cookies and browser storage in the application. See section 8.

Information from others

• Your organization. Administrators of your workspace can add or change your name, email address, role and permissions.
• Sign-in providers. If you sign in with a Google, Microsoft or GitHub account (where offered) or through your organization’s single sign-on, that provider sends us your name, email address and an account identifier.
• Services you connect. If you connect a mailbox or calendar, we receive the information described in section 10 for Google and section 11 for Microsoft and other mailboxes.
• Our payment processor. The result of each payment and a reference to the card saved with iyzico, never the full card number.
• Our IP-lookup provider. The approximate location of an IP address.
• Public sanctions lists. We compare the names of people who register or sign in with sanctions lists published by governments, such as the list kept by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) and the European Union’s consolidated list.

6. How we use personal information

• Provide the service. Create and run accounts and workspaces, authenticate users, sync the services you connect, run Senitix AI when you ask it to, import and export data, and deliver the features of your plan.
• Bill and collect payment. Charge subscriptions in advance, prorate upgrades, retry failed payments, issue invoices and receipts, apply taxes and keep accounting records.
• Communicate with you. Send service messages such as email verification, password resets, security alerts, billing notices and notice of changes to the service or our terms, and answer your inquiries and support requests.
• Answer visitors’ questions. Offer a live chat on every page of our website, keep a chat session working from page to page, and answer what visitors write in it (section 8).
• Keep Senitix secure. Verify sign-ins, provide multi-factor authentication, flag sign-ins from unusual locations, limit repeated failed attempts, block automated abuse, check new passwords against known breached passwords, keep audit logs, monitor errors and maintain backups.
• Comply with the law. Screen names against government sanctions lists at registration and sign-in, keep tax and accounting records, respond to lawful requests and handle privacy requests.
• Improve Senitix. Use service logs and error reports to fix problems, see which features are used and plan improvements.
• Market our products. Send product news and marketing email to people who have agreed to receive it.
• Measure our advertising, and reach past visitors on LinkedIn. Only while our website’s Marketing category is on, use the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag to learn which of our ads led to a visit, a request or a free-trial sign-up, and let Meta and Google optimize their delivery; with the LinkedIn Insight Tag, also show our ads on LinkedIn to LinkedIn members who visited our website (a LinkedIn website audience); tell Meta from our server that you started a free-trial sign-up, that your account was created, that your trial started and of your first payment; and, if you arrived from one of our Google ads, tell Google from our server that your trial account was created (section 8).
• Learn which campaign brought a sign-up. Only if you turned on Analytics or Marketing on our website, keep where you came from with your sign-up (section 8).
• Protect our rights. Enforce our Terms of Service, and establish, exercise or defend legal claims.

Where we use de-identified or aggregated information, such as how often a feature is used across all workspaces, we keep it in that form and do not attempt to re-identify anyone. We will not use personal information for a purpose materially different from those described here without telling you first and, where the law requires, asking for your consent.

Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, with one exception: if the name used to register or sign in exactly matches a name on a government sanctions list, the registration or sign-in is stopped automatically. If this happens to you and you believe it is a mistake, write to privacy@senitix.com and a person will review it.

7. How we disclose personal information

Sale and sharing

Apart from the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag on our website, which run while Marketing is on (the Google Ads tag also loads cookieless before that; section 8), we do not sell personal information or share it for cross-context behavioral advertising, and we place no other advertising technology on our website and none in the application. We do not disclose personal information to third parties for their own direct marketing. We disclose it only as described below.

Service providers

Companies that provide services to us receive personal information only to perform those services, under contracts that limit what they may do with it. The main ones are:

Provider	What it does for us	Where it processes data
Amazon Web Services (AWS)	Servers, databases, file storage, backups and encryption keys for the Senitix service; Amazon Bedrock for Senitix AI	Germany (Frankfurt), with disaster-recovery copies in Ireland; Senitix AI requests in AWS Regions in the European Union
Amazon CloudFront (Amazon Web Services)	Delivering our website, www.senitix.com, and the application’s web files; it receives each visitor’s IP address and request details	AWS edge locations worldwide
Tavily, Inc.	Running the web search Senitix AI can use when a user turns it on	United States
Cloudflare	DNS for our domains; content delivery, firewall and DDoS protection for senitix.com (which redirects to www.senitix.com) and for the Senitix application	Cloudflare’s global network, at the location nearest to you
Google (Google Analytics)	Website analytics (with cookies only if you accept analytics) and cookieless measurement of website visits and conversions (section 8)	Google Ireland Limited for EEA, UK and Türkiye visitors; Google LLC (United States) for other visitors
Crisp IM SAS	The live chat on our website, loaded with every page; it carries the messages visitors write to our team (section 8). Not used in the application.	Company based in France (European Union)
Twilio SendGrid	Delivering the emails the service sends, and receiving emails that users forward to their workspace	United States
Twilio	Sending SMS verification codes	United States
iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.)	Processing payments and storing saved cards	Türkiye
Sentry	Error monitoring	European Union (Germany)
Google Workspace	Our company email, including the addresses you write to	United States and other Google locations
IPinfo	Looking up the approximate location of sign-in IP addresses	United States

The complete and current list, including providers used only for a particular feature, is on our Sub-processors page.

Your organization

If you use Senitix through your organization’s workspace, its administrators can see and manage your user account, your activity in the workspace and the content you create there, and they can ask us to export or delete it.

Services you connect and sign-in providers

When you connect Google, Microsoft or another service to Senitix, or sign in through an identity provider, information passes between Senitix and that service as you direct. The provider’s own terms and privacy policy govern what it does with the information it holds.

Professional advisers

Our lawyers, accountants, auditors and insurers, who are bound by duties of confidentiality, when we need their advice or services.

Legal requirements and protection

Courts, regulators, law enforcement and other public authorities when we believe in good faith that the law requires it, and others when it is necessary to protect the rights, property or safety of Senitix, our customers or the public, including to prevent fraud and abuse. If a request concerns Customer Data, we refer the requester to the customer where the law allows.

Business transfers

A buyer, investor or successor if Senitix is involved in a merger, acquisition, financing or sale of assets, subject to the commitments in this policy. We will tell you before your personal information becomes subject to a different privacy policy.

With your consent

Anyone else, when you ask us to or agree to it. This includes Meta, Google (Google Ads) and LinkedIn, when you turn on the Marketing category on our website. For U.S. visitors to our English site, Meta, Google and LinkedIn receive this data until you opt out, as section 8 describes.

