Privacy Policy

Introduction

Zeisoft Yazılım Limited Şirketi ("HeyMetra," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use HeyMetra, our no-code AI data agent, and visit our website.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). Please read this policy carefully. If you do not agree with it, please do not use our services.

How HeyMetra Works

HeyMetra lets you connect your third-party marketing and analytics accounts and then answers questions about that data in plain language. With your explicit, in-app approval, HeyMetra can also take actions in those connected tools on your behalf. Understanding this flow is important context for the data practices described below.

Information We Collect

Account Information

Information you provide when you create and manage your account and workspace, including:

• Email address, name, and contact details
• Account credentials (passwords are stored only as salted hashes)
• Workspace and team member information
• Billing details and subscription status (payment card data is handled by DodoPayments, not by us)

Connected-Tool Data

When you connect a third-party account through secure OAuth, HeyMetra accesses data from that tool so it can answer your questions and carry out actions you approve. Depending on the integration, this may include:

• Advertising performance and account data from ad platforms you connect
• Website and traffic analytics from analytics tools you connect
• Order, subscription and customer data from ecommerce, revenue and CRM tools you connect

The current list of available integrations, and which are still launching, is on our integrations page. We only access an integration you have connected.

We access this data using the scopes you authorize during the OAuth flow. We never receive your third-party passwords — connections are managed through a dedicated connector infrastructure provider, using access tokens you can revoke at any time.

Usage and Technical Information

When you use HeyMetra, we automatically record limited information such as:

• Questions you ask and actions you approve, so we can operate and support the service
• IP address and general location
• Browser type, device information, and operating system
• Product usage and diagnostic logs

How We Use Your Information

We use the information we collect to:

• Answer your questions using data from your connected tools
• Carry out actions in connected tools that you have explicitly approved in the app
• Provide, operate, maintain, and secure the service
• Process transactions and manage your subscription
• Send technical notices, updates, and support messages
• Respond to your questions and support requests
• Comply with legal obligations and protect our rights

We do not sell your personal data, and we do not use your data or your connected-tool data to train AI models.

The Approval Gate

HeyMetra reads your connected-tool data to answer questions freely. However, it will only make changes in your connected tools — such as adjusting a campaign — after you explicitly approve that specific action in the app. Nothing is written back to a connected tool without your in-app confirmation.

Sub-Processors

We do not sell, trade, or rent your personal information. We share data only with trusted service providers ("sub-processors") who help us operate the service, under contracts that require them to protect it:

• A large language model routing provider and the LLM providers it routes to — processing your questions and connected-tool context to generate answers. Providers are contractually bound not to train on this data. We will name the current providers on request.
• A connector infrastructure provider — secure OAuth connection and access-token management for your integrations
• DodoPayments — payment processing and subscription management
• Cloud hosting providers — infrastructure and data storage
• An email delivery provider — transactional and support email

Legal Requirements

We may disclose your information if required by law or in response to valid legal requests.

Cookies and Analytics

The marketing site uses essential cookies and, only after you consent, analytics and advertising measurement. We use Google Analytics and Google Ads measurement loaded through Google Consent Mode, which stays disabled until you accept. Ad measurement tells us which campaign a visit came from and whether it led to a sign-up; it is not used to build a profile of you for other advertisers, and we do not sell your data. See our Cookie Policy for the individual cookies and how to change your choice.

Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, isolated multi-tenant workspaces, and revocable OAuth tokens. No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard practices.

Data Retention

We retain personal information only for as long as necessary to provide the service and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. When you disconnect an integration, the associated access tokens are revoked. When you close your account, we delete or anonymize your personal data after a reasonable period.

Your Rights

Under GDPR, KVKK, and other applicable laws, you may have the following rights regarding your personal data:

• Access — request a copy of your personal information
• Rectification — request correction of inaccurate information
• Erasure — request deletion of your personal information
• Portability — request transfer of your information
• Restriction and objection — limit or object to certain processing
• Withdraw consent — where processing is based on consent

To exercise these rights, contact our data protection contact at [email protected]. You also have the right to lodge a complaint with your local supervisory authority (in Türkiye, the KVKK Authority).

International Data Transfers

We and our sub-processors may process your information on servers located outside your country, including outside the European Economic Area and Türkiye. Where we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses. By using our services, you acknowledge these transfers.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date. We encourage you to review it periodically.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Zeisoft Yazılım Limited Şirketi
Email: [email protected]