Last updated: 25 September 2026
This text is a draft and is under legal review.
1. Who is responsible
The controller of your personal data is Vera Danışmanlık Limited Şirketi, trading as Vera Bilişim.
- Address: Cevizli Mah. Ulubey Sk. Nursallar Sitesi A Blok No: 4A İç Kapı No: 113, 34865 Kartal / Istanbul, Türkiye
- Tax office: Kartal. Tax number: 9240756914
- Email: bilgi@verabilisim.com
[LAWYER: confirm whether an EU/UK representative (GDPR Art. 27) or a VERBİS registration is required, and add details if so.]
2. What this policy covers
- The web dashboard at dashboard.aishortlist.app
- The website aishortlist.app
- A short note on the Shopify app and the ExpressionEngine add-on (sections 10 and 11)
3. Data we collect in the dashboard
| Data | Why |
|---|---|
| Account email | Login, account messages, billing notices |
| Password (stored only as a hash) | Login security |
| Brand name and domain | Running measurements and site checks |
| Questions you approve | Running measurements |
| Measurement answers from AI providers | Showing and comparing results |
| Text fetched from your public website and the list of page URLs | Technical check and text suggestions |
| Usage logs | Security, fair use limits, fixing errors |
We do not store card data. Payments are handled by our payment provider.
4. Legal bases
- Contract: to provide the Service you signed up for.
- Legitimate interest: to keep the Service secure and prevent misuse.
- Legal obligation: to keep invoices and records the law requires.
- Consent: for optional cookies on the website, if we ever use them.
5. Who processes the data
| Processor | Role | Location |
|---|---|---|
| Railway | Hosting and database | USA |
| Resend | Sending emails | USA |
| Google (Analytics) | Measuring visits to the website, only with your consent | USA |
| OpenAI | Measurement questions; public text of your site and of reviewed pages for question suggestions, list page action plans and text suggestions | [LOCATION] |
| Google (Gemini) | Measurement questions only | [LOCATION] |
| Perplexity | Measurement questions only | [LOCATION] |
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. [CONFIRM for non-Turkish payments] | Card payments | [LOCATION] |
We send the AI providers only your questions and text from public web pages. We do not intend to send them personal data. Do not put personal data in your questions.
6. International transfers
Some processors are in the USA. Where the law requires, transfers rely on [TRANSFER MECHANISM, e.g. Standard Contractual Clauses / EU-US Data Privacy Framework / Turkish KVKK Art. 9 safeguards].
7. How long we keep data
- We keep account data while your account is active.
- If you ask us to delete your account, we delete the data within 30 days.
- We keep data longer only where the law requires it, for example invoices.
8. Your rights
Depending on where you live, including under the GDPR, the UK GDPR and Turkish law (KVKK), you have the right to:
- access your data;
- correct it;
- have it deleted;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
To use these rights, email bilgi@verabilisim.com from your account email. We answer within [30] days. You can also complain to your data protection authority.
9. Cookies
The dashboard uses one strictly necessary session cookie. The website shows a consent banner; Google Analytics runs only if you allow analytics cookies. Details are in our Cookie Policy.
10. The Shopify app
The Shopify app is hosted. Measurement happens on our servers, not in your store. It has its own privacy policy, which is the one that governs it: app.aishortlist.app/gizlilik.
11. The ExpressionEngine add-on
The add-on runs entirely inside your own installation. It has no account system, no licence check that calls home, and no server of ours in the path.
- Your API keys are stored in your own database, in a table belonging to the add-on. Each key is sent only to the provider it belongs to (OpenAI, Google or Perplexity), as the authorisation header of the measurement request.
- Your questions and brand names are sent to those same providers as the text of the question, because that is what a measurement is.
- The answers are stored in your own database, so past runs can be re-scored without paying to ask again.
- Nothing is sent to us. We cannot see your keys, your questions, your results or the fact that you installed it.
Uninstalling the add-on drops its four tables. This removes the keys, the questions, the stored answers and the scores.
What the providers do with the requests is governed by their own terms, not ours. If your questions contain anything sensitive, treat them like any other prompt sent to a third-party model.
12. Emails to us
If you email us, we keep the email to answer it. We do not add it to a mailing list.
13. Security
Passwords are stored only as hashes. [CONFIRM other security measures, e.g. encryption in transit and at rest.]
14. Changes
We may update this policy. We will tell account holders about material changes by email or in the dashboard.