8. Cookies, tracking and browser signals

Our website

Until you make a choice, www.senitix.com sets no analytics or social media cookie and, except for U.S. visitors to our English site (see below), no advertising cookie, and, apart from Google’s tag in cookieless mode (see below), loads no analytics or advertising script; its fonts are served from our own servers. It does load our live chat with every page, as described below. On your first visit, a banner lets you choose “Accept all” or “Reject all,” shown with equal prominence, or open “Cookie settings” to turn the Analytics and Marketing categories on or off separately from Strictly necessary, which is always on. For most visitors, both optional categories are off until you accept them; in the panel their switches start on for a visitor who has not answered yet (an earlier refusal stays off), but nothing is granted until you press “Accept all” or “Save choices.” If you visit our English site from the United States, the banner is a notice instead: Marketing is on until you turn it off (“Reject all” does so at once), and Analytics stays off until you accept it. Your choice is stored in a first-party cookie, sx_consent (holding no personal data, only one answer for each optional category), for 180 days, and the “Your Privacy Choices” link in the footer of every page (on our Turkish site, the equivalent link in its footer) lets you change it at any time; withdrawing consent stops analytics and deletes the Google Analytics cookies, or stops the Meta Pixel and the LinkedIn Insight Tag, stops the Google Ads tag from using cookies, and deletes their first-party cookies, as described below. If you made your choice before we added the Marketing category on September 30, 2026, or before we extended it on October 11, 2026 to the Google Ads tag, to the LinkedIn Insight Tag and then to LinkedIn website audiences (when the consent cookie moved to version 5), an earlier Marketing answer no longer counts and the banner asks you once more about Marketing; your Analytics answer stays as you gave it. If you pick a language from the language menu, we store that choice in a first-party cookie, sx_lang (also holding no personal data), for 1 year, so the home page opens on the market site you chose. See Global Privacy Control below for how we treat that browser signal.

Unless your browser sends a Global Privacy Control signal, Google’s tag (Google Analytics and the Google Ads tag, described below) loads on every page of our website for every visitor, before you make a choice and also after you refuse, with all four of Google’s consent signals (ad_storage, ad_user_data, ad_personalization and analytics_storage) set to denied. In that state it sets and reads no cookie and sends no cookie identifier. It sends Google only cookieless pings: the address of the page you view, the site you came from, your browser and device type, the time, whether an event happened (a page view, or the start of a free-trial sign-up, which is reported to Google Analytics as “generate_lead” and to Google Ads as the “Deneme kaydı” (trial sign-up) conversion, carrying only a random event identifier) and, as with any internet request, your IP address. Google uses them to count and model visits and conversions in aggregate; we see only totals. Our legal basis is our legitimate interest in measuring our website and our advertising (Art. 6(1)(f) GDPR; Art. 5(2)(f) of the Turkish Personal Data Protection Law, KVKK), and you can object by turning on Global Privacy Control in your browser, in which case the tag does not load at all and no ping is sent. Google may transfer these pings to Google LLC in the United States (section 13).

If you accept analytics, Google Analytics 4 (measurement ID G-JQ32B8VWLV) uses Google Consent Mode v2 to set its cookies, under which every signal defaults to denied and only the analytics_storage signal becomes granted; the signals used for advertising (ad_storage, ad_user_data, ad_personalization) stay denied when you accept analytics, because we do not use Google Analytics for advertising, and Google Signals and ads personalization are off in our account. Google Analytics then sets _ga and _ga_JQ32B8VWLV, each kept for 2 years, and measures the pages you view, the site or search engine you arrived from, your device, browser and language, your approximate city-level location (derived by Google from your IP address, which it does not log or store), and three events: submitting our contact or sales form, submitting our sign-up form, and clicking through to our sign-up page. We keep this data in Google Analytics for 14 months. Google Analytics is provided by Google Ireland Limited for visitors in the EEA, the UK and Türkiye, and by Google LLC in the United States for other visitors, and Google processes it as our service provider under its own data processing terms; see section 13 for how transfers to the United States are protected. Using Google Analytics with your consent is not a sale or sharing of personal information.

While Marketing is on, we load the Meta Pixel (pixel ID 28588767130742431) to measure how our own ads perform and to let Meta optimize their delivery. On our Turkish site wherever you are, and on our English site for visitors outside the United States or whose country we cannot determine, Marketing is not granted until you accept it, and until then nothing is requested from Meta. If you visit our English site from the United States and have not made a choice, Marketing is on and the Pixel loads with your first page view, unless your browser sends a Global Privacy Control signal; to tell whether you are in the United States, we use only the country our content delivery network derives from your connection for that one request, and store nothing for it. The Pixel’s script loads from connect.facebook.net and reports to www.facebook.com the address of the page you view (which can include utm_ campaign parameters and, if you arrived from one of our Meta ads, Meta’s click identifier), the page you came from, your IP address, your browser and device details, and the identifiers in the first-party cookies it sets: _fbp, which identifies your browser for ad measurement, and _fbc, set only when you arrive from a Meta ad link that carries a click identifier, each for 90 days. It reports three events: PageView, on every page; ViewContent, only on our pricing and features pages, with the page kind as its only detail; and Lead, when a contact or sales form was submitted successfully, including a sales request sent through the Senitix CRM form embedded on our pages, or when you start a free-trial sign-up and we accept your email address, with “contact,” “sales” or “email-signup” as its only detail (a sign-up’s Lead also carries a random event identifier so it is not counted twice). Advanced Matching and automatic configuration are off, so the Pixel never passes your name, email address, phone number, anything you type into a form or any other personal detail to Meta as event data. If you start a free-trial sign-up while Marketing is on, our server also reports to Meta, through Meta’s Conversions API, that the sign-up started (with the same event identifier as the Pixel’s Lead, so it is counted once), that your account was created (CompleteRegistration), that your trial started (StartTrial, with the plan’s monthly list price) and your first payment (Purchase, with its amount net of tax and its currency). These server notices carry the _fbc and _fbp values, your IP address, your browser details, your country and a random sign-up code, the last two as one-way hashes. So that Meta can match them to a Meta account, the notice that the sign-up started also carries a one-way hash (SHA-256) of the email address you verified with the sign-up code, and the notices sent once your account is created carry one-way hashes of your email address, phone number (if you gave one), first and last name. We never send Meta these details in clear, or anything else you type into a form. Turning Marketing off, in “Cookie settings” or with “Reject all,” tells the Pixel at once to stop sending events, stops it from loading on your next page view and deletes _fbp and _fbc. To stop the server notices after you have signed up, write to privacy@senitix.com and we will delete the encrypted copy we keep for them. The Pixel is provided by Meta Platforms Ireland Limited and by Meta Platforms, Inc. in the United States. Under Meta’s Business Tools Terms, Meta processes this data for its own purposes as well as to measure and report on our ads for us; for its own purposes it is a recipient that acts as an independent controller, and Senitix is responsible, jointly with Meta as those terms describe, for collecting the data on our website and transmitting it to Meta. Meta may transfer the data to the United States under its own terms and the safeguards it describes; see Meta’s Privacy Policy and Cookies Policy. Our Cookie Policy describes the Pixel in full.

