Last updated: 6 October 2026
This text is a draft and is under legal review.
1. Who is responsible
The controller of your personal data is Vera Danışmanlık Limited Şirketi, trading as Vera Bilişim.
- Address: Cevizli Mah. Ulubey Sk. Nursallar Sitesi A Blok No: 4A İç Kapı No: 113, 34865 Kartal / Istanbul, Türkiye
- Tax office: Kartal. Tax number: 9240756914
- Email: bilgi@aishortlist.app
[LAWYER: confirm whether an EU/UK representative (GDPR Art. 27) or a VERBİS registration is required, and add details if so.]
2. What this policy covers
- The web dashboard at app.aishortlist.app
- The website aishortlist.app, including the free site audit (section 12)
- A short note on the Shopify app and the ExpressionEngine add-on (sections 10 and 11)
3. Data we collect in the dashboard
| Data | Why |
|---|---|
| Account email | Login, account messages, billing notices |
| Password (stored only as a hash) | Login security |
| Brand name and domain | Running measurements and site checks |
| Questions you approve | Running measurements |
| Measurement answers from AI providers | Showing and comparing results |
| Text fetched from your public website and the list of page URLs | Technical check and text suggestions |
| Ad account data, if you connect an ad account: the account number and name; spend and result figures for campaigns, ad groups or ad sets, ads, keywords and search terms; your decisions on suggestions and the email of the person who decided; the questions you ask about your ads and their answers; campaign drafts you prepare. If you add them for alerts: your Slack webhook address or Telegram chat id | Ad summary, suggestions, reports, alerts and applying the changes you approve |
| Usage logs | Security, fair use limits, fixing errors |
We do not store card data. Payments are handled by our payment provider.
4. Legal bases
- Contract: to provide the Service you signed up for.
- Legitimate interest: to keep the Service secure and prevent misuse.
- Legal obligation: to keep invoices and records the law requires.
- Consent: for optional cookies on the website, and for tips and news emails if you tick the optional box in the free site audit form.
5. Who processes the data
| Processor | Role | Location |
|---|---|---|
| Railway | Hosting and database | USA |
| Resend | Sending emails | USA |
| Google (Analytics) | Measuring visits to the website, only with your consent | USA |
| OpenAI | Measurement questions; public text of your site and of reviewed pages for question suggestions, list page action plans and text suggestions; when you ask a question about your ads or have ad texts written: your question, summary figures of your ad account, campaign, ad and search names, and the brand facts you typed | [LOCATION] |
| Google (Google Ads) | Reading the data of the Google Ads account you connect and applying the changes you approve in the dashboard | USA |
| Meta | Reading the data of the Meta ad account you connect and applying the changes you approve in the dashboard | USA |
| Slack or Telegram | Only if you connect them: the alert text (site name, number of new suggestions and a link to the dashboard) | USA and other countries |
| Google (Gemini) | Measurement questions only | [LOCATION] |
| Google (PageSpeed Insights) | The address of the site being audited, to measure page speed | USA |
| Perplexity | Measurement questions only | [LOCATION] |
| iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. [CONFIRM for non-Turkish payments] | Card payments | [LOCATION] |
We send the AI providers only your questions, text from public web pages and, for questions about your ads, the content listed above. Your account email, password, ad account number and ad account access credentials are not sent to them. We do not intend to send them personal data. Do not put personal data in your questions.
6. International transfers
Some processors are in the USA. Where the law requires, transfers rely on [TRANSFER MECHANISM, e.g. Standard Contractual Clauses / EU-US Data Privacy Framework / Turkish KVKK Art. 9 safeguards].
7. How long we keep data
- We keep account data while your account is active.
- If you ask us to delete your account, we delete the data within 30 days.
- We keep data longer only where the law requires it, for example invoices.
8. Your rights
Depending on where you live, including under the GDPR, the UK GDPR and Turkish law (KVKK), you have the right to:
- access your data;
- correct it;
- have it deleted;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
To use these rights, email bilgi@aishortlist.app from your account email. We answer within [30] days. You can also complain to your data protection authority.
9. Cookies
The dashboard uses one strictly necessary session cookie. The website shows a consent banner; Google Analytics runs only if you allow analytics cookies. Details are in our Cookie Policy.
10. The Shopify app
The Shopify app is hosted. Measurement happens on our servers, not in your store. It has its own privacy policy, which is the one that governs it: shopify.aishortlist.app/gizlilik.
11. The ExpressionEngine add-on
The add-on runs entirely inside your own installation. It has no account system, no licence check that calls home, and no server of ours in the path.
- Your API keys are stored in your own database, in a table belonging to the add-on. Each key is sent only to the provider it belongs to (OpenAI, Google or Perplexity), as the authorisation header of the measurement request.
- Your questions and brand names are sent to those same providers as the text of the question, because that is what a measurement is.
- The answers are stored in your own database, so past runs can be re-scored without paying to ask again.
- Nothing is sent to us. We cannot see your keys, your questions, your results or the fact that you installed it.
Uninstalling the add-on drops its four tables. This removes the keys, the questions, the stored answers and the scores.
What the providers do with the requests is governed by their own terms, not ours. If your questions contain anything sensitive, treat them like any other prompt sent to a third-party model.
12. The free site audit
When you use the free site audit on aishortlist.app, we collect the email address and website address you type, whether you ticked the optional box for tips and news, and the audit result. To prevent abuse we keep your IP address only as an irreversible hash, never in plain form.
- Why: to run the audit you asked for and email you the link to the result. We send nothing else unless you ticked the optional box; you can withdraw that consent at any time.
- How long: 12 months, then deleted. Email bilgi@aishortlist.app to have it deleted sooner.
- Who processes it: Railway (hosting), Resend (the email) and Google PageSpeed Insights (the site address, for the speed test).
13. Emails to us
If you email us, we keep the email to answer it. We do not add it to a mailing list.
14. Security
Passwords are stored only as hashes. [CONFIRM other security measures, e.g. encryption in transit and at rest.]
15. Ad account data
When you connect a Google Ads or Meta ad account to AIShortlist, these rules apply:
- What we read: spend, clicks, impressions and results for campaigns, ad groups or ad sets, ads, keywords and search terms, and budget and bid values.
- What we use it for: only to show you summaries, suggestions, reports and alerts and to answer your questions. We do not sell this data, do not use it for ad targeting and do not use it to train AI models.
- What we change: only a change you approve in the dashboard is made in your ad account. Every change is kept in the history with the email of the person who approved it and the date.
- AI: when you ask a question about your ads or have ad texts written, the content listed in section 5 is sent to the AI provider so the answer can be written. Suggestions are not produced by AI but by clear rules applied to your account numbers.
- Removing the connection: you can remove the connection at any time in the dashboard or in the access settings of your Google Ads and Meta account. After that no new data is read from your ad account. When your account is closed, ad data is deleted on the schedule in section 7.
AIShortlist's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
16. Changes
We may update this policy. We will tell account holders about material changes by email or in the dashboard.