Protecting personal data

Data processed

Source	Personal data
Order transfer	The customer’s email address, the customer ID in your system, the order number, the products bought. Until invitations by WhatsApp arrive with v2, the phone number is not stored. When the review writing period ends, the email address, phone and customer number are turned into pseudonyms (see Retention periods).
Review	The author’s name, email address, review text, photos and videos
Invitation and send records	The recipient’s email address, the result of the send. After the retention period the recipient address is no longer shown.
List of people who do not want emails	Only a hash of the address; the address itself is not stored. Phone numbers are stored with a keyed hash so they cannot be recovered by guessing. The list is also exported to the brand as hash values.
Panel	Users’ names, email addresses and login times
Action and access records	The user who acted, the action, the request ID, a keyed hash of the IP address and browser details; the IP address itself is not stored

Sayproof does not set cookies on the store page and does not track visitors. Product view counting is anonymous: no person, cookie, IP address or browser information is stored; only a daily counter per product is incremented.

When a visitor answers “Helpful?” below a review with “Yes” or “No”, or reports a review, the script stores two values in the browser’s localStorage: a randomly generated visitor key (sayproof-visitor) and the votes the visitor has cast (sayproof-votes). These values are used so that the same visitor’s vote is counted only once and the buttons are shown in the correct state; they are not matched to any person. If the visitor does not vote or report, no value is stored.

Where it is stored

Each brand is assigned to a data region, and its data is stored on servers in that region:

Region	Time zone
Türkiye	Istanbul
European Union	Brussels

Invitation sending hours are applied in the region’s time zone. An installation in one region does not accept a brand from another region, and no data is transferred between regions. A brand that wants to operate in both regions is set up separately in each region.

Protection methods

• Logs: Email addresses are written as a hash and telephone numbers are masked; key, password, signature, email and phone values in addresses are recorded as [redacted]. Review text is not written to logs. No request bodies, cookies or user details are sent to the error tracking service. Access codes in the address path (unsubscribe, share and feed links) are also written as [redacted]. The server’s access log contains no IP address, browser details or query string. Query strings and access codes in paths are removed from what is sent to the error tracking service.
• Photos and videos: Every file goes through a security scan before it is saved; files found to be harmful are quarantined and are not published. Photos are re-encoded, and location, device and other metadata is removed. The metadata and audio track of videos are removed. Files are not at a public address until the review is published; the files of a hidden, rejected or removed review leave the public address and are shown only in the panel to a signed-in user. The photos and videos of a review removed with the reason “The customer’s own request” or “Court or official order” are deleted permanently. The raw uploaded file is kept only during processing, in an area closed to the public, and is deleted once processed. Photos and videos are prepared in the customer’s browser before they are uploaded: a photo is re-encoded there, which removes the location and device information it carries before the file leaves the device, and a video is converted without its sound and location tags. If the browser cannot do this, the original file is uploaded and the same removal is applied on the server. A brand can remove a single photo or video of a review from the panel, with a reason, without removing the review; the file is deleted permanently from both the public and the closed area, and the removal is written to the review’s history and to the Activity history.
• Panel sign-in: Passwords are at least 12 characters; common passwords (Turkish ones included), guessable ones (a word, team or name with a year or a run of digits) and passwords that contain Sayproof, the brand’s name or the username are refused. Users can turn on two-step sign-in for their own account; signing in to the Sayproof team’s management screen always takes two steps. Password links go only to the account owner’s email address and are never shown to the person who asked; a new-account link is valid for 3 days, a reset link for 1 hour. Only users themselves can change their email address, with their current password; an administrator cannot change someone else’s. When a password or an email address changes, the account’s address gets a notice, and if the address changed, both the old and the new one do.
• Secret values and login details: Only a hash of server keys is stored; the login details of product sources and order connections are stored encrypted.
• Access: Each brand can only access its own data; a user belongs to exactly one brand, and on every table that holds brand data the database returns no records outside the brand the request is bound to. Panel roles are limited according to the work performed; for details, see Users and roles. Every action in the panel is recorded in a way that cannot be deleted; the record carries the request ID, a keyed hash of the IP address and browser details. Every read that shows customers’ personal data is written, with who saw how many records, when and through which route, to the Activity history › Personal data access tab in a way that cannot be deleted; reads by server keys, a Sayproof support session and the Sayproof team are recorded too. The Sayproof team reaches a brand’s data only through a support session limited to one hour that it opens with a written reason; the start of the session with its reason and the actions in it are written to the Activity history (Sayproof team support access).
• Monitoring: One person viewing many personal data records in an hour, unusually many exports in a brand in one day, a new administrator added to the Sayproof team and repeated failed sign-ins with usernames that belong to no brand reach the Sayproof team as alerts.
• Reviews imported from marketplaces: If a brand imports reviews from a marketplace (Trendyol, Hepsiburada, Amazon, N11, Çiçeksepeti), only reviews from customers who bought from the brand’s own store and whom the marketplace marks as buyers are taken. The author’s name is shortened as soon as it is read, to the first letter of each word and ***; the full name, email address, phone number and address are not stored. An uploaded file is turned into shortened rows and kept only while it is processed. The review’s text, rating, date, marketplace review number and any photos are stored; photos go through the virus scan and the removal of location and metadata like other review photos. Because the email address of an imported review is unknown, its author cannot be looked up; at the author’s request the brand picks the review on the Personal data requests screen and removes it: the review leaves the page, its photos and the personal details in its text are deleted and the same review is not imported again. A review removed on the marketplace is removed here within a day. Setting up, changing and removing the connection is recorded in the activity history with who did it.