We also use the Google Ads tag (conversion ID AW-18501219935) to measure whether our own ads on Google led to a free-trial sign-up. It loads in the cookieless mode described above; while Marketing is on, it also sets cookies and uses enhanced conversions, and Marketing starts on or off in the same way as for the Meta Pixel. Its script loads from www.googletagmanager.com; while Marketing is on, it reports to Google’s advertising domains the address of the page you view (which can include utm_ campaign parameters and, if you arrived from one of our Google ads, Google’s click identifier), the page you came from, your IP address, your browser and device details, and the identifiers in the first-party cookies it sets: _gcl_au, which identifies your browser for conversion measurement, and _gcl_aw, set only when you arrive from one of our Google ads, each for 90 days. It reports one conversion, “Trial sign-up,” when you start a free-trial sign-up, with a random event identifier: as a cookieless ping (above) before you choose and if you refuse, and with the Google Ads cookies and enhanced conversions only if you have turned Marketing on yourself. Google’s enhanced conversions feature is on in our Google Ads account: with that conversion, your browser may send Google an irreversible SHA-256 hash of the email address you entered, never the address itself. If you arrived from one of our Google ads, we also tell Google from our server when your trial account is created, sending only Google’s click identifier (gclid, gbraid or wbraid), the time and a random sign-up code, together with the fact that you have not consented to ads personalization; we send no name, email address or phone number. Google’s ad_personalization signal always stays denied: we do not remarket or personalize ads through Google. Turning Marketing off stops the tag from using cookies and enhanced conversions (it keeps loading in cookieless mode), changes Google’s ad_storage and ad_user_data signals back to denied, and deletes _gcl_au and _gcl_aw. The Google Ads service is provided by Google Ireland Limited and, in the United States, by Google LLC. Under the Google Ads Controller-Controller Data Protection Terms, Google processes conversion measurement data for its own purposes as well as for us, and for its own purposes it is a recipient that acts as an independent controller; the hashed email address sent with enhanced conversions is processed by Google as our processor under the Google Ads Data Processing Terms. See Google’s Privacy Policy and How Google uses information from sites or apps that use our services.

While Marketing is on, we also load the LinkedIn Insight Tag (partner ID 11072769) to measure, in aggregate reports, whether our own ads on LinkedIn led to a visit or to a free-trial sign-up, and to build LinkedIn website audiences, so that our ads on LinkedIn can be shown to LinkedIn members who visited our website; it starts on or off in the same way as the Meta Pixel and the Google Ads tag, and until Marketing is on nothing is requested from LinkedIn. LinkedIn itself matches visits to its members; we see only the approximate size of an audience, never who is in it, and we use these audiences only for our own ads on LinkedIn. We do not upload contact lists or email addresses to LinkedIn. A visitor stays in our website audiences for at most 30 days after their last visit. Its script loads from snap.licdn.com and reports to px.ads.linkedin.com the address of the page you view and the page you came from, your IP address, your browser and device details, the time of your visit, the labels of the buttons you click and how long you stay on the page, together with LinkedIn’s own identifiers; if you arrived from one of our LinkedIn ads, it also reports LinkedIn’s li_fat_id click identifier, and if you are signed in to LinkedIn, LinkedIn can link the visit to your LinkedIn account. It sets the first-party cookies li_fat_id (30 days) and li_giant (7 days) on senitix.com, and LinkedIn sets its own cookies on linkedin.com (such as ar_debug, bcookie, bscookie, lidc, li_sugr, UserMatchHistory and AnalyticsSyncHistory). It reports one conversion, “Free trial signup” (conversion ID 31746425), when a free-trial sign-up succeeds; only the conversion event is sent, with nothing about you. We send LinkedIn no name, email address or anything you type into a form, and no hashed email addresses. Turning Marketing off stops the tag at once (the page reloads), deletes li_fat_id and li_giant and adds no new visits to our audiences (an existing membership ends when the 30 days run out, since we cannot see who is in an audience and so cannot remove you from it ourselves; you can stop these ads in your LinkedIn ad settings); we cannot delete the cookies LinkedIn sets on linkedin.com, which you can delete in your browser or manage in your LinkedIn settings. The tag is provided by LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland), and LinkedIn may process the data in the United States (LinkedIn Corporation). LinkedIn also processes the data for its own purposes, as an independent controller, under its own privacy policy; for the collection of the data on our website and its transmission to LinkedIn, we may be joint controllers with LinkedIn. See LinkedIn’s Privacy Policy and cookie table.

If you turn on Analytics or Marketing, we keep where your first and latest visits came from in a first-party cookie, sx_attr, for 90 days: campaign parameters, an ad click identifier if you arrived from an ad (gclid, gbraid, wbraid, fbclid or li_fat_id), your landing page, the referring site and the time. When you start a free-trial sign-up, we pass the campaign parameters, landing page and referring site with it only if you accepted Analytics, and the click identifiers and Meta’s _fbp and _fbc values only if you turned on Marketing. Meta cookie values are deleted from your sign-up details within 24 hours after the sign-up is completed; so that we can tell Meta about your first payment, an encrypted copy of them, with your IP address, browser details and the hashes sent to Meta, is kept separately until 30 days after your trial ends (30 days after the account was created if no trial started) and then deleted; the click identifiers and campaign information are kept with your account’s sign-up details. If the sign-up is not completed, all of it is deleted within 72 hours. Withdrawing both Analytics and Marketing deletes the cookie on your next page view.

Cloudflare, which provides DNS for our domains, may also set a strictly necessary security cookie (__cf_bm, and cf_clearance if your browser is asked to complete a security check) on senitix.com while it redirects you to www.senitix.com. Neither is set on www.senitix.com itself, which is delivered by Amazon CloudFront. Videos on some pages load only when you press play. At that point the video provider, Wistia, YouTube (through its privacy-enhanced youtube-nocookie.com domain) or Vimeo, receives your IP address and may set its own cookies under its own privacy policy. People who sign in to edit the website receive WordPress’s standard sign-in cookies; visitors do not. Our Cookie Policy lists every cookie, what it does and how long it lasts.

The sign-up form on www.senitix.com is protected by Cloudflare Turnstile, which checks in the background, without a puzzle or a box to tick, that the form is being sent by a person rather than an automated program. To do so Turnstile processes your IP address and information about your browser and device on behalf of Senitix; it is used only to keep the form free of abuse, never for advertising. Cloudflare’s handling of this data is described in the Cloudflare Turnstile Privacy Addendum.

