Privacy Policy

This policy covers two different kinds of personal data, and the distinction matters because our obligations differ in each case.

Our own visitors and customers. If you fill in a form on this site, book a call, or hold an account in TechSales, we hold your name, work email, company and the correspondence between us. For that data we are the controller.

Prospect data inside a customer's workspace. If you are a person a TechSales customer is prospecting, your data is in their workspace because they put it there. For that data they are the controller and we are the processor. See clause 2.

For all lead and prospect data orchestrated through a customer's own accounts (Apollo, Instantly, HeyReach, HubSpot, Calendly and the enrichment providers), TechSales acts strictly as a data processor within the meaning of Article 28 of the GDPR, and as a veri işleyen within the meaning of the KVKK (Law No. 6698).

The customer remains the data controller (veri sorumlusu). They decide whose data enters the workspace, on what lawful basis, and what is done with it. We process it only on their documented instructions, which in practice means the campaigns, filters and rules they configure in the product.

This is not a formality chosen for convenience. The data is sourced under the customer's own provider contracts, sent from the customer's own sending accounts, and written back to the customer's own CRM. We never introduce a prospect into a workspace that the customer did not ask for.

We will enter a Data Processing Agreement on request, and we engage sub-processors (the providers listed in clause 6) under equivalent terms.

TechSales does not sell, resell, pool, aggregate, license, broker or otherwise make available any customer's prospect data to another customer, to a data vendor, or to anyone else. One customer's workspace is never used to improve, populate or enrich another's, and we do not build a shared contact database out of what passes through the platform.

We are an orchestration layer, not a data vendor. The business model is a subscription and a credit balance; there is no version of it in which reselling your list makes us money.

We also do not use customer prospect data to train machine learning models. Where the product drafts a reply or a follow-up hook, the relevant thread and signal are sent to a model provider to generate that single output and are not retained by us for training.

In TechSales you can connect your own Google or Microsoft account so that replies go out from your own address and your meetings appear in one place. This is optional, and you can disconnect at any time from Settings.

What we access. With your permission we request two things: permission to send email as you (Gmail: gmail.send; Microsoft: Mail.Send) and read only access to your calendar events (Google: calendar.events.readonly; Microsoft: Calendars.Read), plus your name and email address to show which account is connected. We do not read, search or store your inbox.

How we use it. We send an email from your account only when you send a reply in TechSales, or, if your workspace has switched on automatic replies, when a reply passes the safety rules your workspace configured. From your calendar we keep only events that include at least one attendee outside your company: the title, time, status, attendees' email addresses, organiser, location and video link, so the meeting can be shown on your Calendar page and on the matching contact. We do not store event descriptions, and we never create, change or delete calendar events.

What we never do. We do not sell this data, use it for advertising, or use it to train or improve AI or machine learning models, and we do not share it with anyone except as needed to provide the features above, to comply with the law, or to protect against abuse. Data from your Google or Microsoft account is not sent to AI model providers. No person at TechSales reads it unless you ask us to (for example in a support request), it is needed for security, or the law requires it.

Storage and deletion. Access tokens are stored encrypted. When you disconnect an account we delete the stored token, and for Google we also revoke our access. Meetings already recorded stay in your workspace as history until you or your workspace admin delete them or the account closes; write to[email protected]to have them removed sooner. You can also remove our access at any time from your Google Account (Security, then Third party apps and services) or your Microsoft account.

Limited Use. TechSales's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

Site visitors. Form submissions (name, work email, company, message) are stored in our CRM so we can reply. Retained until you ask us to delete them, or two years after our last contact.

Customers. Account details, workspace configuration, billing records and support correspondence, for the life of the account plus the period we are required to keep financial records.

Workspace data. Leads, conversations and campaign history live in the customer's workspace and are deleted when they delete them, or within 30 days of the account closing. A customer can export everything at any time. See the Terms.

Verification results. Email verification verdicts are cached for up to 60 days so that re-checking the same address does not cost a customer credits twice.

We rely on these providers to run the service. Where a customer connects their own key to a provider, that provider is the customer's contracted party rather than our sub-processor.

• Supabase: application database and authentication (EU region)
• Cloudflare: site delivery and edge security
• HubSpot: our own CRM, for enquiries and customer correspondence
• Out Plane: application hosting (EU)
• Anthropic and OpenAI: model providers for drafted replies, reply classification, list scoring and signal summaries
• Google and Microsoft: sending email and reading calendar events from accounts a user connects (clause 4)
• Reoon, BounceBan, Apify, Tavily, Apollo, Instantly, HeyReach, Calendly: enrichment, verification, sending and scheduling, run on the customer's own keys wherever connected

Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing. The KVKK grants equivalent rights under Article 11, including the right to learn whether your data is processed and to request that it be corrected or deleted.

If your data is in a customer's workspace, the customer is the controller and we will forward your request to them without undue delay, and assist them in answering it. If we are the controller, we answer it ourselves.

Data subject access requests and any privacy question: [email protected]. We aim to respond within 30 days.

You also have the right to complain to a supervisory authority. In the EU that is the data protection authority of your member state; in Türkiye, the Kişisel Verileri Koruma Kurumu.

Our primary infrastructure is hosted in the EU. Some sub-processors listed in clause 6 operate outside the EEA; where they do, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. For transfers out of Türkiye, we rely on the mechanisms permitted under KVKK Article 9.

If we change this policy in a way that materially affects how we handle your data, we will say so, by email to account holders, and by updating the date at the top of this page.