Privacy Policy

1. Data We Collect

We collect: account information (email, name), organization data (company name, website, industry), AI scan results, and usage analytics (cookie-based measurement only with your consent; a cookieless total page count and page-speed measurement run without it, see section 5). We do not collect payment card details directly — all payments are processed securely through Polar, our Merchant of Record.

When you send the contact form or ask for your free scan report by email, we store what you enter (contact form: name, email, company, topic and message; free scan: email, brand, website and the scan result) together with your IP address and the country derived from it, to answer your request and to prevent abuse.

2. How We Use Your Data

Your data is used to: provide AI visibility analysis, generate GEO recommendations, track competitor performance, send scan notifications, and improve our service. If you ask for your free scan report by email, we send that report once. We send follow-up tips and plan information only if you tick the separate box for it; every such email has an unsubscribe link. We never sell your data to third parties.

3. Data Security

Data is protected with HTTPS/TLS in transit, and organization access is separated with Row Level Security (RLS) on Supabase, so each organization can only access its own data. Our database (Supabase) and our application servers (Vercel) run in the EU, in Ireland. Some of the service providers listed in section 8 (for example the AI providers and the analytics tools) process data outside Türkiye and the EU, including in the US.

4. Your Rights under KVKK and GDPR

We process personal data with the aim of meeting the requirements of the Turkish KVKK and the GDPR. You can ask to access, correct, delete or export your data. Contact hello@sovtracker.com to exercise these rights.

5. Cookies

Without asking, we only use the cookies the site needs to work: sign-in and session cookies (Supabase), your language choice (NEXT_LOCALE, 1 year) and your cookie choice itself (sov_consent, 1 year).

Our own visitor measurement runs only if you choose “Accept” in the cookie banner. It then sets two cookies: __Host-sov_vid (recognises your browser on later visits, 400 days) and __Host-sov_sid (one visit; it ends after 30 minutes without activity). We record the page path (with campaign/UTM parameters only), the referring site, the country and city derived from your IP address, the browser family and active time on the page; if you are signed in, the visit is linked to your account and organization and your last sign-in IP address is saved. The cookie values themselves are not stored; we keep only a keyed hash of them. Visit events are deleted automatically after 180 days. Without your consent, these cookies are not set and your visit is not recorded in this measurement (only the cookieless count described below runs); if you reject later, the cookies are deleted. Account, payment and scan records that the service needs (for example a completed checkout) are still saved with your account, but are not linked to your browsing.

If you have not given consent (you made no choice or chose “Reject”), we only keep a cookieless, identifier-free total page count on our public marketing, academy and sign-in pages; this count does not run in the customer dashboard or on scorecard/report pages. For this, our page code reads only the following from your browser and sends it to our server: the path of the page viewed (without the query string; parts that carry an identifier, such as a certificate number, are masked), only the domain of the referring site (for example google.com) and, if the link has one, only the campaign source (utm_source). As with every web request, your browser also transmits your IP address and its User-Agent header; our server uses the User-Agent only at the moment of the request to filter out automated (bot) traffic and to derive a coarse device type (desktop, mobile, tablet), does not use your IP address for this count, and writes neither of them to this count's record. This count sets no cookies, stores nothing in your browser (including localStorage), gives you or your browser no identifier, does no fingerprinting, does not link your visits together and keeps no country or city. Each stored record contains only the masked page path, the referring domain, the campaign source if any, the coarse device type and the time rounded to the hour; it is not linked to your account, your browser or any other visit. Its only purpose is to see the overall use of the site; unique visitor numbers cannot be derived from it. The legal basis is our legitimate interest in monitoring the overall use of the site (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)); because it uses no cookies or identifiers, we do not ask for cookie consent for this count. If your browser sends a Global Privacy Control (GPC) signal, this count does not run either. Records are deleted automatically after 180 days. Once you give consent, this count stops and the measurement described above runs instead.

If you choose “Accept” in the cookie banner (legal basis: your consent, KVKK Art. 5/1, GDPR Art. 6(1)(a)), we also use Google Analytics (Google LLC) to measure visits, and Microsoft Clarity (Microsoft Corporation) on our public marketing pages and shared scorecard/report pages to see clicks, scrolling and session recordings. Clarity is not loaded in the customer dashboard or on sign-in pages; form inputs are masked. These providers may process data outside Türkiye and the EU, including in the US. Google Analytics keeps event data for 2 months and user-level data for 14 months, then deletes it automatically. If you reject, neither tool is loaded. You can change your choice at any time via “Cookie preferences” at the bottom of the page. Vercel Analytics and Speed Insights (Vercel Inc.) use no cookies and run regardless of consent to measure aggregate visits and page speed (legitimate interest, KVKK Art. 5/2-f, GDPR Art. 6(1)(f)). You can also manage cookies in your browser settings.