Before this policy took effect, our previous website used Google Analytics and Crisp live chat for visitors who agreed to them in a cookie banner. That website has been replaced. The current website uses Google Analytics again, with its cookies only after consent as described above, and, since September 30, 2026, the Meta Pixel and, since October 11, 2026, the Google Ads tag and the LinkedIn Insight Tag, in the way described above. Since September 30, 2026, it also runs Crisp live chat again, this time loaded with every page rather than after a choice in a cookie banner, as described above. Also on October 11, 2026, Google’s tag began to load in cookieless mode before a choice is made (a Global Privacy Control signal keeps it off), and the switches in “Cookie settings” began to start on for a visitor who has not answered. On October 14, 2026, our server began to tell Meta, through Meta’s Conversions API and only while Marketing is on, that a free-trial sign-up started, that the account was created, that the trial started and of the first payment, as described above. On October 17, 2026, we added to these notices one-way hashes of the email address verified at sign-up and, once the account is created, of the phone number, first and last name.

The Senitix application

The application uses a small number of cookies and browser storage entries that it needs to work or that remember choices you make: a session cookie that keeps you signed in, an XSRF-TOKEN cookie that protects your account against cross-site request forgery, and local storage that keeps your sign-in active and remembers your language, interface settings and unsaved drafts. None of them is used for advertising or to follow you across other websites, so we do not show a cookie banner. If we ever add cookies that are not needed for the service, we will update our Cookie Policy first and ask for your consent where the law requires. The Cookie Policy lists each cookie, what it does and how long it lasts.

Do Not Track

Some browsers can send a “Do Not Track” signal. The application does not track you over time or across other websites, and neither does our website unless Marketing is on; both work the same way whether or not your browser sends the signal, and on our website your cookie choices and a Global Privacy Control signal decide what runs. We do not allow third parties to collect personal information about your online activities over time and across different websites through our website or the application, except the video providers described above once you press play, and Meta, through the Meta Pixel, Google, through the Google Ads tag, and LinkedIn, through the LinkedIn Insight Tag, while Marketing is on. Crisp, our live chat provider, processes information about your visits to our website on our behalf, as our service provider.

Global Privacy Control

We honor opt-out preference signals, such as Global Privacy Control (GPC), as a valid request to opt out of the sale or sharing of personal information and of targeted advertising for the browser that sends them. On our website, we treat a GPC signal as a refusal of both optional categories, Analytics and Marketing, the same as choosing “Reject all” in the cookie banner: the banner is not shown, and neither category runs unless you later turn it on yourself in “Cookie settings.” This keeps the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag off, which are the only technologies on our website that some U.S. state privacy laws may treat as a sale or sharing of personal information, or as targeted advertising. Under GPC, Google’s tag does not load at all, so not even the cookieless pings described above are sent. For U.S. visitors to our English site, who would otherwise have them on from their first page view, a GPC signal keeps them from loading at all. We do not otherwise sell or share personal information or use it for targeted advertising. A GPC signal does not stop our live chat, which is not one of the consent categories and which Crisp provides as our service provider.

9. Senitix AI

Senitix AI is a set of features in the application, available on paid plans, that prepares work for a person to review: a daily digest, answers to questions about records the user can already see, email drafts and rewrites, summaries of email threads and suggested next steps. When you use Senitix AI, you are working with an AI system. Its output can be wrong, so check it before you rely on it.

What it processes

Your instruction or question; the parts of records you have permission to see that are needed to answer it; and any email or text you ask it to work on. Most of this is Customer Data, which we process for the customer as described in section 3. We also count each user’s AI requests to apply the daily limits of the customer’s plan.

Where it runs

Senitix AI uses models provided through Amazon Bedrock, with AWS’s European Union inference profiles, so requests and responses are processed in AWS Regions in the European Union. We do not send them directly to any model developer. By default, Senitix masks common identifiers, such as email addresses, phone numbers, national ID numbers, IBANs, payment card numbers and IP addresses, before text is sent to a model. If a customer uses Senitix AI’s web search, the search query Senitix AI writes for that request is sent to our web search provider, Tavily, Inc., in the United States, as our Sub-processors page describes.

No training on your data

We do not use Customer Data, prompts or Senitix AI outputs to train or improve AI models. AWS’s published commitments for Amazon Bedrock state that it does not use prompts and responses to train models and does not distribute them to third parties.

People stay in control

Senitix AI suggests; it does not decide. By default it asks the user to confirm before it creates or changes a record, and sending or replying to an email or deleting anything always requires the user’s confirmation. We do not use Senitix AI to make decisions about people that have legal or similarly significant effects.

How long it is kept

Senitix AI conversations are deleted automatically after 180 days without activity. Records a user creates or updates with Senitix AI’s help are kept like any other Customer Data.

10. Google user data and Limited Use

This section explains how Senitix accesses, uses, stores and shares information from Google when a user connects a Google account to Senitix, for example to see Gmail messages next to CRM records or to keep Google Calendar in sync. Senitix accesses only the Google account the user connects, only after the user authorizes it on Google’s consent screen, and only to provide features the user can see in Senitix.

The data we access and why

• Gmail (gmail.readonly and gmail.send). We read your messages to find the ones you exchange with people and companies in your organization’s CRM (its contacts, its leads and the email domains of its accounts), and we keep only those, with their attachments, next to the related records. Mail between colleagues, drafts and messages with addresses you have marked never to log are not kept. We send the messages you write, reply to or forward in Senitix. Senitix does not change your mailbox: it does not mark messages as read, label, archive, move or delete them.
• Google Calendar (calendar.events and calendar.calendarlist.readonly). We read the list of your calendars so you can choose which one to sync, read your events to show your meetings and availability in Senitix, and create, update and delete the events you schedule or change in Senitix, so both sides stay in sync.
• Basic profile (userinfo.email and userinfo.profile). We identify the connected Google account and use the right sender address. The same information is used if you choose to sign in with Google.

A shared team address. An administrator can also connect a team address, such as support@ on Google Workspace or Microsoft 365, to the Senitix Inbox, with the same permissions. Messages sent to that address become conversations the team works on in the Inbox. They are the organization’s data and are kept until the organization deletes them or the retention period it has set for closed conversations ends (section 14). Disconnecting the team address revokes our access and stops the sync; conversations already received stay in the Inbox.

How we use it

We use Google user data only to provide and improve the user-facing features described above. When you ask Senitix AI to work on a message or event, for example to summarize a thread, it processes that data to give you the result. We do not use Google user data for advertising, including retargeting or personalized ads, and we do not sell it. We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.

