Maestro Privacy Policy

Last updated: September 30, 2026

This notice explains how GK Teknoloji Danışmanlık A.Ş. (“AnalyticaHouse” or the “Company”), as data controller, processes the personal data of employees and authorised business partners who use Maestro, the operations platform available at maestro.analyticahouse.com (the “Service”), under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”).

1. Data controller

Your personal data is processed by GK Teknoloji Danışmanlık A.Ş. as the data controller under KVKK.

2. Personal data we process, purposes and legal bases

• Identity and contact data (full name, work email address, profile picture, Google account identifier): processed to sign you in with Google, identify you and determine your permissions, on the basis of establishing and performing a contract (KVKK Art. 5/2-c).
• Professional and work data (tasks, comments, time entries, approvals, files, invoicing and finance records, people operations records): processed to run company operations and manage finance, project and people processes, on the basis of performing a contract, complying with legal obligations (Art. 5/2-ç) and our legitimate interests (Art. 5/2-f).
• Google Workspace data: Google Calendar events and availability (calendar views, meeting and interview scheduling) and the content of Google Sheets the Service creates or that are connected to it (importing invoice templates). The Service also sends candidate and finance emails from authorised company mailboxes through Gmail and writes copies of marketing media to Google Drive; it does not read mailboxes or other Drive files. Processed on the basis of performing a contract and our legitimate interests. See section 7 for details.
• Security data (IP address, browser and device information, session and access logs, audit records): processed to secure the Service, prevent unauthorised access and comply with legal obligations, on the basis of legal obligations and our legitimate interests.

3. How we collect your data

We collect personal data electronically: from your Google account when you sign in with Google, from information you enter or upload into the Service, and automatically through authorised integrations (Google Workspace, Slack, Paraşüt, ClickUp), based on the legal bases in section 2.

4. Retention

We keep personal data for as long as your account is active and as long as the purposes of processing require, or longer where the law requires it (for example retention periods under the Turkish Tax Procedure Law and Commercial Code). At the end of that period we delete, destroy or anonymise the data.

5. Sharing with third parties in Türkiye

Limited to the purposes above and only as necessary, we may share personal data with Paraşüt and our banks for invoicing, collections and reconciliation, and with competent public authorities and courts upon request. We do not sell personal data.

6. Sharing with third parties abroad

The Service is hosted in Google Cloud data centres in the European Union. The following providers we use to run the Service are located abroad or may access data from abroad:

• Google (Google Cloud and Google Workspace): hosting, email, calendar and file services.
• Slack: notifications and team communication.
• ClickUp: project and task synchronisation.
• OpenAI and Anthropic: assistant features. These providers process data only on our instructions and, under their API terms, do not use our data to train their models.

We transfer personal data abroad in accordance with Article 9 of KVKK and, where applicable, the GDPR, using the safeguards provided by law such as standard contractual clauses.

7. Google user data

We use data received from Google APIs only to provide and improve the user-facing features of the Service that you or your organisation have enabled.

• We do not sell Google user data.
• We do not use Google user data for advertising, including personalised, retargeted or interest-based advertising.
• We do not use Google user data to determine creditworthiness or for lending purposes.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
• We do not transfer Google user data to others except as necessary to provide or improve user-facing features, to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets with notice to users.
• Our staff do not read Google user data unless you have given explicit consent for specific data, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymised for internal operations.

Maestro’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

8. Security

We protect personal data with technical and organisational measures, including encryption in transit (TLS) and at rest, encrypted storage of integration credentials and access tokens, role-based access control that limits each user to the data needed for their work, and audit logs of sensitive actions.

9. Cookies and local storage

The Service uses only cookies that are strictly necessary to keep you signed in and to secure your session, and your browser’s local storage to remember interface preferences such as the colour theme. We do not use advertising or cross-site tracking cookies.

10. Your rights as a data subject

Under Article 11 of KVKK, you may apply to the Company to:

1. learn whether your personal data is processed;
2. request information about the processing if your data has been processed;
3. learn the purpose of the processing and whether your data is used for that purpose;
4. know the third parties in Türkiye or abroad to whom your data is transferred;
5. request correction of incomplete or inaccurate data;
6. request deletion or destruction of your data under the conditions of Article 7 of KVKK;
7. request that actions taken under items 5 and 6 be notified to the third parties to whom your data was transferred;
8. object to a result against you arising exclusively from automated analysis of your data;
9. claim compensation for damage arising from unlawful processing of your data.

Where the GDPR applies, you also have the rights it grants, including data portability and the right to lodge a complaint with a supervisory authority.

Send requests to legal@analyticahouse.com or by the other methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We respond free of charge within 30 days at the latest; if a request requires additional cost, the fee set by the Personal Data Protection Board may be charged.

You can revoke the Service’s access to your Google account at any time from your Google Account permissions page. If your organisation granted access centrally, contact your Google Workspace administrator.

11. Changes and contact

We may update this notice from time to time. The “Last updated” date at the top of this page shows when it was last revised, and we announce material changes through the Service or by email. For questions, email legal@analyticahouse.com.