Privacy Policy

1. Data we collect

• Account data — your name, email address, and authentication details (including data from Google sign-in if you choose it).
• Usage data — scans you run, locations and keywords you enter, settings, and product activity used to operate and improve the Service.
• Payment data — processed by Paddle, our merchant of record. We receive transaction metadata (e.g. plan, amount, status) but do not store your full card details.
• Connected Google Business Profile data — when you connect a Google account, we access only the profile, reviews, and performance data you authorize, to display it back to you. OAuth tokens are stored encrypted.

2. How we use your data

• to provide, maintain, and secure the Service;
• to process payments and prevent fraud;
• to respond to support requests and communicate service updates;
• to analyze and improve product performance and reliability;
• to comply with legal obligations.

3. Service providers

We share data only with providers that help us run the Service, under appropriate safeguards:

• Supabase — database, authentication, and storage.
• Vercel — application hosting.
• Paddle — payments and tax as merchant of record.
• Google — Maps and Business Profile APIs for the data you request.
• DataForSEO — search ranking data used to build heatmaps.
• Resend — transactional email delivery.
• Sentry — error monitoring to keep the Service reliable.

We do not sell your personal data.

4. Cookies

We use strictly necessary cookies to keep you signed in and to operate the Service. We do not use advertising cookies. You can control cookies through your browser, though disabling essential cookies may break core functionality.

5. Data retention

We keep your data for as long as your account is active and as needed to provide the Service or comply with legal obligations. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where retention is legally required.

6. Your rights

Depending on your location (including under the GDPR and Türkiye's KVKK), you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to withdraw consent. To exercise these rights, email melih@zuhya.com.

7. Security

We use industry-standard measures including encryption in transit, encrypted storage of sensitive tokens, and access controls. No method of transmission or storage is fully secure, so we cannot guarantee absolute security.

8. Children

The Service is not directed to children under 18, and we do not knowingly collect their data.

9. Changes

We may update this Policy from time to time. Changes take effect when posted, indicated by the "Last updated" date above.

10. Contact

For privacy questions or requests, contact us at melih@zuhya.com or via our contact page.