How we share it

We do not transfer Google user data to anyone except: (a) as necessary to provide or improve the features you use, including to the service providers that host and run Senitix, such as AWS (and Amazon Bedrock when you use Senitix AI on that data), under contracts that limit their use of it; (b) within your organization’s workspace, according to the permissions its administrators set, for example when an email is linked to a shared CRM record; (c) to comply with applicable law; or (d) as part of a merger, acquisition or sale of assets, after telling you.

Human access

No one at Senitix reads Google user data unless you give us permission for specific messages or events (for example, when you ask our support team to look into a problem), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized and is used for internal operations.

How we store and protect it

Google user data is stored on AWS in the European Union with the rest of the service and is encrypted in transit and at rest. The access tokens that let Senitix reach your Google account are stored encrypted, and only the people and systems that need them to run the feature can use them.

Retention and deletion

Messages that are not linked to a CRM record are deleted 365 days after they were synced. A message linked to a record (a contact, lead, account or deal) stays as part of that record’s history for as long as it is linked. When you disconnect a Gmail account in Senitix, we end our access and delete every message and attachment we synced from it, including the ones linked to records. When you disconnect Google Calendar, we stop syncing and end our access; meetings you scheduled in Senitix remain as activities in your organization’s workspace until it deletes them. Google keeps its own list of the apps you have allowed, and Senitix can stay on that list after you disconnect until you remove it there, so if you want it gone from the list as well, remove Senitix’s access on your Google Account’s third-party access page; you can do this at any time. You can also ask us to delete Google user data we hold by writing to privacy@senitix.com. Deleted data can remain in our backups until they expire (section 14).

Limited Use

Senitix’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Senitix’s use of information received from Google Workspace APIs will also adhere to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

11. Microsoft and other mail connections

Users can also connect a Microsoft Outlook mailbox and calendar, or any mailbox that supports IMAP and SMTP.

• Outlook mail (Mail.ReadWrite and Mail.Send). We read your messages to find the ones you exchange with people and companies in your organization’s CRM and keep only those, as described for Gmail in section 10. We send the messages you write in Senitix. We use Mail.ReadWrite only to save a message you send as a draft in your mailbox just before sending it, which keeps a reply in its conversation and lets a large attachment be uploaded. Senitix does not otherwise change your mailbox: it does not mark messages as read, move or delete them.
• Outlook calendar (Calendars.ReadWrite). We show your meetings in Senitix and keep the events you schedule in Senitix in sync with your calendar.
• Basic profile (User.Read). We identify the connected account and use the right sender address. The same information is used if you choose to sign in with Microsoft.
• IMAP and SMTP. We store the server details and credentials you enter, encrypted, and use them only to sync and send your mail.

We handle this data under the same rules as Google user data in section 10: we use it only to provide the features you use; we do not sell it or use it for advertising; we do not use it to train AI models; people at Senitix read it only with your permission, for security or where the law requires; messages that are not linked to a CRM record are deleted 365 days after they were synced, while linked ones stay with the record; and disconnecting a mailbox ends our access, because we delete the tokens that let us reach it, and deletes every message we synced from it. You can also remove Senitix’s access in your Microsoft account’s app permissions.

12. Messaging channels: WhatsApp, Messenger, Instagram and Telegram

This section explains what we process when a Senitix customer (a business) connects a WhatsApp Business, Facebook Messenger, Instagram or Telegram account to the Senitix Inbox. These channels are provided by Meta Platforms, Inc. and its affiliates and by Telegram, and their own privacy policies govern how they handle data.

Our roles. Conversations between a business and the people who message it are that business’s Customer Data: the business is the controller and Senitix is its processor (section 3). Senitix is the controller of the account information of the business user who connects the channel.

The information we process

• Connected account information: the IDs of the connected WhatsApp Business account and phone number, the ID and name of the Facebook Page, the ID and username of the Instagram professional account, the ID and username of the Telegram bot, and the access tokens Meta or Telegram issue so Senitix can reach those accounts.
• Information about people who message the business: the sender identifier the channel provides (on WhatsApp, the phone number and profile name; on Messenger and Instagram, an ID specific to that Page or account; on Telegram, the user ID and username), message content and attachments (images, documents, audio, video, location), timestamps, and delivery and read status.
• Profile name and picture on Messenger and Instagram: only where Meta has approved that access, and only so the agent can see who they are talking to.
• Messaging permission: whether the person has agreed to receive messages from the business on a channel, how they did so (by writing to the business first, by ticking a box on the business’s form that asks for it, or as the business recorded) and when, and whether they have opted out.
• WhatsApp templates: the message templates the business creates in Senitix and their approval status at Meta.

How we use it

• to show messages as conversations in the business’s Inbox, link them to the related CRM record (a contact, lead, account or deal) and let the business’s agents reply;
• to route conversations to a team or an agent according to the rules the business sets;
• to send, through the relevant channel, the replies and approved templates an agent writes or selects, and the automatic replies the business has set up;
• to show whether a connection is working, and to end our access when the business disconnects the channel or removes our app at Meta;
• to summarize a conversation or draft a reply with Senitix AI when a business user asks for it (section 9).

We do not use this information for advertising and we do not sell it, and we do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models. Senitix does not message anyone on its own initiative. A WhatsApp template, which a business can send outside WhatsApp’s 24-hour reply window, goes only to a person who has agreed to receive messages from that business. A person who replies STOP (or DUR, İPTAL, UNSUBSCRIBE or ÇIKAR) is opted out at once, and only a later START (or BAŞLA) from that person opts them back in. Submitting a form never opts a person back in.

How we share it

• Within the business’s own organization, with the members who can see that Inbox, according to the permissions its administrators set.
• With the channel provider: to deliver replies, message content goes to the relevant channel (Meta or Telegram). Meta and Telegram are not our subprocessors; they are communication services the business chooses to use.
• With our service providers that host and run Senitix (AWS, and Amazon Bedrock when Senitix AI is used), under contracts that limit their use of it to providing the service (section 7).
• To comply with the law, or as part of a merger or acquisition (section 7).

Storage and retention

The information is stored on AWS in the European Union with the rest of the service and is encrypted in transit and at rest. Access tokens are encrypted with a separate data key for each connection and can be used only by the systems that run the feature. Attachments that arrive through a channel wait in a temporary buffer for at most 14 days until they are moved into the business’s workspace.

Conversations are kept as part of the business’s Customer Data until the business deletes them, or until the retention period it has set for closed conversations ends (section 14). When a business disconnects a channel, we revoke or delete the access tokens and remove the channel’s webhook subscription; conversations already received stay in the workspace until the business deletes them.

