Privacy Policy

Who is responsible

The controller (KVKK: veri sorumlusu) for the personal data described here is RGS Yazılım ve Bilişim Sistemleri Ltd. Şti., Maslak Mah. AOS 55. Sk. 42 Maslak B Blok No: 4 İç Kapı No: 542, 34398 Sarıyer, İstanbul, Türkiye. For anything about your data, write to [email protected].

Inside an organization, the ad data and the people it invites are managed by that organization. For that data we process on the organization’s behalf, according to these terms; for your own account, security and billing records we are the controller.

What we collect

• Account: your name, e-mail address, password (stored only as a hash), language, and two-step verification settings.
• Organizations and members: organization names and settings, who belongs to which organization with which role, and invitations.
• Google Ads data: the accounts you connect, their campaigns, keywords, search terms and performance numbers, the Google e-mail address of the connection, and the connection’s access token (encrypted).
• History and audit log: the changes made through Odak and who made them; sign-ins and membership, connection, project and billing events, with the IP address and browser of security events.
• Billing: your plan, its status and dates, your billing currency and Paddle’s customer and subscription ids. Card and bank details go to Paddle only; we never see them.
• Messages and technical data: e-mails you send us, and server logs with request ids, IP addresses and errors.

Why we use it, and on what basis

• To provide Odak: your account, organizations, showing and changing your ads, e-mails the service needs (verification, invitations, billing and retention notices). Basis: the contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• To keep Odak secure and find errors: audit log, sign-in protection, error monitoring and logs. Basis: our legitimate interest in a safe service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• To bill and to meet tax and accounting rules. Basis: contract and legal obligation (GDPR Art. 6(1)(b), (c); KVKK Art. 5(2)(c), (ç)).
• To answer you when you write to us. Basis: contract or legitimate interest.

We do not sell personal data, we do not use it for advertising, and we do not use your Google Ads data to train AI models.

Google user data

Odak accesses Google Ads data only through the Google Ads API, with the permission you give in Google’s consent screen, and Google sign-in data (name, e-mail) when you sign in with Google. We use this data only to show your accounts in Odak and to make the changes you ask for.

Odak’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell it, do not use it for advertising, and share it only with the service providers below that we need to run Odak. People at Odak do not read it unless you ask for help, it is needed for security, or the law requires it.

You can remove a connection in Settings › Connections, or revoke Odak’s access in your Google account’s security settings, at any time.

Where data is stored and how it is protected

Your data is stored in the EU. It travels encrypted (TLS). Google Ads access tokens are encrypted in the database with a key only the application holds, and they never appear in the app, in logs or in API responses. Every organization’s data is separated in the database itself (row-level security), so one customer can never read another’s.

Service providers

We use these providers to run Odak. Each processes only what its task needs, under a data processing agreement:

• Paddle (Paddle.com Market Ltd.): checkout, payments, invoices and taxes as our reseller and merchant of record. For payment data Paddle is an independent controller under its own privacy notice.
• Mailgun: sending the service’s e-mails.
• Google: the Google Ads API and Sign in with Google.
• Sentry, when enabled: error monitoring. Error reports are stripped of personal data before they leave our servers.
• OpenAI, only when our server has an OpenAI key configured (without one, these features run on built-in rules and nothing is sent). New campaign: the landing page’s text, the keywords and other inputs you give, the target countries and language and the project name, to suggest keywords and draft ad text. Opportunities: the project name, the names of your campaigns and ad groups, up to 10 keywords and a few headlines and descriptions per ad group, and the keyword ideas being judged, to check which ideas fit your ads. Metrics, spend, budgets, billing details and personal data are never sent, and requests are made with storage at OpenAI turned off.
• Our hosting provider in the EU: servers, the database and its backups.

International transfers

Some providers (for example Google, Paddle, Mailgun, Sentry and OpenAI) may process data outside the EU or Türkiye. We transfer data only where an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses apply. For transfers from Türkiye we follow Article 9 of the KVKK and use the standard contracts it provides for.

How long we keep it

• Account data: as long as your account exists. Deleting your account removes your sign-in and personal details; in the History and audit logs of organizations you belonged to, your name is replaced by “Former member”. So that each person gets one free trial, deleting an account that used it keeps one thing for 24 months: a one-way code made from the e-mail address (it can’t be turned back into the address) and the date of the trial.
• Organization data: as long as the organization exists. Deleting an organization deletes all of its data.
• Without a plan: when a trial ends or a subscription ends without a new plan, the organization stays read-only for 90 days and is then deleted. Owners and Admins are e-mailed 30, 7 and 1 day before.
• Billing records: kept by Paddle, and by us as long as tax and accounting law requires.
• Server logs: up to 30 days. Backups: deleted data can remain in encrypted backups for up to 35 days before they are overwritten.

Your rights

Under the GDPR and Article 11 of the KVKK you can ask whether we process your data and get a copy, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent where we asked for it. You can also complain to a supervisory authority, such as the data protection authority of your EU country or Türkiye’s Personal Data Protection Authority (KVKK).

Many of these you can do yourself: download your data in Settings › Account, delete your account in Settings › Security, and delete an organization in Settings › Danger zone. For anything else, write to [email protected]; we answer within 30 days.

Cookies

Odak uses only strictly necessary cookies: the sign-in session cookie and the language cookie, plus your theme choice in your browser’s storage. There are no analytics or advertising cookies, so there is no cookie banner. When you pay, Paddle’s checkout may set its own cookies, explained in Paddle’s policy.

Children

Odak is a business service and is not meant for anyone under 18.

Changes to this policy

When we change this policy in a way that matters, we tell Owners and Admins by e-mail or in the app before the change applies. The date at the top always shows the latest version.