Privacy Policy

This Privacy Policy explains how BeCited ("BeCited," "we," "us," or "our"), operated by Astro Tasarım Simay Yenice ("Company"), collects, uses, and protects information when you use becited.co and our GEO/SEO visibility measurement service (the "Service"). It is written to satisfy the EU General Data Protection Regulation (GDPR) and, where applicable, Turkey's Law No. 6698 on the Protection of Personal Data (KVKK). A Turkish-language KVKK notice is provided separately at /kvkk; where the two texts differ due to translation, this English Privacy Policy governs except for KVKK-specific rights, which are governed by the Turkish text.

1. Who We Are (Controller)

Astro Tasarım Simay Yenice, registered in Türkiye (full registered address available on request at hello@becited.co), is the data controller responsible for your personal data under GDPR Article 4(7) and the "veri sorumlusu" under KVKK Article 3. For all privacy questions, contact us at hello@becited.co.

If and when we serve users in the EU/EEA on a regular basis, we will appoint an EU representative under GDPR Article 27 and update this notice accordingly.

2. What Information We Collect

We only collect what the Service needs to function. We do not run behavioral advertising trackers and we do not buy or sell personal data.

What we do not collect: we never see or store your card number, CVV, or full payment card details. Card data is handled entirely by Creem, our payment processor and Merchant of Record.

What our measurement queries send: when we run monthly (or on-demand) visibility checks, we send the submitted domain and generic, AI-generated buyer-intent search queries (e.g., "best project management tool for small teams") to our measurement subprocessors. These queries never contain your name, email, or any other contact or account data.

3. Purposes and Legal Bases (GDPR Article 6)

We do not use your report content, domain data, or account information to train third-party AI models beyond what is strictly necessary to generate your own measurement, and we do not use it for advertising.

4. Who We Share Data With (Subprocessors)

We use a small number of vetted subprocessors, each bound by a data processing agreement. We do not sell your data to anyone, and none of these vendors is permitted to use your data for their own advertising purposes. The current, versioned list is also published on its own page at /subprocessors, and our Data Processing Agreement describes the obligations we place on ourselves and on them.

5. International Data Transfers

Because our subprocessors are primarily based in the United States, personal data originating in the EU/EEA, UK, or Turkey is transferred internationally. For EU/EEA and UK transfers, we rely on Standard Contractual Clauses (SCCs) with our subprocessors and, where available, adequacy mechanisms; we review this list as vendors update their own compliance frameworks. For transfers governed by KVKK, we rely on the explicit consent or the statutory transfer mechanisms available under KVKK Article 9 (as amended), including standard contractual undertakings, pending guidance from the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

6. Data Retention

• Account data: kept for as long as your account is active, plus a limited period after closure for legal/accounting purposes (typically up to the statutory retention period applicable in Turkey, generally up to 10 years for financial records under Turkish Commercial Code and tax law).
• Report and measurement data: kept while your account is active so you can review historical trends; deleted or anonymized after account deletion.
• Google Search Console tokens: deleted immediately if you disconnect the integration, and automatically invalidated if not refreshed.
• Marketing consent records: kept until you withdraw consent, plus a short evidentiary period.
• Error/technical logs: retained by Sentry per our configured retention window, typically 90 days, then purged.

7. Your Rights

Under GDPR (Articles 15-22) and KVKK (Article 11), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure ("right to be forgotten")
• Restrict or object to processing
• Data portability (receive your data in a structured, machine-readable format)
• Withdraw consent at any time, without affecting prior lawful processing
• Lodge a complaint with a supervisory authority (in the EU, your local Data Protection Authority; in Turkey, the Kişisel Verileri Koruma Kurumu)

To exercise any of these rights, email hello@becited.co. We will respond within one month under GDPR, and within the 30-day period required under KVKK Article 13. Upon a verified deletion request, we permanently delete your personal data within 30 days, except where retention is required by law (e.g., billing records).

8. Cookies

We use only strictly necessary, session-based cookies to keep you signed in and to remember your session state. We do not use third-party advertising cookies or cross-site tracking pixels. Because these cookies are essential to the Service, they do not require separate consent under applicable e-Privacy rules, but we disclose them here for transparency. See our Cookie Policy for the full list.

9. Marketing Communications

We only send product updates or marketing email if you separately and affirmatively opt in at sign-up or later in your account settings. This consent is never pre-checked. You can withdraw it at any time via the unsubscribe link in any marketing email or by writing to hello@becited.co, without affecting your ability to use the Service or receive transactional emails necessary to operate your account.

10. Children

The Service is not directed to individuals under 18, and we do not knowingly collect data from them.

11. Changes to This Policy

We will post material changes to this page and update the effective date above. Where required by law, we will notify you by email.

12. Contact

Questions, requests, or complaints: hello@becited.co