Deleting your data

• If you messaged a business: ask the business you messaged. From its Senitix account it can find the information about you, including messages and attachments that came through a channel, export it and erase it, unless the law requires it to keep that information. You can also write to privacy@senitix.com; we pass your request to that business and help it respond as its processor.
• If you connected Senitix to Facebook or Instagram: you can remove Senitix, or ask for your data to be deleted, in your Facebook or Instagram settings. Meta passes the request to us. We record it and give you a confirmation code and a link to a page that shows the status of your request. When you remove our app at Meta, we end your connection. If we have to decline a deletion request, for example because the law requires us to keep the data, that page says why.

Messages are delivered through the channel provider’s systems (Meta Platforms, Inc. in the United States, and Telegram), which follows from the business’s choice to use that channel; section 13 explains how we protect international transfers.

13. International data transfers

Where the service runs. The Senitix application and its data are hosted on AWS in Frankfurt, Germany (region eu-central-1), with disaster-recovery copies in Ireland (region eu-west-1), and Senitix AI requests are processed in AWS Regions in the European Union. We do not host the service in the United States.

Where we work. Senitix is based in Türkiye. Our team operates, secures and supports the service from Türkiye and can access personal information from there when that work requires it. Your correspondence with us is handled there too.

Providers in other countries. Some of our service providers process information in the United States or on a global network, as listed in section 7 and on our Sub-processors page. On our website, that includes Google, whose tag sends it cookieless pings before you choose (section 8), which may be transferred to Google LLC in the United States. If you accept analytics, Google Ireland Limited processes the Google Analytics data for visitors in the EEA, the UK and Türkiye, and Google LLC, based in the United States, for other visitors; transfers to the United States rely on the standard contractual clauses in Google’s data processing terms and, for Google LLC, its certification under the EU-U.S. Data Privacy Framework. While our website’s Marketing category is on, the Meta Pixel sends information to Meta Platforms Ireland Limited and Meta Platforms, Inc., and Meta may transfer it to the United States under its own terms and the safeguards it describes (section 8). While Marketing is on, the Google Ads tag sends information to Google Ireland Limited and Google LLC, and Google may transfer it to the United States and other countries where it has data centers; for transfers from Türkiye this rests, like the Meta Pixel’s, on the explicit consent given by turning Marketing on, and, for the cookieless pings, on the standard-contract commitment that also covers Google Analytics (section 8). While Marketing is on, the LinkedIn Insight Tag sends information to LinkedIn Ireland Unlimited Company, and LinkedIn may process it in the United States (LinkedIn Corporation) under its own terms and the safeguards it describes; for transfers from Türkiye this rests, like the Meta Pixel’s, on the explicit consent given by turning Marketing on (section 8). Our live chat provider, Crisp IM SAS, is a company based in France, in the European Union.

If you are in the United States, your personal information is transferred to and processed in the European Union and Türkiye, and in the United States by the providers named above. The data protection laws of those countries differ from the law of your state. This policy applies wherever your information is processed.

If you are in the EEA or the UK. Neither the European Commission nor the United Kingdom has found that Türkiye provides an adequate level of data protection. When you give us information directly, for example by signing up, writing to us or visiting our website, the GDPR or the UK GDPR applies to our handling of it as this policy describes. When a customer in the EEA or the UK transfers Customer Data to us, our Data Processing Agreement incorporates the standard contractual clauses adopted by the European Commission and, for UK data, the UK International Data Transfer Addendum. When one of our providers outside the EEA and the UK handles personal information for us, we rely on the standard contractual clauses in that provider’s data processing terms. You can ask for a copy of the safeguards that apply to your information at privacy@senitix.com; we may remove commercially sensitive terms from the copy.

Transfers from Türkiye. Because we are established in Türkiye, transfers we make from Türkiye to other countries are governed by Article 9 of the Turkish Personal Data Protection Law No. 6698 (KVKK). No country has an adequacy decision under the KVKK, so we are putting the Board’s standard contracts in place with each provider and notify each contract to the Personal Data Protection Authority within five business days of signature, as Article 9(5) requires; the Sub-processors page shows for which provider this is complete.

14. How long we keep personal information

We keep personal information only as long as we need it for the purposes in this policy, and then delete or anonymize it. Most deletion runs automatically. The main periods are:

Information	How long we keep it
Account and profile information	While your account exists. If an administrator removes you from a workspace, your membership record is deleted after 365 days. If you sign up but never verify your email address, we delete the account after 30 days, with reminders before we do.
Billing records, invoices and contracts	10 years, as Turkish tax and commercial law requires. If you ask us to delete your information, we anonymize the personal information in these records and keep the records.
Audit and security logs	7 years
Sign-in attempts and expired sessions	30 days
Server and application logs	30 days; 14 days for the real-time connection and status services
In-app notifications	90 days after they are read; 180 days if unread
Data export files	30 days
Analytics data (Google Analytics, only if you accept analytics on our website)	14 months in Google Analytics. Your cookie consent choice itself (the sx_consent cookie) is kept for 180 days.
Meta Pixel data (only while our website’s Marketing category is on)	The _fbp and _fbc cookies last 90 days. Meta keeps what the Pixel sends under its own policy; we do not control how long.
Google Ads data (cookies and enhanced conversions only while our website’s Marketing category is on)	The _gcl_au and _gcl_aw cookies last 90 days. Google keeps what it receives under its own policy; we do not control how long.
LinkedIn Insight Tag data (only while our website’s Marketing category is on)	The first-party li_fat_id cookie lasts 30 days and li_giant 7 days. A visitor stays in our LinkedIn website audiences for at most 30 days after their last visit. LinkedIn keeps what the tag sends under its own privacy policy; we do not control how long.
Where you came from (the sx_attr cookie, only if you turn on Analytics or Marketing)	90 days in your browser; deleted if you withdraw both
Meta cookie values passed with a free-trial sign-up, and the hashes sent to Meta	Deleted from the sign-up details within 24 hours after the sign-up is completed; an encrypted copy kept, with the IP address, browser details and the hashes sent to Meta, to tell Meta about the first payment is deleted 30 days after the trial ends (30 days after the account was created if no trial started); within 72 hours if the sign-up is not completed
Ad click identifiers passed with a free-trial sign-up	Kept with the account’s sign-up details until the account is deleted; deleted within 72 hours if the sign-up is not completed
Your language choice (the sx_lang cookie, set only if you pick a language in the language menu)	1 year
Live chat conversations on our website (Crisp)	As long as needed to answer and follow up on your request and to keep a record of it, and until you ask us to delete them at privacy@senitix.com. The live chat’s session cookies last about 6 months (182 days) and about 2 days.
Senitix AI conversations	Deleted after 180 days without activity
Website inquiries, support requests and other correspondence	As long as we need them to answer you, follow up and keep a record of our dealings with you or your organization; then deleted
Marketing preferences	Until you withdraw your consent. We keep a record of your consent and of any opt-out so that we can prove and honor it.
Backups	Daily backups for 35 days and monthly backups for 365 days, after which they are overwritten

We may keep information longer when the law requires it, to resolve a dispute or enforce an agreement, or while a legal hold applies. Once we have verified a deletion request, we complete it within 30 days. Information deleted from the live service can remain in backups until those backups expire; we use backups only to restore the service after an incident.

