KVKK privacy notice and privacy policy

1. Data controller

Notussoft Bilgi Teknolojileri Ltd. Şti. ("Notussoft") is established at Güzelyalı Yalı Mah. Yunusemre Sok. No: 6/1, Mudanya / Bursa, Türkiye; for any request or question about your personal data, you can reach us at info@notussoft.com.

2. Scope and roles

Where we are the data controller: Notussoft is the data controller for website visitors, waitlist participants, account holders and platform administrators.

Where we are the data processor: For customer and contact data that our customers enter into NotusCRM or sync from the email and calendar accounts they connect, the data controller is the respective customer (the user's company); Notussoft acts as a data processor that processes this data only on the customer's behalf and instructions.

3. Personal data processed

Waitlist: email address, full name, company name, optional message, form language and submission time.

Account information: name, email address, profile photo and language preference. When signing in with Google (OAuth), only the name, email and profile photo are obtained from Google.

Security and usage records: IP address, browser information, session records and an audit trail of changes within the account (audit log).

Connected email and calendar accounts: connection parameters, credentials and OAuth access/refresh tokens of connected accounts are stored encrypted with strong algorithms in a separate authentication service isolated from the application database, and are never written directly to the CRM operational database. Email addresses and sender names of potential contacts not yet in the CRM are processed transiently to offer the user a suggestion to create the contact ("Incoming suggestions"); for messages matching known contacts, the subject, date, participants and CRM-relevant summary/text excerpts, and for events the title, time and participants, are recorded in the CRM. Email attachments are not imported.

Mobile app notifications: if notifications are turned on in the mobile app, the device's notification address (push token), operating system type (iOS/Android), app language, the number of unread notifications and the workspace name shown in the notification title.

4. Purposes and legal grounds

Your personal data is processed for the purposes below, based on the legal grounds set out in KVKK Articles 5 and 9:

Evaluating waitlist applications and informing you of the product launch (KVKK Art. 5/2-c: directly related to the establishment of a contract, and Art. 5/2-f: legitimate interest).

Providing the NotusCRM service, managing the account and providing technical support (KVKK Art. 5/2-c).

Running the AI summary feature once the customer (the data controller) has turned it on in its workspace, for users' individual summary requests and for summarising synced email conversations and enriching contact suggestions. The related transfer to the sub-processor is based on the customer's instruction (details in section 6; no transfer takes place while the feature is off).

Delivering mobile push notifications and updating the unread notification count on the app icon (KVKK Art. 5/2-c).

Ensuring service security, preventing abuse and keeping audit records (KVKK Art. 5/2-f: legitimate interest).

Running information security processes and fulfilling legal obligations (KVKK Art. 5/2-ç: legal obligation of the data controller).

Where communication permission has been given, sending product updates, announcements and information (KVKK Art. 5/1: explicit consent / commercial electronic message legislation).

5. Transfers

Your personal data is hosted in Türkiye on Notussoft's own servers. To secure the infrastructure, manage encrypted tunnel connections and forward requests, the Cloudflare (a US-based infrastructure provider) tunnel/CDN layer is used as a data processor; network traffic, IP addresses and form contents technically pass through this infrastructure.

Your personal data is not transferred abroad for any other purpose, except for the AI summary described below (once the feature is active) and mobile push notifications.

Information obtained through Google sign-in (OAuth) is used only for authentication and account creation; it is not used for advertising and is not shared with third parties. The use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Use of Google API data and its limits: with the user's explicit authorisation, NotusCRM accesses through Google APIs only calendar data (calendar.events.owned.readonly) and the Gmail sending service (gmail.send) so that the user can send email from the CRM.

Google Calendar: the title, time, participants and meeting link of events are read and matched with the related person records in the CRM.

Sending email via Gmail: emails the user composes in the CRM are sent through the user's own Gmail account; messages in the inbox are not read through Google APIs.

No model training: data obtained from Google APIs is never used to train artificial intelligence or machine learning models.

Limited Use: the use of Google user data and its transfer to other applications fully complies with the Google API Services User Data Policy, including the Limited Use requirements.

Use of Microsoft 365 / Graph API data: if the user connects a Microsoft account, the Microsoft Graph API is used for emails (Mail.Read) — the last 30 days when connecting and new incoming and sent emails afterwards — calendar events (Calendars.Read) and sending email on the user's behalf (Mail.Send). The subject, date, participants and up to 4,000 characters of the body of emails, and the meeting information of known people, are processed in the CRM. This data is not used for advertising targeting and is not sold to third parties.