6. SOV Tracker Academy: exam and certificate

Academy lessons can be read without an account. The marks showing which lessons you have finished are kept only in your browser (localStorage) and are not saved to your account. Visits to lesson pages are measured with the analytics tools in section 5, like the rest of the site.

Taking the final exam requires an account. For the exam and the certificate we process: the full name printed on the certificate, your account email, your exam attempts (the questions you were shown, the answers you gave, start and submission times), your score and the modules where you scored low, the certificate number, and the exam and certificate dates. The legal basis is the performance of the service and our contract with you (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)). A certificate cannot be issued without a name. Your score is calculated automatically on our server; to dispute a result, write to hello@sovtracker.com.

This data is stored with our database provider Supabase (EU, Ireland) and processed through our hosting provider Vercel. We send no email for the exam or certificate and do not share this data with anyone else. Certificate numbers are not sent to analytics tools from verification pages. If you share your certificate on LinkedIn or X, you choose what goes to that platform.

The certificate verification page opens only with a certificate number; it cannot be searched by name or email. Anyone who knows the number sees the program, the issue date, the valid-through date and the status (current, past its valid-through date, or revoked). Your name is shown only if you made the certificate public, and your score only if you also chose to show it. Both are off by default and you can change them on your certificate page at any time. Your email is never shown on the verification page.

You can hide your name and score on the verification page from your certificate page at any time. To have your exam and certificate record deleted without deleting your account, write to hello@sovtracker.com from your account email; we will do it within 30 days. If you delete your account, your exam attempts are deleted and the name and score on your certificate are removed at once. The certificate number, its dates and its status are kept with no link to you, so someone who has seen your certificate can still check that it was issued. The legal basis for this is our legitimate interest in preventing forged certificates (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)). If you want this record deleted too, just write to us.

Exam attempts are kept for at most 24 months from the attempt date, and certificate records for at most 24 months from the issue date; then they are deleted. A deleted certificate's number can no longer be verified.

7. Data Controller and Contact

The data controller for the personal data described in this policy, under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the GDPR, is SOV Tracker, operating from Türkiye. For privacy questions and to exercise your rights, contact us at hello@sovtracker.com. We answer requests free of charge within 30 days at the latest.

8. Service Providers We Use

We share data with the following providers only as far as needed for the purpose shown:

• Supabase: database and sign-in (EU, Ireland).
• Vercel: hosting and application servers (EU, Ireland); Vercel Analytics and Speed Insights (section 5).
• Polar: payments and invoices, as Merchant of Record.
• OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini) and Perplexity: AI measurement. We send them the questions asked in a scan; to write those questions we use the brand, category, market and website you enter. OpenAI is also used to suggest questions in the dashboard.
• DataForSEO and Bright Data: collecting Google AI Overviews results for the same questions.
• Resend: sending the emails the service sends (scan reports, weekly reports, notifications, team invitations, the follow-up emails you opted into, and contact form messages to our inbox).
• Sentry: error monitoring. It runs regardless of the cookie choice, without session recordings and without sending default personal data such as IP addresses or cookies.
• Cloudflare (Turnstile): bot protection on the free scan form. It runs regardless of the cookie choice.
• Google (Google Analytics) and Microsoft (Clarity): only with your consent (section 5).

9. API, MCP and AI Assistant Connectors

On Pro plans and above you can connect an AI assistant such as Claude or ChatGPT, or a tool such as Claude Code or Cursor, to your organization through our MCP server (sovtracker.com/api/mcp) or our REST API. Claude and ChatGPT connect by signing in: only an owner or admin of your organization can approve the connection, and approving it creates an API key with read-only access, named after the assistant (for example “Claude (OAuth)”) under Settings → API. Tools such as Claude Code or Cursor can also use an API key you create there. A key stays valid until you revoke it under Settings → API, which disconnects that assistant at once.

The connection is read-only. Its tools return only your own organization's data: scores and metrics, tracked questions, scan results, archived AI answers and their cited sources, Brand Facts status and AI-referred traffic statistics. They cannot change, delete or send anything. We receive only the tool calls the assistant makes and their parameters (for example which market or date range to show); we do not receive your conversation with the assistant, your files or the assistant's memory. For each key we record when it was last used; standard request logs of our hosting provider (Vercel) and error reports (Sentry, section 8) apply as for the rest of the service.

Once a tool returns your data to the assistant, the assistant's provider (for example Anthropic for Claude or OpenAI for ChatGPT) processes it under its own terms and privacy policy, as part of your conversation there. We do not sell or share data received through these connections with anyone else. The legal basis is the performance of the service and our contract with you (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)). Questions: hello@sovtracker.com.