Privacy Policy

1. Scope

This policy covers the LenaRiseOS platform operated by LenaRise, the marketing site, and the services attached to them. Its purpose is to explain in plain language what we collect and what we do with it.

The formal disclosure obligation under the KVKK is met by a separate notice. If the two texts conflict, the KVKK Privacy Notice prevails — this policy does not replace it, it makes it easier to read.

2. What we collect

Data reaches us in three ways:

• What you give us: first and last name, work email, phone, your brand website, billing details, the images and text you upload, brand rules and no-gos.
• What use creates: session and sign-in records, IP address, device and browser information, which modules you use, your approval and rejection decisions, API key calls, audit trail entries.
• What comes from third parties: profile information and performance metrics from the social accounts you connect; the transaction result and identifiers such as the last four digits of the card from the payment institution.

Card numbers, expiry dates and security codes are never stored in our systems at any stage.

3. Why we use it

• To provide the service: run your account, build your brand memory, let the modules produce output, publish the content you approve.
• To take payment: manage subscription and trial records and issue invoices.
• For security: detect unauthorised access and abuse, and keep an audit trail of account operations.
• For support: answer your questions and investigate fault reports.
• For improvement: debug faults and produce aggregate usage statistics.
• For communication: send mandatory service notices. Marketing messages are sent only if you separately opt in, and every message carries an unsubscribe link.

4. Cookies and similar technologies

Strictly necessary cookies keep your session open, remember your language preference and run basic security checks; the platform does not work without them and they cannot be switched off.

Analytics and marketing cookies run only if you allow them. A detailed list of the cookies used and their lifetimes: [to be completed]. You can also manage your preference from your browser settings; blocking strictly necessary cookies will end your session.

5. Artificial intelligence, brand memory and model training

Brand memory is the core of LenaRiseOS: your brand voice, palette, personas and no-gos are learned once and used across every module. The approvals and corrections you give feed that memory, which means the system improves specifically for YOU.

To generate content, your prompts and brand context are sent to third-party artificial intelligence model providers. As a matter of principle we obtain a contractual undertaking from these providers that the content sent will not be used to train their general-purpose models. The current list of providers and the scope of the arrangement with each: [to be completed].

Your brand memory belongs to your account and is never used to feed the output of other customers.

6. Who we share it with

We do not sell your data. We share it only with the providers needed to deliver the service and, where legally required, with competent authorities. The categories of provider and the legal basis for each transfer are listed in §5 of the KVKK Privacy Notice.

Every provider is bound by a contract requiring them to process the data only on our instructions and to apply appropriate security measures.

7. Where the data is held

Your account and brand data is hosted in Türkiye as a rule. Because some providers are located abroad, transfers outside Türkiye are made where necessary under KVKK Article 9 and with appropriate safeguards.

8. Retention, deletion and export

We retain your data for as long as your account is open and for the limitation periods required by law. The periods are listed in §7 of the KVKK Privacy Notice.

You can download a full copy of your data from the panel at any time (Profile → Security → KVKK) and request the deletion of your account from the same place. Deletion cannot be undone, which is why it asks for a two-step confirmation and is processed within the reasonable period the law allows. Invoicing and accounting records that must be kept by law are preserved for their statutory period even after the account is deleted.

9. Security

• All traffic is encrypted with TLS; unencrypted connections are refused.
• Passwords are stored using irreversible hashing — plain-text passwords are never kept anywhere.
• Sessions are managed with time-limited cookies and can be ended individually from the panel.
• API keys are shown in full only at the moment they are created.
• Account, password, session, key and KVKK operations are written to the audit trail.
• Access is limited to the narrowest permission the task requires.

No system can offer absolute security. If you notice a vulnerability, please report it to [email protected] and refrain from disclosing it publicly until we have reviewed it. If a breach affecting your personal data occurs, both the Board and you are notified within the period required by law.

10. Children's data

LenaRiseOS is a business product and is not directed at anyone under 18. We do not knowingly collect data from children; if we discover such a record we delete it.

11. Your rights and contact

Your rights to access, correct and erase your data and to object to its processing, together with the ways to exercise them, are set out in §8 and §9 of the KVKK Privacy Notice. For any question you can write to [email protected].

12. Changes to this policy

This policy may be updated; the current version is always published at this address. Material changes are notified by email before they take effect.