Privacy Policy

• 1. Controller and scope
• 2. Personal data collected
• 3. Purposes and legal bases
• 4. Recipients
• 5. Cookies and local storage
• 6. Retention
• 7. Security
• 8. Your rights
• 9. International transfers
• 10. Age restriction
• 11. Amendments
• 12. Contact

1. Controller and scope

1.1 This Privacy Policy (the “Policy”) applies to the website squsha.com and the services provided through it (together, the “Service”). The Service is operated by Orkun Karavelioğlu, an individual established in Türkiye (the “Controller”, “we”, “us”), who determines the purposes and means of the processing described in this Policy. The Controller may be contacted at hello@squsha.com.

1.2 Payments are processed by Paddle.com Market Ltd (“Paddle”), acting as Merchant of Record. Paddle is an independent controller of the payment data it collects at checkout, and that processing is governed by Paddle’s privacy policy.

1.3 Where the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, or the Turkish Law on the Protection of Personal Data No. 6698 (“KVKK”) applies, this Policy is intended to satisfy the information obligations imposed by those laws.

2. Personal data collected

2.1 Account data

• Email address, which serves as the account identifier and the means of authentication. No passwords are stored; authentication is performed by a single-use 8-digit code sent to the email address, valid for ten minutes.
• Google account data, only where you choose to sign in with Google. Google provides the email address of the Google account, whether Google has verified it, the name on the account and a Google account identifier. The identifier is stored to recognise the account at the next sign-in, and the name is used as the initial username. No Google password is received, and no access to any other Google data is requested.
• Username, selected at registration and modifiable in Settings.
• Session records, as described in section 5, including a description of the browser and operating system derived from the user-agent string, shown in Settings so that sessions can be recognised and revoked.

2.2 Report data

• The topic and brief submitted for research.
• The resulting report, its PDF rendering and, under the Consultant Plan, the monthly re-runs of any tracked niche.
• Report metadata: generation timestamps, completion status, the plan or credit applied, and computed scores. Internal administrative tools display metadata only; the topic and content of a report are not accessible through them.

The topic, brief, report content and PDF are encrypted by the application prior to storage, using a key that is not held in the database. PDF files are stored under a randomly generated identifier that does not disclose their subject.

2.3 Billing data

• We do not receive or store payment card details. Paddle transmits to us the transaction identifier, the amount paid, the Paddle customer identifier and the email address used at checkout, for the purpose of crediting the account and displaying purchase history.
• Records of billing irregularities (for example a duplicate charge or an undelivered payment notification) are retained until resolved.

2.4 Technical data

• IP address and user-agent string, used to enforce rate limits on authentication and report generation. These are associated with a session for its duration and are present in server logs.
• Server logs and performance telemetry, comprising request timings, error messages and generation durations. Logs are redacted to exclude report content, authentication codes and session tokens. Privileged administrative actions (changes to a plan; resolution of a billing incident) and account deletions are recorded in the same logs as an audit trail, referenced by account identifier only.
• Free-report records. When a free report is generated, a one-way keyed hash of the email address (with sub-address tags such as +tag removed), of the device cookie described in section 5 and of the IP address is stored, so that the free report is available once per person rather than once per account. The hashes cannot be converted back into the address, cookie or IP address. They are compared only against the same hashes of later free-report requests, and they are not used for any other purpose.

2.5 Support correspondence

Correspondence sent to us is retained for the duration of the matter and for 30 days thereafter.

2.6 Consultant Plan: branding and client details

• The business name and logo a Consultant Plan subscriber sets for white-labelled reports.
• The name and email address of the subscriber’s client, where the subscriber enters them for a report or a tracked niche, together with the time a report was sent to that client. The client name and email address are encrypted before storage in the same way as report content.
• Where a report sent to a client is not delivered, the time of that failure and the reason given by the client’s mail server, as reported to us by Resend. The reason often repeats the client’s email address, so it is encrypted in the same way. It is used only to show the subscriber that the report did not arrive and to tell them so by email, and it is cleared when the report is sent again.

Client details are processed on behalf of the subscriber, who decides whether and to whom a report is sent and who is the controller of that data; Squsha acts as processor under the terms set out in section 7A of the Terms of Service. A client who no longer wishes to receive reports may say so by replying to the email, which reaches the subscriber, or by writing to hello@squsha.com, in which case delivery to that address will be stopped.

3. Purposes and legal bases

3.2 Personal data is not processed for advertising purposes and is not sold. Submissions and reports are not used to train machine-learning models, whether operated by us or by third parties. Reports are generated independently for each account and are not disclosed to, or derived from, any other account. No marketing communications are sent.

