Privacy Policy
We explain in plain language which data we process when you use our website or contact us, why, for how long, and what rights you have.
Scope and data controller
This policy explains how personal data is processed when you visit aurorayazilim.com or contact us by form, phone, WhatsApp or e-mail. The controller is Aurora Yazılım, based in Türkiye. Where the EU General Data Protection Regulation (GDPR), the UK GDPR and the Data Protection Act 2018 apply to visitors in those regions, we handle data in line with them, and with the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy rules for cookies.
Address: Akçay Mah. 90 Sk. No:14 Edremit, Balıkesir, Türkiye · Phone: +90 541 557 57 59 · E-mail: info@aurorayazilim.com
For websites, online stores and software we build for clients, the client business is usually the controller of its visitors' and customers' data; Aurora accesses that data only to provide the technical service, on the client's instructions and under contract. Those sites have their own privacy notices. This policy also covers data accessed through Google APIs as part of Aurora Yazılım's Google Ads management services (Aurora Google Ads and GoFly); details are in section "12. Google User Data".
What data we process
We process only what we need to answer your request. The contact and partner-application forms ask for:
| Data | When | Required |
|---|---|---|
| Name, phone, e-mail | When you submit a contact or partner form | Yes |
| Company name, current website | If you enter them | No |
| Services of interest, project stage, timing, your message | When you submit the form | Service and message yes; the rest no |
| Preferred contact channel | If you choose one | No |
| IP address and time of submission | When a form is submitted, to prevent abuse and automated posting | Automatic |
| Content of correspondence | When you write by e-mail, phone or WhatsApp | Up to you |
| Site usage data (pages viewed, device and browser type, approximate location) | Only if you accept analytics cookies | No |
We do not ask for special-category data (health, biometric, etc.); please do not include it in forms or messages. The site is not directed at children.
Forms: your messages are not stored in our system
What you type into the contact and partner forms is not saved in a database or on our web server. Your message is delivered only as an e-mail to our company mailbox, where the correspondence is kept like any other e-mail.
The server keeps only technical records to prevent abuse: a short-lived counter with your IP address and time for the hourly submission limit, and a technical log of rejected or failed submissions. These records do not contain the content of your message.
Cookies and Google Analytics
Apart from records strictly necessary to run the site, we use only Google Analytics 4, and it sets cookies only if you accept analytics cookies. We do not use advertising or marketing cookies. Your choice is stored in your browser's local storage and you can change it at any time.
We use Google Consent Mode v2: if you decline, Google Analytics sets no cookies and reads no advertising identifiers, although cookieless, non-identifying aggregate measurement pings (for example that a page was viewed) may still reach Google. See our Cookie Policy for details and the cookie list.
To change your choice: Cookie Preferences.
Why we process data and on what legal basis
- Answering your request and preparing a quote. Legal basis: taking steps at your request before entering a contract (Art. 6(1)(b) GDPR) and your consent given by ticking the form box (Art. 6(1)(a)).
- Delivering, invoicing and supporting a service once a contract exists. Legal basis: performance of a contract and legal obligations (Art. 6(1)(b), (c)).
- Site security and abuse prevention. Legal basis: our legitimate interest (Art. 6(1)(f)).
- Analysing site use (Google Analytics). Legal basis: your consent (Art. 6(1)(a) and the cookie rules of PECR / the ePrivacy Directive), given through the cookie banner and withdrawable at any time.
- Legal obligations. Responding to lawful requests from authorities (Art. 6(1)(c)).
We do not add you to any marketing list without separate permission and use your data for nothing beyond answering your request.
Recipients and international transfers
We do not sell your data. We share it only as the service requires:
- E-mail and hosting providers: your form message is sent by SMTP to our company mailbox; the site runs on our hosting provider's servers.
- Google (analytics, only with your consent): Google Analytics data is processed by Google Ireland Limited and/or Google LLC.
- Google (map): the Google Map on the contact page sends technical data such as your IP address to Google when the page is opened.
- Accountant, banks and authorities: where a contract exists, as needed for invoicing and tax obligations.
- Cloudflare (Google Ads service infrastructure): See section 12 for details.
We are based in Türkiye, which is outside the EEA and the UK. Data you send us therefore travels to Türkiye at your request, which Art. 49(1)(a)–(b) GDPR permits (your explicit consent and pre-contractual steps). Transfers to Google LLC in the United States rely on Google's participation in the EU–US Data Privacy Framework and its standard contractual clauses.
Retention
If your enquiry does not lead to a contract we keep the data for as long as needed for the discussion; if a contract is concluded, for the periods required by law (generally up to 10 years for accounting records). After that we delete, destroy or anonymise it. Security-related IP records are kept briefly. Analytics data is retained in our Google Analytics property for no longer than 14 months. Cookie and local-storage lifetimes are listed in the Cookie Policy.
