Privacy policy

2. Who holds your data

The data controller is the company named above. It decides what is collected and why, and it is the address for any request under this policy.

For work a customer runs inside their own workspace, the customer is the controller of the data they bring, and GOCUX processes it on their instructions.

3. Scope

This policy covers gocux.com and the GOCUX workspace. It does not cover a site reached by following a link out of either, or a system a customer connects their own credentials to.

4. What is held

Account data: the identity your provider asserts when you sign in — name, work email, and which company you belong to. No password is received or stored.

Work data: what is asked for, what ran, what was decided and by whom, and what was produced. This is the audit record, and it is the product rather than a by-product of it.

Billing data: what was bought and when. Card details are never received — they are held by Paddle, which processes the payment.

Connected credentials: held as server-side references. They are not placed in a browser and are not readable from another company's boundary.

Site measurement: aggregate page views on the public pages, with no cookie and no cross-site identifier. Nothing there identifies a person.

5. Why it is held

To provide the service under the contract you have with us: running work, enforcing approvals, and producing the record of both.

To meet legal obligations, including keeping accounting and tax records for the periods Turkish law requires.

For legitimate interests that do not override your rights: keeping the service secure, preventing abuse, and understanding in aggregate how the public pages are used.

6. Who else processes it

The processors below act on this company's instructions and for no other purpose. Where processing happens outside Türkiye, it is carried out under the safeguards KVKK requires for transfer abroad.

• Paddle.com Market LtdPayment processing and invoicingUnited Kingdom / EU
• ResendTransactional emailEU
• Plausible AnalyticsAggregate site measurementEU
• Hetzner Online GmbHHosting and storageGermany
• Model providersRunning the models a work order usesUnited States / EU

7. How long

Account data is held for as long as the account exists, and for six months after it closes so that a reopened account is not a lost history.

Work and audit records are held for as long as the account exists. An audit trail that can be quietly shortened is not one, so deletion of individual records is not offered while the account is open; the whole workspace can be deleted on request.

Billing records are held for ten years, which is the period Turkish commercial and tax law requires.

Site measurement is aggregate and is not tied to a person, so there is nothing in it to retain against one.

8. Your rights

Under KVKK Article 11 you may ask whether your data is processed, what is held and why, who it has been shared with including abroad, and to have it corrected, deleted or destroyed. You may object to a result produced solely by automated analysis, and claim compensation for damage caused by unlawful processing.

Write to the address above. A response is given within thirty days at the latest, and normally much sooner. If the answer does not satisfy you, you may complain to the Personal Data Protection Authority (KVKK Kurumu).

9. Contact