Privacy Policy

01Scope and data controller

This notice explains processing of individuals’ data through the Selfmerce website, enquiries, accounts, subscriptions and AI services. The controller is Aragon, whose registered company name, address and tax information appear in the provider and contact section. Selfmerce is the service offered by this business.

Reading this notice does not constitute consent to all processing or marketing. Where explicit consent is required, its purpose and scope are presented separately.

02Contact, account and billing data

Enquiries may involve your name, email, phone and message; account activities may involve user, role, Workspace and company information. Orders and billing involve the billing name or company, address, necessary tax information, plan, period, amount, currency and payment reference.

Account permissions and approval records relate to invitations, membership and transaction verification. Include only information necessary to resolve support requests; do not send card security codes, passwords or unnecessary identity documents.

03Technical data and AI inputs

Security and service operation may involve IP addresses, browser/device details, session events, error records, timestamps and usage amounts. AI tools you enable may process prompts, text, images, selected context, outputs and credit usage records.

Integration scope depends on the accounts you connect and permissions you grant. Avoid unnecessary customer information or sensitive personal data in AI inputs. AI providers’ retention and model-training terms vary by service. You can contact us for information about the data-processing terms of a particular service.

04Collection methods

Data is collected electronically through web forms, account and payment screens, email, support correspondence, cookies, technical logs and integrations connected by users. A Workspace administrator may provide an invited team member’s name and contact details. Processing through these channels is fully or partly automated, or forms part of a data filing system.

05Purposes and legal grounds

Account creation, subscriptions and requested AI operations are assessed under contractual necessity in KVKK Article 5(2)(c). Billing and mandatory records rely on applicable statutory provisions and legal obligations under Articles 5(2)(a) and 5(2)(ç).

Dispute evidence and claims management rely on establishing, exercising or protecting rights under Article 5(2)(e). Proportionate security and abuse prevention may rely on legitimate interests under Article 5(2)(f), provided fundamental rights are protected. Non-essential activities without another legal ground require separate explicit consent under Article 5(1).

06Recipients and sharing purposes

Necessary data may be shared with hosting, infrastructure and security providers to operate the service; communications providers for notifications and support; and enabled AI or integration providers for requested operations. Relevant accounting/legal advisers may receive information for billing or disputes, and competent authorities for lawful requests.

When iyzico payment is selected, iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. may also process necessary information under its own role and privacy notice. Sharing is limited to the relevant purpose.

07International transfers

Using overseas cloud, communications or AI services may transfer personal data abroad. Such transfers must meet applicable conditions under KVKK Article 9, such as an adequacy decision or appropriate safeguards. Where standard contractual clauses are used, the related notification duties must also be fulfilled.

Occasional-transfer exceptions cannot be treated as general permission for ongoing services. Accepting this page alone does not authorise international transfers. You can contact us for information about recipients, destination countries, data categories and applicable transfer mechanisms.

08Store customers’ information

If you are a store customer, the relevant seller will usually be the controller for your shopping activities; consult that seller’s privacy notice too. Activities in which Selfmerce processes data on the seller’s instructions are governed by the processing arrangements with the seller.

Selfmerce’s role for its own account, security or legal-compliance purposes is assessed separately. The presence of store data in Selfmerce tools does not permit its use for every purpose.

09Retention, deletion and security

Account data is retained for the service relationship and related duties; payment/invoice records for statutory retention; support records for resolving requests and protecting relevant rights; and security logs for proportionate security needs. The retention period depends on the data category, processing purpose and applicable legal obligations.

Once processing grounds cease, data is deleted, destroyed or anonymised in accordance with law. Closing an account does not instantly erase all records that must legally be kept. Measures include access permissions, secure communications and record controls; backups and provider copies are also considered in retention and disposal.

10Cookies and marketing choices

The NEXT_LOCALE cookie remembers your selected language and country. Account services may use cookies needed for sessions and security. You can remove or restrict cookies through browser settings, which may affect preferences and session functions.

Non-essential analytics or marketing cookies are subject to separate information about purposes, providers and durations, and the necessary consent or preference mechanisms. Optional promotional-message permission is separate from service notifications. Withdrawing marketing preferences does not stop notifications necessary for contractual or security purposes.

11Your rights under KVKK

Under KVKK Article 11, you can ask whether your data is processed, request information about processing, learn its purpose and whether use matches that purpose, identify domestic or overseas recipients, and request correction of incomplete or inaccurate information.

Where legal conditions are met, you may request deletion or destruction and notification of corrections/deletions to recipients; object to an adverse result arising solely from automated analysis; and seek compensation for damage caused by unlawful processing.

12Applications and complaints

To exercise your rights, email hello@selfmerce.com from your email address registered in our system with the subject “KVKK application”. Written applications can be addressed to the registered company at the postal address in the provider section; other legally valid application methods remain available. Include the particulars required by the applicable Communiqué, such as full name, applicable identification details, address for service, the request and a signature for written applications.

Applications are answered as soon as possible and within 30 days. They are normally free, with fees only where legally permitted. Proportionate identity checks may be necessary. After applying to the controller, if a response is inadequate, rejected or not received in time, you may complain to the Personal Data Protection Board within 30 days of learning the response and, in all cases, within 60 days of the application.

13Updates and contact

This notice is updated when processing activities change; required new information and permissions are presented before the relevant processing. A new version does not automatically expand the scope of earlier consent. Both the Turkish and English versions concern Türkiye. Send privacy questions to hello@selfmerce.com.