Privacy Policy
1. Who we are
This website, u2aiperformance.com, and the application at app.u2aiperformance.com are operated by U2 AI Studio Teknoloji A.Ş. ("U2 AI Studio", "we"), a company registered in Türkiye; U2 AI Performance is a venture of that company. Registered office: Ahi Evran OSB Mah. Erkunt Cad. No: 3 İç Kapı No: 41, Sincan / Ankara, Türkiye. Registered at the Ankara Trade Registry Office under number 434199, MERSİS number 0883124471000001, tax office and number Sincan V.D. 8831244710. Phone: +90 850 346 82 82. Contact: info@u2aistudio.com. KEP: u2aistudio@hs01.kep.tr.
2. What we collect
- Account data in the application: your email address, a salted PBKDF2-SHA256 digest of your password (the password itself is never stored), your mobile number if you turn on two-factor sign-in by SMS, and the panel content you enter (canvas texts, revenue and cost lines, product portfolio and sales targets, OPEX staff and expense rows; up to 1 MB).
- Session data: a random session token stored with your email address for seven days or until you sign out, carried by one strictly necessary cookie in your browser.
- Transaction security data: the IP address of sign-in and sign-up attempts, kept for fifteen minutes as a rate-limit counter, and a per-account attempt counter kept for one hour.
- If you belong to a sales team: the sales module records entered by you or about you (activities, customer cards, photos and documents attached to records, targets, commission records, end-of-day records and month-close figures) and the team's audit trail of them.
- If you use the mobile app (U2 AI Performance, iOS): the visit location, only if you turn it on in the app (you can turn it off on the Profile screen at any time) and only at the moment you save a visit record; the phone's location at that moment (latitude, longitude, accuracy and time) is added to that visit record and seen by you and your team's managers; the location is never tracked in the background. If you allow notifications, the phone's Apple notification token, kept with your e-mail address to notify you when a task is assigned to you or a customer answers your e-mail, and deleted when you sign out on the phone.
- Information you submit through the contact form on this website: name, work email, organisation if you share it, and your message.
- Basic technical data generated when you visit the website or the application (IP address, browser type, pages requested), processed on our server for security and performance.
- On this website and in the application, fonts are served by Google Fonts; when pages load, your IP address is transmitted to Google to deliver the font files.
3. Why we process it
- To create and operate your account and provide the panel: storing the canvas, computing the figures and producing the exports you request.
- To provide the sales module to the teams that use it: recording the team's activities, customers, targets and commissions and producing its reports.
- To keep you signed in and to protect accounts against automated sign-in and sign-up attempts.
- To respond to your message and follow up on your request.
- To operate, secure and improve the website and the application.
- To comply with legal obligations applicable to us in Türkiye.
4. Sharing, transfer abroad and retention
We do not sell your personal data, and we do not read canvas content for product purposes, use it to train anything or disclose it to anyone. The website, its contact form and the application run on one server of Amazon Web Services (AWS) in Frankfurt, Germany, and account, session and rate-limit data, panel content and sales module records are stored in one database on that server. That transfer abroad is made in accordance with Article 9 of Law No. 6698, on the basis of the data processing terms in the AWS service agreement and, for account data, the necessity of the transfer for the performance of the contract you entered by creating the account. E-mails the service sends are delivered by Amazon SES, the e-mail service of Amazon Web Services, in Frankfurt (Germany), outside Türkiye, and text messages by our SMS provider NetGSM in Türkiye; each receives the e-mail address or mobile number and the message, as set out in the KVKK notice. Photos and documents attached to records are kept in an encrypted Amazon S3 bucket in the same AWS Frankfurt region; when the file or its record is deleted it is deleted from the bucket too, and the deleted version is removed for good after 30 days. The mobile app's notifications are delivered by Apple Push Notification service (APNs) of Apple Inc.; Apple receives the phone's notification token and the notification's title and text (the task's name, or the name and answer of the customer who answered). Data may be disclosed where required by law. Account data is kept until you delete the account: deletion from the panel, confirmed with your password, removes the account, the canvas and every session on every device immediately. Members of a sales team send the deletion request to the team owner, and the owner of a sales team writes to info@u2aistudio.com. Records entered in the sales module stay with the sales team; once the account that entered them is deleted, they stay under a pseudonym. The end-of-day records and month-close figures (each person's open pipeline and active customers at the end of every day, and each person's summary and figures frozen when a month is closed) are kept for ten years and then deleted automatically; the other sales records (activities, customer cards, targets, the commission ledger) have no automatic deletion and are kept with no time limit; an activity or customer card that the team deletes leaves its details in the team's audit trail (for a customer card, its name and tax number). Daily backup copies of the database are deleted after 15 days, and full copies made before a database update or by hand after 90 days, so deleted data also leaves the backups once those periods have passed. Contact messages are kept for as long as needed to respond and follow up, then deleted or anonymised.
5. This notice covers the website and the application
This notice concerns visitors to u2aiperformance.com and account holders of app.u2aiperformance.com. The canvas content you enter belongs to you; you can download it as JSON at any time and delete it together with the account. Cloudflare Web Analytics is not enabled on the website or in the application in this version; if it is enabled, it works without cookies and this notice will be updated first.
6. Your rights
Depending on your jurisdiction you may have the right to access, correct, delete or restrict processing of your personal data. Residents of Türkiye may exercise the rights listed in Article 11 of Law No. 6698 (KVKK); see the KVKK notice on this site. Account holders can delete their account and canvas directly from the panel. Members of a sales team send the deletion request to the team owner, and the owner of a sales team writes to info@u2aistudio.com. To exercise any other right, write to info@u2aistudio.com.