Privacy Policy
Last updated
This policy explains how Who's Asking handles personal data, both for people who use the Service and for people whose public posts it finds. The data controller is Onur Garip, an individual based in Türkiye, reachable at [email protected]. We follow the Turkish Personal Data Protection Law (KVKK, No. 6698) and, for people in the EU/EEA and UK, the GDPR. We don't sell personal data.
1. What we collect
- Account data: your email address, and your name and profile picture if you sign in with Google.
- Project data: the product links you enter and each Project's Profile: name, description, audience, pain points, competitors, Search phrases and excluded terms.
- Public post data: for each post that passes scoring, we store its text, link, Source, publish date, engagement counts and the author's public name, handle and profile image link, as returned by the Source. We store these with the Intent score, Evidence quote, reason and drafts we generate.
- Seen post IDs: for other posts we find, we keep only the Source and post ID for 14 days, so we don't process the same post twice.
- Your activity: which Opportunities you dismiss, copy or mark as replied, and the drafts generated for them.
- Tracked link counts: the number of clicks and the time of the last click. We read a visitor's browser type to ignore obvious bots, and we don't store it. We don't keep IP addresses with click counts, though a click can appear in our server logs like any other request.
- Billing data: your Plan, subscription status and billing period. Card details go straight to Polar; we never see or store them.
- Usage data: pages you view, what you click, your browser and approximate location, and session recordings. See Cookies and local storage below.
- Technical logs: IP address and request logs kept for security and debugging.
2. Why we use it
| Purpose | Legal basis |
|---|---|
| Create your account, sign you in, run Scans, show your feed | Performing our contract with you |
| Find, store and score public posts for your Projects | Legitimate interest (see section 3) |
| Process payments and keep accounting records | Contract; legal obligation |
| Service emails: sign-in links, the Digest | Contract. You can turn off each Project's Digest |
| Security, abuse prevention, debugging | Legitimate interest |
3. If you wrote a post we found
Who's Asking handles public posts written by people who aren't its customers. We only collect posts that are already public, and we use them to show our customers conversations they may want to join. We have a legitimate interest in doing this, and we keep the fields limited to what a reader of the original post could already see.
We don't contact authors, post to any platform, or combine one author's posts into a profile. A customer who sees your post may choose to reply to it from their own account.
You can object to this processing or ask us to delete a post. Email [email protected] with a link to the post, and we'll respond within 30 days. Deleting or editing a post on the original platform doesn't automatically update our copy, so please write to us.
4. Who processes it
We use these providers to run the Service. Each only gets the data it needs:
| Provider | What for | Data |
|---|---|---|
| Hosting and network providers | Servers, database, DNS and network protection | All Service data, IP address, request data |
| Anthropic (Claude) | Building Profiles, scoring posts and writing drafts | Your product link and Profile, public post text. No account data |
| Third-party social data provider | Finding public posts on Reddit, X, Bluesky, Threads, LinkedIn, YouTube and Quora | Search phrases and competitor names. No account data |
| Hacker News Search API (Algolia) and Stack Exchange API | Finding public posts on Hacker News and Stack Overflow | Search phrases and competitor names. No account data |
| Apple | Reading app details for App Store links | The App Store link you enter |
| Resend | Sending emails | Email address and email content, including post text quoted in the Digest |
| Polar | Payments, merchant of record | Email, purchase and payment data |
| Optional Google sign-in | Sign-in data | |
| PostHog (US) | Product analytics and session recording | Usage data, session recordings, account ID and email |
Some providers are outside Türkiye and the EU, mainly in the US. Where required, transfers rely on standard contractual clauses or another lawful transfer mechanism.
6. How long we keep it
- Account data: while your account exists, and deleted within 30 days after you ask us to delete it.
- Project data, public post data and drafts: until you delete the Project or your account. Deleting a Project deletes its data.
- Seen post IDs: 14 days.
- Billing records: as long as tax and accounting law requires (up to 10 years in Türkiye).
- Server logs: up to 30 days.
- Session recordings: 30 days.
7. Your rights
You can ask to access, correct, delete or export your data, object to or restrict processing based on legitimate interest, and withdraw consent. Under KVKK Article 11 you can also ask whether your data is processed, for what purpose, and to whom it was transferred.
Email [email protected]. If you have an account, write from your account address. We answer within 30 days. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU/EEA, your local data protection authority.
8. Security
Traffic is encrypted with HTTPS, and sign-in uses one-time email links or Google instead of passwords. We hold no social account logins for anyone. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.
9. Children
The Service isn't meant for anyone under 16, and we don't knowingly collect their account data.
10. Changes
We'll update the date above when this policy changes and email account holders about material changes. See also our Terms of Service.