Privacy Policy

1. Data Controller

Pasha ("Pasha", "we", "our", or "us") operates the Pasha internet intelligence service and acts as data controller for personal data collected directly through the service. GDPR provisions apply where their territorial scope is met.

Service operator: Pasha

Privacy contact: [email protected]

For privacy inquiries, contact us via LinkedIn or submit a formal request through our Legal Request Form.

2. Legal Basis for Processing (KVKK & GDPR)

We process personal data primarily under Türkiye's Personal Data Protection Law (KVKK - Law No. 6698). The EU General Data Protection Regulation (GDPR) applies only where its territorial-scope requirements are met. Depending on the processing purpose, the legal bases we rely on include:

Contract Performance (KVKK Art. 5/2-c, GDPR Art. 6/1-b): To provide our services and manage your account
Legitimate Interests (KVKK Art. 5/2-f, GDPR Art. 6/1-f): For security, fraud prevention, and service improvement
Explicit Consent (KVKK Art. 5/1, GDPR Art. 6/1-a): For optional analytics and marketing communications
Legal Obligation (KVKK Art. 5/2-ç, GDPR Art. 6/1-c): To comply with obligations that apply to the service operator

3. Information We Collect

Account Information

When you register on our platform, we collect:

Email address (for account verification and communication)
Username (internal identifier for authentication purposes only, not publicly visible)
Password verifier (stored as a one-way bcrypt hash with a unique salt)

Usage Data

When you use our platform, we automatically collect:

Web domain searches and, for eligible Pro API users, domain and IP lookups
Search history and saved searches
API usage and request logs
Access timestamps and authentication-session lifecycle information
Campaign attribution parameters and landing pathname only after analytics consent

Legal Request Information

When you submit a legal request, the form may collect:

Name, email, optional telephone number and country
Organization, registration, address and contact-person details when applicable
Request subject, description, account reference and consent record
Submission IP address, user agent, timestamps and request status history

Technical Data

IP address used to access the platform
Browser type and version
Browser user-agent information, which may describe browser, device and operating system
Sanitized page and API paths, response status, release identifier and browser user agent when operational client telemetry is enabled. Query strings and error stack contents are excluded; its session identifier remains in memory.

4. Cookies and Security Technologies

We use HTTP cookies for authentication and browser storage for consent, interface preferences, short-lived caches and navigation state. Optional analytics loads only after analytics consent. Security flags vary by storage type and environment:

Type	Purpose	Security
Authentication	Session management and user verification	httpOnly and SameSite; Secure on HTTPS
Security	CSRF protection and request validation	Request-bound token and SameSite protections
Preferences	Cookie consent status	Browser local storage; readable by the application

You can manage optional cookies from the .

5. How We Use Your Information

Service Delivery: To provide indexed observation and search results with security intelligence
Account Management: To authenticate users and manage subscriptions
API Access: To track API key usage and enforce rate limits
Security: To detect and prevent abuse, unauthorized access, and fraud
Legal Compliance: To fulfill our obligations under KVKK and other applicable laws

6. Data Sharing and Transfers

We do not sell your personal information. We may share data only in these cases:

With Your Consent: When you explicitly authorize sharing
Legal Requirements: When required by applicable law, court orders or valid legal process
Infrastructure and Security Providers: Providers that support edge delivery, hosting, databases, monitoring and service protection
Email Delivery Providers: Providers that deliver verification, recovery and service messages
Consented Analytics Providers: Google Tag Manager and connected analytics services, only after analytics consent

The current deployment design uses Cloudflare for edge delivery and protection, SMTP2GO for outbound email, and Google Tag Manager with any connected analytics only after consent. The production provider inventory must be kept consistent with this notice whenever a provider is enabled, replaced or removed.

A provider may process data outside Türkiye or, where GDPR applies, outside the EEA. Before enabling such processing, we document the provider, destination, purpose and the applicable transfer mechanism, such as an adequacy decision, appropriate safeguards or a legally permitted derogation. Optional analytics remains disabled until consent.

7. Data Security

We implement technical and organizational measures including:

bcrypt password hashing with unique salts
Short-lived access tokens and rotating refresh tokens in httpOnly cookies
TLS/HTTPS protection for supported network transmissions in production
Rate limiting and brute-force protection
Audit logging and restricted administrative access

8. Data Retention

In accordance with KVKK Article 4 and Article 7, personal data is retained for as long as necessary for the purposes for which it was collected, or as required by applicable law. Retention is based on the record category and configured operational schedule:

Account data: While the account is active, followed by the period required to close the account, resolve disputes or meet a documented legal obligation
Search and API activity: Until account deletion or an approved deletion request, unless a shorter operational schedule is configured or a legal obligation requires retention
Operational client telemetry: Seven days from collection
Legal requests: Through resolution and afterwards only for the period required to document the response, resolve a dispute or meet a legal obligation
Consent records: Until the choice is replaced or no longer needs to be demonstrated, subject to applicable limitation periods
Financial records: For the statutory period applicable to an actual transaction

Note: Data deletion requests are processed through our formal Legal Request Form. A request may require identity verification and may be limited where a documented legal obligation requires specific records to be retained.

9. Your Rights (KVKK Article 11 & GDPR Articles 15-22)

Under KVKK Article 11, you may request:

11/a: Learn whether your personal data is processed
11/b: Request information if your personal data has been processed
11/c: Learn the purpose of processing and whether data is used consistently with that purpose
11/ç: Learn the third parties to whom personal data is transferred in Türkiye or abroad
11/d: Request correction of incomplete or inaccurate personal data
11/e: Request deletion or destruction when the conditions for processing no longer exist
11/f: Request notification of correction, deletion or destruction to third parties to whom data was transferred
11/g: Object to an adverse result arising from analysis exclusively by automated systems
11/ğ: Claim compensation for damage caused by unlawful processing

Where GDPR applies, its separate rights may include access and a copy (Article 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), safeguards relating to automated decisions (22), and withdrawal of consent without affecting processing that was lawful before withdrawal.

To exercise these rights: You may submit a request through our Legal Request Form or use another application method permitted by applicable law and shown in our configured legal-identity details. KVKK applications are answered as soon as possible and no later than 30 days. Where GDPR applies, requests are handled without undue delay and normally within one month; a permitted extension will be explained within that month.

10. Automated Decision-Making

We use automated systems for rate limiting and abuse detection. These decisions may temporarily restrict access but do not produce significant legal effects. You can submit a request for human review through our Legal Request Form.

11. Changes to This Policy

Material changes are published with a new version and effective date. Where consent or another notice is required for a changed purpose, we will request it before applying that purpose. Continued use is not treated as consent where explicit consent is required.

12. Supervisory Authorities & Complaints

If you believe your data protection rights have been violated:

First submit the matter to us through our Legal Request Form
Türkiye: After first applying to the data controller, you may lodge a complaint with the Personal Data Protection Authority if the application is rejected, the response is inadequate or no response is received within 30 days. Statutory complaint periods still apply. www.kvkk.gov.tr
European Union: Lodge a complaint with your local Data Protection Authority (DPA)

13. Contact

For privacy-related questions or to exercise your rights, use our Legal Request Form or the privacy email shown below.

Service operator: Pasha

Privacy contact: [email protected]