Privacy Policy

1. Who we are

Zeisoft Yazılım Limited Şirketi, Atatürk Mh. 2190 Sk. No:2A, Urla, İzmir, Türkiye, is the controller. MERSİS: 0997199821900001. Contact: hello@heymetra.com. This policy also serves as the information notice required by Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK).

2. Scope

This policy covers visitors to heymetra.com and app.heymetra.com and HeyMetra account holders. Data from your connected accounts is not kept on HeyMetra's servers and is not processed by HeyMetra; see the Data Transfer and Responsibility Notice.

3. What we process, why, and on what legal basis

Account and authentication

Name, email, password hash, workspace and team details, session and authorization records. Purpose: to create your account and handle sign-in and permissions. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Security

IP address, device and browser details, sign-in attempts, activity logs and error logs. Purpose: to prevent abuse, unauthorized access and fraud, and to fix errors. Legal basis: legitimate interests and legal obligations (GDPR Art. 6(1)(c), (f); KVKK Art. 5(2)(ç), (f)).

Billing

Billing details, plan and payment status. Card details are handled by our payment provider, not by us. Purpose: charging, invoicing and tax compliance. Legal basis: contract and legal obligation.

Analytics and heatmaps

Pages viewed, clicks, scrolling and mouse movement, session length, approximate location (country or city), device details and, where enabled, session recordings. Purpose: to improve the site and the product. Legal basis: our legitimate interest in understanding how the site is used and, where the law requires it, your consent (GDPR Art. 6(1)(a), (f); ePrivacy rules; KVKK Art. 5(1)). You can turn these tools off at any time in the cookie banner.

Ad measurement

Which ad brought you to us, ad click identifiers (such as gclid and fbclid), and conversion events such as sign-ups and purchases. Purpose: to measure ad performance and manage campaigns. Legal basis: as for analytics. You can turn ad measurement off separately in the cookie banner, and it starts switched off if your browser sends a Global Privacy Control signal.

Email marketing

Email address, name, and whether emails are opened or clicked. Purpose: product news and offers. Legal basis: consent (GDPR Art. 6(1)(a); Turkish Law No. 6563 and the Message Management System, İYS; U.S. CAN-SPAM; Canada's CASL). Every marketing email has a one-click unsubscribe link. Service messages about security, billing or changes to the service are not marketing and are sent regardless of this consent.

Support

Messages and feedback you send us. Purpose: to respond to you. Legal basis: contract and legitimate interests.

4. Cookies and similar technologies

Strictly necessary cookies (session, security and your cookie choice) always run. Analytics and advertising tools run unless you turn them off: Google Tag Manager, Google Analytics 4, Google Ads, Meta Pixel, Reddit Pixel, and PostHog (analytics, heatmaps, session recording). You can turn analytics and advertising off separately, at any time, from the cookie banner or the Cookie Policy page. If your browser sends a Global Privacy Control (GPC) signal, ad tracking starts switched off for you.

5. Who we share data with

We share data only with service providers we need to run HeyMetra, under contract and confidentiality obligations:

• Cloudflare, Inc.: content delivery and security
• Dodo Payments: payments and billing, as merchant of record
• Google LLC: analytics and advertising
• Meta Platforms Ireland Ltd.: ad measurement
• Reddit, Inc.: ad measurement
• PostHog, Inc.: product analytics
• A cloud hosting provider: servers and data storage, in the European Union (Finland)
• An email delivery provider: account and service email

We also disclose data to public authorities when the law requires it. We do not sell your personal data.

6. International transfers

Some of our providers are located outside Türkiye and the EU, mainly in the United States. For data from the EU/EEA and the UK we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, or the EU-U.S. Data Privacy Framework. For data from Türkiye we rely on the standard contracts published by the Personal Data Protection Board under KVKK Art. 9, with the required notifications, or on your explicit consent.

7. How long we keep data

We keep account data while your account is open and afterwards for the applicable limitation period (up to 10 years). We keep billing records for 10 years, as Turkish tax and commercial law requires. We keep security and activity logs while your account is open and erase them within 30 days of its deletion, analytics data for up to 14 months, ad click identifiers for 90 days, and marketing consent records for 3 years after consent is withdrawn. When a period ends, we delete, destroy or anonymize the data. How account deletion works step by step is on the Data Protection & Deletion page.

8. Your rights

Depending on where you are, you have the following rights.

Türkiye (KVKK Art. 11)

To learn whether your data is processed and to request information about it, to learn its purpose and whether it is used accordingly, to know who receives it in Türkiye or abroad, to have it corrected, deleted or destroyed, to have those changes notified to recipients, to object to an adverse result produced solely by automated analysis, and to claim compensation for damage. Requests are answered free of charge within 30 days. You may also complain to the Personal Data Protection Board.

EU/EEA and UK (GDPR, UK GDPR)

Access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests and to direct marketing, withdrawal of consent at any time, and the right to complain to your local supervisory authority (the ICO in the UK).

United States

Under California's CCPA/CPRA and the laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states: the right to know what we collect, and to access, correct and delete it; the right to opt out of the sale of personal data and of sharing it for targeted advertising; the right to limit the use of sensitive data; and the right not to be discriminated against for exercising these rights. We do not sell personal data. Ad measurement may count as "sharing" under these laws, and you can opt out through your cookie settings or a GPC signal. If we deny a request, you can appeal.

Other countries

Including Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act and Switzerland's FADP: the rights your local law provides.

To make a request, email hello@heymetra.com. We may ask for information to verify your identity. You may also use an authorized agent.

9. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

10. Children

HeyMetra is built for businesses. It is not designed for anyone under 18, and we do not knowingly collect data from children.

11. Security

We protect data with technical and organizational measures, including encryption in transit (TLS) and at rest, access controls, logging and least-privilege access. If a personal data breach occurs, we notify the relevant authorities and affected individuals as the law requires: within 72 hours under the GDPR and KVKK, and within the time limits set by other applicable laws.

12. Changes

When this policy is updated, the date above changes. We announce material changes by email or in the app.