Last updated: 7 October 2026
1. Controller
Erkan Ecom LLC (a Delaware limited liability company), Wilmington, Delaware, USA. Email: [email protected]
2. Personal data processed
- Identity and contact: email address; for Google sign-in, the Google account identifier.
- Transaction security: password hash, session data, abuse-prevention records, technical request logs (e.g. IP address).
- Customer transactions: plan, subscription status, Lemon Squeezy customer and subscription numbers, renewal and end dates.
- Business information: website, business name and description, competitors, measurement topics; for sole proprietors this may include personal data.
- Service records: measurement results, the records you enter for actions, and reports.
3. Purposes
- running membership and account operations and authentication;
- providing the measurement service and preparing results, actions and reports;
- running subscription and payment processes through Lemon Squeezy notifications;
- sending account verification, password reset and service-related transactional emails;
- information security, abuse prevention, error detection and backups;
- meeting legal obligations and informing competent authorities.
4. Collection method and legal grounds
Personal data is collected electronically, partly by automated means, through website and application forms, Google sign-in, Lemon Squeezy payment notifications, cookies and server logs. The legal grounds are those in Article 5(2) of the Law:
- (c) necessity for the conclusion or performance of a contract (account, measurement, subscription, transactional emails);
- (ç) compliance with a legal obligation of the controller;
- (e) establishment, exercise or protection of a right;
- (f) legitimate interests of the controller, provided your fundamental rights are not harmed (security, abuse prevention, backups).
5. Transfers, including abroad
Personal data may be transferred, in line with Articles 8 and 9 of the Law and limited to the purposes above, to the following providers and, where legally required, to competent public authorities:
- Railway: application hosting, database and file storage.
- Google Cloud: storage of encrypted backup copies and management of encryption keys.
- Google (Google sign-in): authentication, if you choose this method.
- OpenAI and Google Gemini: asking measurement questions, receiving answers and deriving measurement topics from business information. Business information and measurement questions are sent to these providers; your account email and password are not.
- Lemon Squeezy: payment, subscription, invoicing and tax handling (merchant of record). Card details are entered only at Lemon Squeezy and never reach Dexlera.
- Resend: sending account verification, password reset and service-related transactional emails.
The controller, Erkan Ecom LLC, is established in the USA and the providers' servers may be located abroad, including in the USA; your data is therefore transferred abroad. Transfers abroad rely on the transfer mechanisms set out in Article 9 of the Law.
6. Your rights under Article 11
By applying to the controller, you may:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether data is used accordingly,
- know the third parties in Türkiye or abroad to whom data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction under the conditions of Article 7 of the Law,
- request that correction, deletion or destruction be notified to third parties to whom data was transferred,
- object to a result against you arising exclusively from automated analysis of processed data,
- claim compensation for damage caused by unlawful processing.
7. How to apply
Send your request in writing, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, with enough information to verify your identity and from the email address registered with Dexlera, to [email protected]. Requests are concluded as soon as possible and within 30 days at the latest; if the action involves an extra cost, the fee in the Personal Data Protection Board's tariff may be charged. If your request is refused, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board under Article 14 of the Law.
See also the Privacy Policy and the Cookie Notice.