Mobile push notifications: notifications are delivered through the notification infrastructure of mobile operating systems: Google LLC (Firebase Cloud Messaging – USA/Ireland) and, on iOS devices, also Apple Inc. (Apple Push Notification service – USA). Only the device's notification address, the workspace name in the notification title, a general text such as "You have a new notification", technical identifiers to open the related record and the unread notification count are transferred to these providers; record content and the names of people and deals are not sent. These providers act as sub-processors. You can turn notifications off at any time in your device's operating system settings or in your NotusCRM notification preferences.

Apart from the above, your personal data is transferred only to legally authorized public institutions and organizations upon request.

6. AI summaries and transfer to a sub-processor

Optional use: AI features in NotusCRM are off by default and work only once an authorised person of the workspace turns them on. While on, they work in two ways: (i) when a user gives the "Summarize with AI" command on a record, that record is summarised; (ii) conversation threads that reach a certain volume in synced email traffic are summarised automatically and job title suggestions are extracted from people's signatures. In both cases the output is only a suggestion and is not written to a CRM record unless the user approves it. While the feature is off, no data is sent to the AI infrastructure.

Data transferred and data minimisation: When a summary is requested, only the text of the relevant record and the deal's summary activity information are transferred abroad. In workspaces where AI features are enabled, in addition to users' individual summary requests, the relevant record excerpts are also sent, masked, to the AI infrastructure to summarise conversation threads that reach a certain volume in synced email traffic and to detect job titles from people's signatures. Before sending, our system automatically masks email addresses and phone numbers. Passwords, attached files and the rest of the CRM database are never transferred.

Sub-processor: Under this feature, data is transferred to our AI infrastructure provider Anthropic PBC (USA) in its capacity as a technical sub-processor.

Purpose of use and security commitment: Transferred data is processed only to generate the summary or the job title suggestion. Under Anthropic's API policies and the agreements made with Notussoft, the data is never used to train large language models. Generated summaries are not saved to the CRM database unless the user approves them.

Retention: As a rule, inputs and outputs are deleted at the provider within 30 days at the latest (immediately after processing once a zero data retention / ZDR arrangement is in place); only limited security logs may be kept temporarily for legal requirements and usage policy violation reviews.

7. Retention

Waitlist: data of people who join the waitlist is kept for no longer than 30 days from the date they signed up. Data of people who are invited and create a NotusCRM account within this period continues to be kept as part of the account and CRM relationship; waitlist applications that are not invited or not converted into an account within 30 days are automatically deleted from the system.

CRM data and logs: deleted CRM records remain recoverable in the system for 30 days and are then permanently deleted. Security audit records (audit log) are kept for 90 days. Email/calendar sync records and webhook delivery logs are kept for 30 days and automation run history for 90 days, and they are deleted automatically when that period ends.

Email connections: when an email or calendar account is disconnected, the authentication keys are deleted immediately and permanently. Existing synced CRM activities are kept unless deleted by a user or the workspace administrator, or until the workspace is closed; when disconnecting, you can choose to delete the records synced from that account as well.

8. Cookies

The notuscrm.com website does not use marketing or analytics cookies. The NotusCRM web application uses only strictly necessary cookies to maintain your session security and language preference.

9. Your rights under KVKK Art. 11

As a data subject, you have the following rights under Article 11 of KVKK:

to learn whether your personal data is processed,

to request information about it if it has been processed,

to learn the purpose of processing and whether it is used in line with that purpose,

to know the third parties in Türkiye or abroad to whom your personal data is transferred,

to request correction of incomplete or inaccurate data and notification of this to third parties to whom the data was transferred,

to request deletion or destruction of your data where the reasons requiring its processing no longer exist, even though it was processed in accordance with KVKK and other applicable laws,

to object to a result against you arising from the analysis of processed data exclusively by automated systems,

to claim compensation for damages if you suffer loss due to unlawful processing of your personal data.

10. How to apply

You may submit requests to exercise the rights above in writing, in person at Güzelyalı Yalı Mah. Yunusemre Sok. No: 6/1, Mudanya / Bursa, Türkiye, through a notary, or to info@notussoft.com with a secure electronic signature or from the email address registered in our system. Requests are resolved free of charge within the legal period of 30 days at the latest.