Customer Data

We keep Customer Data for as long as the customer’s subscription lasts and as the customer instructs. By default, deleted records stay in a recycle bin for 90 days (a workspace can choose anywhere from 30 days to 7 years) and deleted files stay in the file trash for 90 days. Synced email that is not linked to a CRM record is purged after 365 days; email linked to a record stays with it. A workspace can also set how long closed Inbox conversations and form submissions are kept, from 1 to 120 months; until it does, they are kept until the customer deletes them. Once a period is set, a monthly run destroys what has passed it, skips anything linked to a contact or lead under a legal hold, leaves attachments that were added to a CRM record with that record, and keeps a record of the destruction. A workspace can also have contacts and leads with no activity for a period it chooses, from 6 to 120 months, moved to its recycle bin, where they can still be restored until the recycle bin period ends; contacts and leads under a legal hold, converted leads, and contacts on deals, quotes, contracts, orders, invoices or open conversations are never moved. When a customer cancels or closes its workspace, the workspace stays available read-only for 30 days so the customer can export its data, and the data is then deleted as our Data Retention Policy describes.

15. How we protect personal information

We use administrative, technical and physical safeguards suited to the information we handle, including:

• encryption in transit with TLS 1.2 or higher (TLS 1.3 where your browser supports it), and HTTP Strict Transport Security on our websites;
• encryption at rest, plus field-level AES-256-GCM encryption, with a separate key for each workspace, for designated sensitive fields;
• passwords stored only as salted one-way hashes, and new passwords checked against known breached passwords by a method that never sends the password itself;
• multi-factor authentication with an authenticator app, or by SMS where it is enabled, which workspace administrators can make mandatory; Senitix staff must use multi-factor authentication to reach our administrative tools;
• role-based access control, with each customer’s workspace kept separate in the application, and audit logs of account activity;
• daily and monthly backups stored in the European Union, in Frankfurt with copies in Ireland; and
• traffic filtering and protection against denial-of-service attacks through Cloudflare for senitix.com and the Senitix application; our website, www.senitix.com, is served through Amazon CloudFront.

No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires. Annex II of our Data Processing Addendum describes our measures in more detail. To report a vulnerability, write to security@senitix.com.

16. Your choices

• Marketing email. Every marketing email we send includes an unsubscribe link and our postal address. You can also change your preference in the application under Settings › Privacy, or write to privacy@senitix.com. We act on an opt-out promptly, and always within 10 business days. We will still send you service messages about your account.
• Text messages. We send text messages only for verification and account security; we do not send marketing messages by text. You can stop them by replying STOP, by removing your phone number in the application’s settings, or by writing to support@senitix.com, and you can reply HELP for assistance. Removing the number turns off SMS verification for you.
• Your profile. Update your details in the application’s settings, or ask your workspace administrator.
• A copy of your data. Export your account data under Settings › Privacy, or ask us for a copy.
• Connected services. Disconnect a mailbox or calendar in Senitix at any time, and remove Senitix’s access from your Google or Microsoft account.
• Cookies. On our website, use the “Your Privacy Choices” link in the footer of every page (on our Turkish site, the equivalent link in its footer) to accept, reject or change analytics and marketing cookies at any time, or block or delete cookies in your browser. Our live chat loads with every page and cannot be turned off there; you can delete its cookies and local storage entries in your browser. The application’s sign-in and security cookies are needed to use it, so blocking them will stop you from signing in.
• Browser signals. Section 8 explains how we respond to Do Not Track and Global Privacy Control.

17. U.S. state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and a growing number of other states have rights under their state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA). Some of these laws apply only to businesses above certain thresholds, and some do not cover information about people acting in a business or employment capacity. We honor the requests below from residents of any U.S. state; the details and exceptions depend on the law where you live.

Your rights

• Know and access. Ask what personal information we have collected about you, the categories of its sources, why we use it, the categories of third parties to whom we disclose it, and the specific pieces of information we hold. Where your state provides for it, as Oregon and Minnesota do, you can also ask for a list of the specific third parties to which we have disclosed personal information.
• Portability. Receive your personal information in a portable, readily usable format.
• Correct. Ask us to correct personal information that is inaccurate.
• Delete. Ask us to delete personal information we collected from or about you, subject to exceptions the law allows, such as invoices we are required to keep.
• Opt out. Opt out of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do none of these, except that we use our website’s LinkedIn Insight Tag for targeted advertising (LinkedIn website audiences), and some state laws may treat our website’s Meta Pixel, Google Ads tag and LinkedIn Insight Tag as a sale or sharing of personal information, or as targeted advertising. If you visit our English site from the United States, they run until you opt out; you can opt out through the “Your Privacy Choices” link in the footer of every page, “Reject all” in our cookie banner, or a Global Privacy Control signal (an opt-out preference signal). An opt-out made in the banner or through the link is saved in that browser for 180 days. Section 8 explains how we honor opt-out signals.
• Limit the use of sensitive personal information. See below.
• Non-discrimination. We will not deny you service, charge you a different price or give you a lower quality of service because you exercised any of these rights. We do not offer financial incentives in exchange for personal information.

Sensitive personal information

We collect account log-in credentials (your email address together with a password, which we store only as a one-way hash) and, when you pay by card, your card number and security code, which go to our payment processor. We use and disclose this information only to provide the service, secure your account and take payments, which are uses the CCPA permits without a right to limit, and never to infer characteristics about you. For that reason we do not offer a “Limit the Use of My Sensitive Personal Information” link.

How to make a request

Email privacy@senitix.com with “U.S. privacy request” in the subject line. Tell us your name, the email address you use with Senitix or used to contact us, your state of residence and the right you want to exercise. If you have an account, you can also export your account data under Settings › Privacy. We will confirm that we received your request within 10 business days and respond within 45 days. If we need more time, up to another 45 days, we will tell you why. Requests are free; if a request is manifestly unfounded or excessive, we may decline it or charge a reasonable fee, as the law allows.