4. Recipients

4.1 Producing a report requires the disclosure of certain data to third-party processors. The recipients, the data disclosed to each, and the purpose of disclosure are as follows.

4.2 YouTube data. Reports use YouTube API Services to read public information about channels and videos, including the public comments posted under them. Commenters’ names are not stored. YouTube data held in a report — quoted comments and view and subscriber figures — is removed 30 days after the report is generated. No YouTube or Google account data of yours is accessed. By using the Service you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to YouTube’s processing.

4.3 Personal data is not otherwise disclosed, except where disclosure is required by law, including pursuant to a binding legal order. Where lawful, we will notify you of any such disclosure.

5. Cookies and local storage

5.1 The Service sets one persistent cookie, rn_session, which maintains the authenticated session. It is strictly necessary for the operation of the Service, is not accessible to client-side scripts, and expires after 30 days without a visit or upon sign-out; a visit extends it. Sign-in with Google additionally sets two short-lived cookies, rn_oauth and rn_google_link, which carry the state of that sign-in between our site and Google, are sent only to the sign-in routes, and expire after ten minutes. A second persistent cookie, rn_device, holds a random identifier that is set when a report is requested and is used only to prevent the free report being claimed repeatedly from the same browser; it is not accessible to client-side scripts, is not shared with any third party, and expires after two years. The browser’s local storage holds a single flag indicating signed-in status, used to render pages correctly before the server responds.

5.2 No analytics, advertising or tracking cookies are set, and no third-party trackers are embedded. Fonts are served from our own servers. The only third-party resource loaded is Paddle’s script, on the home, pricing and consultants pages, as described in section 4; Paddle may set the cookies its checkout requires, under Paddle’s privacy policy. Consent is accordingly not required and no consent mechanism is displayed. Any change to this position will be reflected in this Policy before it is implemented.

6. Retention

7. Security

7.1 The following technical and organisational measures are in place:

• Application-level encryption of report content at rest, independent of disk encryption.
• Transport Layer Security for all connections. The Service will not start without it.
• Passwordless authentication by single-use code, subject to rate limiting and lock-out after repeated failed attempts, so that no password database exists to be compromised.
• A session cookie inaccessible to client-side scripts, and origin verification on every state-changing request.
• Account isolation enforced on the server: every request for report data is scoped to the authenticated account, and no endpoint returns another account’s reports.
• Report sections outside an account’s plan are removed at the time the report is generated, before it is stored, and are therefore never held or transmitted for that account.
• An audit trail of privileged administrative actions and account deletions.

7.2 Because encryption and decryption are performed on our servers, the Controller retains the technical ability to decrypt stored content. The measures above protect against unauthorised access to stored data, including through a compromised database or backup; they do not constitute end-to-end encryption, and this Policy does not represent otherwise.

7.3 In the event of a personal data breach affecting you, we will notify you without undue delay, and in any event within the period required by applicable law.

8. Your rights

8.1 Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy of it. A complete copy — account details, every report with its content, tracked niches and open sessions — can be downloaded from Settings at any time, without contacting us.
• Rectify inaccurate data. The username may be changed in Settings. The email address serves as the account identifier and cannot be changed; a new account may be created and the existing one deleted.
• Erase your data. Any report, or the account in its entirety, may be deleted from Settings without contacting us. Deletion is irreversible, and any unused credits or remaining subscription period are forfeited; this is stated before deletion is confirmed. The free-report record described in section 2.4 is retained for the period stated in section 6; it contains no data from which you can be identified without your email address.
• Restrict or object to processing, and to data portability where applicable. The download in Settings is in JSON, a structured, machine-readable format.
• Withdraw consent, where consent is the legal basis, without affecting the lawfulness of prior processing.
• Lodge a complaint with a supervisory authority: in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu); in the European Union or the United Kingdom, the data protection authority of your place of residence.

8.2 Requests may be sent to the address in section 12 and will be answered within 30 days. We may require verification that a request originates from the email address registered to the account.

9. International transfers

The Service is operated from Türkiye. The recipients listed in section 4 process data in the United States and the European Union under their standard contractual terms, which include the safeguards required for such transfers. The recipients, and the data each receives, are listed in section 4.

10. Age restriction

The Service is intended for persons aged 18 or over, or the age of majority in their place of residence if higher. We do not knowingly collect personal data from persons below that age. If you believe such data has been collected, please contact us and it will be deleted.

11. Amendments

This Policy may be amended from time to time. The effective date at the top of the Policy indicates the current version. Where an amendment materially changes the categories of data collected or the recipients of it, account holders will be notified by email before the amendment takes effect.

12. Contact

Enquiries concerning this Policy or the exercise of your rights may be directed to hello@squsha.com.