Data subject rights

Access, deletion, correction and objection requests under Turkish Law No. 6698 on the Protection of Personal Data (KVKK) are recorded and applied in the panel. For an access request, the customer’s reviews, orders, delivery updates, invitations, the emails sent to them and their delivery records, their questions and answers, consent records, and their photos and videos are provided in a single file; in the request record, the address is stored as an irreversible keyed value. For a deletion request, the customer’s name, email address, photos and videos are deleted; their name and contact details in review, question and answer texts are replaced with marks; the contact details and order numbers on their orders are converted into irreversible pseudonyms; and prepared data exports are deleted. Reviews that are not live yet cannot go live after the deletion. Completed deletions are also written to a log kept outside the database and are applied again after a restore from backup. For details, see Personal data requests.

The brand’s privacy notice is entered in the channel’s Privacy notice link field (https). When it is set, a Privacy notice on the processing of personal data link is shown on the site under the review, question and answer forms and the review form on the order page, and in the footer of the invitation email. The notice itself stays on the brand’s site; Sayproof shows the link.

Customers who do not want to receive emails can leave the list using the link contained in every invitation. Rejection notices continue to be sent because they are service notices.

Retention periods

Data	Period
Reviews and review history	Kept indefinitely. Regulation, Art. 28/B-4 requires published reviews to remain published for at least one year; personal data is deleted on request.
Activity history, audit reports	Kept indefinitely
Connection log entries	30 days
File uploads not attached to a review	2 days
Orders	Order and product details are kept indefinitely; the email address, phone and customer number are turned into pseudonyms when the review writing period ends (90 days by default), 30 days after the order date for orders that will never get an invitation, and at once for a deletion request
Personal data access entries	365 days
Panel sessions	Deleted every day once expired
All data of a brand whose service is closed	30 days after closing; then permanently deleted
A prepared data export	7 days
Failed panel sign-in attempts (username and IP address as keyed hashes)	30 days

Service status

The Sayproof team sets your brand’s service status. Status changes are recorded in the Activity history.

Status	Result
Active	The panel, invitations, order reading and the reviews on your store work as usual.
Frozen	Applied, for example, when payment is not made. The panel shows the Your service is frozen page and offers administrators only the data export. Invitations, order reading and writing new reviews stop; the reviews already published on your store remain visible.
Closed	Applied when the service is cancelled. The panel shows the Your service is closed page together with the date the data will be deleted. Reviews are no longer shown on your store, and the photos and videos of published reviews leave the public address at once (they come back if the brand reopens). The data is kept for 30 days and then permanently deleted; within those 30 days the brand can be reopened.

For a brand whose service is frozen or closed, users who are not administrators see the note “Your brand’s administrator can download the data export.”

Data export

On the Settings › Data export tab, an administrator can prepare all of the brand’s data as a single zip file. Use it to move to another system, to archive, or to receive your data when the service ends. The file contains: reviews and their history, photos and videos, orders, delivery updates, questions and answers, invitations and send records, activity history and personal data access entries, marketplace connections, their read history, the source records of imported reviews and the numbers of reviews removed by a personal data request, settings, channels, products, risky words, your rating topic lists and your brand’s market rules versions. Keys and passwords are not included.

1. Press Prepare the export. The file is prepared in the background; its status in the list is Being prepared, then Ready.
2. A ready file is downloaded with the Download button in the list. It can be downloaded for 7 days after it is prepared; the Last day to download column shows that date.

The export can also be prepared and downloaded while your service is frozen and within the 30 days after it is closed. Preparing and downloading it are recorded in the Activity history.