How we verify requests

To protect your information, we verify your identity before we act on a request to know, correct or delete. If you have an account, we will ask you to confirm the request from the email address on the account or while signed in. If you do not, we will match details you give us, such as your name, email address and the date and subject of your inquiry, against our records. For a request for specific pieces of information or to delete sensitive information, we may ask for more. We use the information you give us for verification only for that purpose. An opt-out request does not need verification.

Authorized agents

You can use an authorized agent to make a request for you. The agent must give us proof that you signed a permission for the request, and we may ask you to verify your identity with us directly or to confirm that you gave the agent permission. We do not ask for this when the agent holds a power of attorney under California Probate Code sections 4121 to 4130 or a comparable law. A parent or legal guardian can make a request on behalf of a child.

Appeals

If we decline to act on your request, in whole or in part, we will explain why. You can appeal by replying to our decision or by emailing privacy@senitix.com with “Privacy request appeal” in the subject line. We will answer your appeal in writing within 45 days of receiving it, explaining what we did and why. If we deny your appeal, we will tell you how to contact your state’s Attorney General to submit a complaint.

Other state notices

• California “Shine the Light.” We do not disclose personal information to third parties for their own direct marketing purposes.
• Nevada. We do not sell covered information as Nevada law defines it. Nevada residents can still send an opt-out request to privacy@senitix.com.
• Job applicants. This policy does not cover job applications. If you apply for a job with us, we will tell you separately how we handle your application.

18. Privacy rights in the EU, the UK and Türkiye

If you are in the European Economic Area (EEA) or the United Kingdom, the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to the personal information we handle as a controller, and this section adds what those laws require us to tell you. Our GDPR and Data Protection page explains our roles and transfers in more detail.

Legal bases

Purpose	Legal basis
Providing the service, running your account, billing and support	Performance of our contract with you or your organization. For users an organization invites, our legitimate interest in providing the service the organization has bought.
Service messages	Performance of a contract; our legitimate interest in keeping users informed about their accounts
Answering inquiries sent through our forms or by email	Steps you ask us to take before entering into a contract; our legitimate interest in answering you
Security, fraud and abuse prevention, sign-in location checks, error monitoring and backups	Our legitimate interest in keeping Senitix and its users secure
Sanctions screening	Our legitimate interest in complying with the sanctions rules that apply to us and our providers; legal obligation where EU or UK law requires it
Tax, accounting and other records the law requires	Our legitimate interest in complying with Turkish law, which requires us to keep these records; legal obligation where EU or UK law applies
Improving the service using logs and error reports	Our legitimate interest in running and improving our products
Senitix AI and the services you connect	Performance of a contract: they are features you ask us to provide
Analytics cookies on our website	Your consent (Art. 6(1)(a)), which you can withdraw at any time in “Cookie settings”
Cookieless measurement of our website and our advertising by Google’s tag before you choose (it does not load under a Global Privacy Control signal)	Our legitimate interest (Art. 6(1)(f)) in measuring our website and our advertising; you can object by turning on Global Privacy Control in your browser
Measuring our advertising with the Meta Pixel, the Google Ads tag and the LinkedIn Insight Tag on our website, building LinkedIn website audiences of visitors, transmitting that data to Meta, Google and LinkedIn, telling Meta from our server that a sign-up and a trial started, that the account was created and of the first payment, and telling Google from our server that a trial started	Your consent (Art. 6(1)(a)), which you can withdraw at any time in “Cookie settings”
Keeping where you came from (sx_attr) and passing it with a free-trial sign-up	Your consent (Art. 6(1)(a)) to Analytics or Marketing, as the part passed requires; withdrawable at any time in “Cookie settings”
The live chat on our website: loading it with every page, keeping a chat session working and answering what you write in it	Our legitimate interests (Art. 6(1)(f)) in offering visitors a direct way to reach us and in keeping a chat session working, not your consent; we process the content of your messages because you choose to write to us
Marketing email	Your consent, which you can withdraw at any time
Establishing, exercising or defending legal claims	Our legitimate interest in protecting our rights

Where we rely on legitimate interests, we consider whether your rights and interests override them. You can ask us for details, and you can object.

What you need to give us

We need your name, email address, password and country to create an account, and billing details for a paid plan. Without them we cannot provide the service. Other fields are optional unless a form marks them as required.

Your rights

• Access the personal information we hold about you and receive a copy.
• Rectification of information that is inaccurate or incomplete.
• Erasure of your information where the law provides for it.
• Restriction of our use of your information while a concern is resolved.
• Portability of information you gave us, in a structured, machine-readable format.
• Objection to processing based on legitimate interests, and at any time to direct marketing.
• Withdrawal of consent at any time, without affecting what we did before you withdrew it.
• Human review of a decision based solely on automated processing, such as the sanctions check described in section 6.

To exercise a right, write to privacy@senitix.com. We will respond within one month. If a request is complex or you have made several, we may extend that by up to two further months, and we will tell you why.

Complaints

You can complain to us about how we handle your personal information at privacy@senitix.com. We acknowledge a complaint within 30 days of receiving it, look into it without undue delay and tell you the outcome. You also have the right to complain to a supervisory authority: in the EEA, the authority in the country where you live or work or where you believe the infringement took place (the European Data Protection Board lists them); in the UK, the Information Commissioner’s Office.

Representative

We have not designated a representative in the EU or UK; you can reach us directly at privacy@senitix.com.

People in Türkiye

Because Senitix is established in Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK) also applies to our processing. People in Türkiye can read our KVKK disclosure notice, in Turkish, on our Türkiye website, and can send an application under Article 11 of KVKK to privacy@senitix.com. We answer applications within 30 days.

19. Children

Senitix is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 16, including children under 13 as defined by the U.S. Children’s Online Privacy Protection Act, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us personal information, write to privacy@senitix.com and we will delete it.

20. Changes to this policy

We review this policy at least once a year and update it when our practices or the law change. The dates at the top of this page show when it was last updated and when the current version took effect. If we make a material change, we will tell account owners by email or in the application before the change takes effect, and we will not apply a material change to information we collected earlier without giving notice and, where the law requires, obtaining consent. You can ask us for an earlier version at privacy@senitix.com.

21. Contact us

• Privacy questions and requests, including U.S. state, GDPR and KVKK requests: privacy@senitix.com
• Legal notices: legal@senitix.com
• Security vulnerabilities: security@senitix.com
• Support and billing: support@senitix.com
• General questions: info@senitix.com or our contact form
• By mail: Senitix Teknoloji LTD. ŞTİ., Cevizli Mah. Zuhal Cad. A Blok No:46 İç Kapı No:50, Maltepe, İstanbul, Türkiye

If you have a disability and need this policy in another format, write to privacy@senitix.com and we will provide it. You can also print this page.