Legal
Privacy policy
Last updated:
1. Who we are
Benefity is operated by Alpnet Yazılım Anonim Şirketi, the data controller for your personal data.
- Company
- Alpnet Yazılım Anonim Şirketi
- Address
- Sultan Selim Mah. Hümeyra Sk. Nef 09 Sitesi B Blok No: 7 İç Kapı No: 175, Kağıthane / İstanbul
- MERSİS
- 0058082635500001
- Tax office / no
- Maslak / 0580826355
- Trade registry
- İstanbul Ticaret Odası, sicil no 1153504
- hello@benefity.io
2. What data we process
- Account: Your name, email address and, once verified, the date you verified it, your interface language and password. We never store the password itself, only a one-way hash.
- Store: The name, address and platform access credentials (encrypted) of the store you connect; the SEO fields of your products, categories and blog posts, the drafts we write and the content of Excel files you upload.
- Widgets: The widgets you design and their daily view and click counts.
- Payments: The sender name on your bank transfer notice, the plan you chose and the amount. We don't collect card details.
- Support: The phone number and note you give when you request setup help, and the emails you send us.
- Google: If you select your Google business, the data described under Google reviews below.
- Security and operations: A 15-minute attempt counter per email and IP address for sign-in, sign-up and password resets, to stop password guessing and fake accounts; a robot check on the sign-in and sign-up forms (when the form was opened, and the verification signals Cloudflare Turnstile reads from your browser); email verification (after sign-up we send your address a link valid for 7 days; until the address is verified, AI SEO writing and the Google business search stay off and we send no automated notification emails); server logs for debugging and attack detection (IP address, browser details, request time and URL).
- Email: Delivery, bounce, open and click events for the emails we send; a list of addresses that unsubscribed or bounced (so we don't write to them again).
3. Why we process it
- To provide the service: open your account, connect your store, write SEO text and save it to your store with your approval, show your widgets on your site and count usage against your plan limits.
- To take payments and meet legal record-keeping obligations.
- To keep the service secure: prevent abuse, password guessing, fake accounts and fake views.
- To talk to you: account and payment notices, support and product news. Every newsletter has a one-click unsubscribe link.
Our legal bases under Article 5 of the KVKK are performance of a contract, compliance with legal obligations and our legitimate interest in keeping the service secure.
We collect data electronically, partly by automated means: sign-up and app forms, the APIs of the store platform and Google you connect, Excel files you upload, the widget script on your site, cookies, server logs and emails you send us.
Under Turkish e-commerce law, product news and promotional emails may be sent without prior consent to business customers who use the service for their trade; you can opt out at any time with the link in every email or by writing to us.
4. Google reviews
To show Google reviews in review widgets, you search for your business by name in the app and select it. Your Google account isn't connected and no Google permissions are requested: only information that is public on Google Maps is used.
Data we collect
- When you search: the business name and city you type, and the resulting businesses' name, address, rating and review count. We don't store search results.
- The name, Google ID, average rating, total review count and newest reviews with text of the business you select: reviewer name and profile photo address, rating, review text, date and the owner's reply.
Where it comes from
Searches and reviews are fetched through our data provider Outscraper (USA), which provides public Google Maps data. Only your search text and the selected business's Google ID are sent to Outscraper; nothing about your account, your store or your site's visitors is sent.
How we use it
- We use this data only to show the reviews of the business you select in the review widgets on your own site.
- We never write to Google: we don't reply to reviews or change business information.
- We don't sell review data, use it for advertising, combine it with other sources, use it to train AI models or send it to our AI provider.
Storage and deletion
- We keep the 30 newest reviews with text per business. New reviews are added daily; every 30 days, and when you press "Refresh now" in the app, reviews are fetched again from scratch, so reviews deleted or changed on Google are removed here within 30 days at the latest.
- If reviews can't be refreshed for 30 days, they are deleted and the review widget is hidden on your site.
- When you disconnect from the Store > Google reviews card in the app, delete the store or delete your account, we delete all review data right away.
5. Visitors to sites running our widgets
Widgets run on our customers' sites through the Benefity script (w.js). For visitors to those sites:
- We don't use cookies. We write small entries to the browser's local storage to remember how often a widget may show (e.g. "show once"), countdowns and the install check. On IdeaSoft stores, the free shipping widget also stores the cart total and item count there so it stays up to date across tabs. These entries stay in the browser.
- When counting views we don't store IP addresses or browser details: we derive a one-way hash unique to that day and store. Hashes are deleted within two days; only daily totals remain.
- An email address entered in an email-capture widget is stored for that store together with the page address. The store owner is the controller of this data and we store it only on their behalf; visitors can send related requests to the store.
- In Google review widgets, reviewer profile photos load directly from Google's servers.
For this data the store owner is the controller and we are the processor acting on their behalf. Each party's obligations are set out in the data processing agreement.
8. How long we keep it
- Account, store and widget data: as long as your account is open. When you delete your account under Settings > Delete account in the app, we delete all of it right away; when you ask us by email, within 30 days.
- What remains after deletion: your payment records, as tax and commercial law requires (amount, plan, payment reference, date, sender name, account email address and workspace name), and a record of the deletion (your email address and the date). These are kept for 10 years from the end of the year they were created, then deleted. If you unsubscribed, your email address stays on our suppression list so we never write to you again.
- Google reviews: at most 30 days.
- Visitor counting hashes: at most two days.
- Sign-in attempt counters and expired password reset links: deleted in daily maintenance.
- Server logs: at most 3 months.
- Backups: deleted data stays in backups for at most 14 more days.
9. Security
- All connections use TLS; the database isn't reachable from the internet and its disk is encrypted.
- Store and Google credentials are encrypted again inside the database; your password is stored only as a hash.
- Our support team can open the app as you see it to solve a problem. This access is limited to 2 hours and every action is logged.
10. Your rights
Under Article 11 of the KVKK you have the right to:
- learn whether your personal data is processed;
- request information about it if it is;
- learn the purpose of processing and whether the data is used for that purpose;
- know the third parties in Turkey or abroad it is transferred to;
- ask for it to be corrected if it is incomplete or inaccurate;
- ask for it to be erased or destroyed under the conditions of Article 7 of the KVKK;
- ask that corrections, erasures and destructions be notified to the third parties the data was transferred to;
- object to a result against you that arises solely from automated analysis of your data;
- claim compensation if you suffer damage because of unlawful processing.
If you're in the EU or UK, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection under the GDPR.
You don't need to send a request to delete your account and data: you can do it right away under Settings > Delete account in the app.
Send your request from the email address registered in your account to hello@benefity.io, or in writing to Sultan Selim Mah. Hümeyra Sk. Nef 09 Sitesi B Blok No: 7 İç Kapı No: 175, Kağıthane / İstanbul. We'll handle it free of charge within 30 days; if it involves extra cost, the fee set by the Turkish Data Protection Board may apply. If we reject your request, you find our answer insufficient or we don't answer in time, you can complain to the Turkish Data Protection Board or your local supervisory authority.
11. Changes
When we update this policy, we change the date at the top of this page. We announce significant changes in the app or by email.