Privacy Notice (KVKK)

1. Data controller

Guardbee.ai (“we”, “us”) is the data controller. Contact: privacy@guardbee.ai · Location: Türkiye.

2. Categories of personal data

• Identity / contact: name, email address
• Account: password hash, role, email verification status
• Optional profile: company name, website URL, avatar image
• Technical: IP address, user agent, session identifiers, cookies
• Usage: scan targets, scan results, crawl reports, activity / audit logs
• Communications: messages you send via contact or support channels
• Consent records: cookie preferences, terms acceptance, and scan authorizations

We do not request national ID numbers (TCKN), biometric data, or payment card data through our standard registration or profile forms.

3. Purposes of processing

• Creating and managing your account
• Providing website / AI security scanning, traffic discovery crawls, and related recommendations
• Sending transactional emails (verification, password reset, scan notices)
• Securing the platform (authentication, fraud prevention, audit trails)
• Responding to support and KVKK data-subject requests
• Improving the product based on aggregated usage patterns
• Where you consent: analytics cookies and optional marketing communications

3a. Authorized scanning of targets

We only scan or crawl hosts you submit after you confirm authority. Brand hostnames must match your corporate email domain. Scan/crawl outputs may incidentally include personal data exposed by the target site; we process them to deliver security findings and retain them while your account is active unless you delete them.

4. Legal bases (KVKK Art. 5)

• Performance of a contract — account and scan services
• Legitimate interest — security, abuse prevention, product improvement
• Legal obligation — where applicable
• Explicit consent — non-essential cookies, optional marketing

5. Retention

• Account data: for the life of the account, then deleted or anonymised within a reasonable period after closure
• Scan data: retained while your account is active unless you delete scans
• Logs / security records: typically up to 12 months unless a longer period is required for investigations
• Consent records: retained for the duration needed to demonstrate compliance

6. Recipients / processors

We may share data with processors that help us operate the service, such as:

• Hosting / infrastructure providers
• Transactional email providers (e.g. Resend / SMTP)
• Database and backup services

We do not sell personal data. Transfers outside Türkiye / EEA, if any, are covered by appropriate safeguards with our processors.

7. Your rights (KVKK Art. 11)

You may request to:

• Learn whether your data is processed and obtain information
• Access and request correction of inaccurate data
• Request deletion or destruction within the limits of the law
• Object to processing or request restriction where applicable
• Withdraw consent (without affecting prior lawful processing)
• Lodge a complaint with the Turkish Personal Data Protection Authority (KVKK)

To exercise these rights, use the contact form (select “KVKK / data request”) or email privacy@guardbee.ai. We aim to respond within 30 days.

8. How to reach this notice

This notice is linked from registration, the site footer, and our Privacy Policy. Cookie details are in the Cookie Policy.