Your rights
Under the GDPR / UK GDPR you can ask us for:
- Access to your personal data and a copy of it (Art. 15)
- Correction of inaccurate or incomplete data (Art. 16)
- Erasure ("right to be forgotten") where the conditions are met (Art. 17)
- Restriction of processing (Art. 18)
- Data portability for data you provided, where processing is based on consent or contract (Art. 20)
- Objection to processing based on legitimate interests (Art. 21)
Where processing is based on consent you can withdraw it at any time; withdrawal does not affect earlier processing (Art. 7(3)).
How to exercise your rights and complain
Write to info@aurorayazilim.com with enough detail for us to identify you. We reply within one month (extendable by two months for complex requests). If you are not satisfied you may complain to the supervisory authority where you live or work: in the United Kingdom the Information Commissioner's Office (ico.org.uk); in the EEA your national data protection authority.
Security
The site is served over HTTPS; form submissions are protected by a session token, bot protection and a submission limit, and mailbox access is restricted to authorised staff. No internet transmission is completely secure, so please do not share passwords or card details in messages.
Changes
We update this policy when the law or our services change. The current text is always published here; the date of the last update is at the top of the page.
Google User Data (Aurora Google Ads / GoFly)
12.1 Data we access
When you authorize with your Google account, we access, via the Google Ads API (https://www.googleapis.com/auth/adwords scope), only:
- Google Ads account IDs, names, currency, time zone and manager (MCC) relationships
- Campaign, ad group, keyword, negative keyword, ad, asset, targeting, bidding and budget settings
- Performance metrics (impressions, clicks, cost, conversions, conversion value, including device, location, hour and day breakdowns)
- Search term and landing page reports
- Conversion actions and goals, labels, recommendations and change history
- Billing setup status (not card or bank details)
For audience lists we read metadata only (such as name and size), never member data, and we do not upload customer lists. We do not access Gmail, Drive, Contacts or any other Google service.
12.2 How we use it
Google user data is used only to provide user-facing features:
- Reporting on your ad performance
- Creating and editing campaigns at your request (pause, budget, keyword and ad changes)
- Budget safeguards and pausing campaigns when a subscription ends
- Recommendations
Every change to your Google Ads account is shown to you as a preview and applied only after your explicit approval. We never use Google user data for advertising, profiling, credit or lending decisions, or any purpose unrelated to these features.
12.3 Sharing and transfer
We do not sell Google user data and do not transfer it to advertisers, data brokers or information resellers. It is processed only by:
- (a) Infrastructure providers strictly necessary to run the service: Cloudflare (serverless runtime and encrypted key-value storage) and our hosting provider
- (b) Authorities, where required by law
- (c) Others, with your explicit consent
12.4 AI/ML
We do not use Google user data to develop, improve or train AI or machine-learning models. If Google user data is ever sent to an AI provider to deliver a feature to you, it will be used only for that feature, only with providers contractually bound not to train on it, and this policy will be updated beforehand.
12.5 Limited Use
Aurora Yazılım's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
12.6 Protection
- All traffic is encrypted with HTTPS/TLS.
- OAuth tokens are stored server-side only, in access-restricted storage, and are never exposed to browsers, logs or third parties.
- Secrets are redacted from logs.
- Every account change requires a single-use approval valid for 15 minutes.
- Access is limited to authorized Aurora staff.
12.7 Retention
| Data | Retention |
|---|---|
| Access tokens | ≤ 1 hour |
| Refresh token | Until you disconnect |
| Account info cache | 6 hours |
| Change approval records | 24 hours |
| Audit logs of account changes (no tokens) | 365 days, then deleted automatically |
| Reporting summaries kept in the panel | 30 days after disconnection / end of service |
| GoFly: store ↔ Google Ads account mapping and link history | Until the link is removed; then 30 days |
| GoFly: Google sign-in connection record (encrypted token and e-mail) | Until disconnected; the token is deleted immediately on disconnect, the record after 30 days |
| GoFly: setup wizard step records | 365 days |
| GoFly: campaign drafts | Until you delete them; 30 days after the service ends |
| GoFly: technical operation log (no tokens) | 90 days |
| GoFly: replay and duplicate-request protection records | 15 minutes – 7 days |
12.8 Revocation and deletion
You can revoke Aurora's access at any time at https://myaccount.google.com/permissions. To have stored Google data deleted, email info@aurorayazilim.com; we will delete it, including tokens, within 30 days, except invoices we must keep by law. You can remove the link between your Google Ads account and Aurora's manager account at any time under Google Ads › Manager accounts; if you write to us, we remove it within 3 business days.
12.9 GoFly: linking your Google Ads account to your store
GoFly is a Google Ads management service for stores on the AuroraSoft e-commerce platform. When you enter your Google Ads customer ID in the GoFly setup wizard in your store panel and approve the preview, Aurora's manager account (MCC 290-791-1250) sends a link invitation to your account; the link is established only when you accept the invitation in Google Ads. In this context we process:
- The mapping between your store and your Google Ads customer ID and the link status (invitation pending, linked, removed)
- Your account name, currency, time zone and whether billing setup is approved (not card or bank details)
- The setup wizard steps and their dates; results of readiness checks
- Search campaign drafts you prepare and approval records
This information is kept in Aurora's Google Ads service (Cloudflare Workers and the Cloudflare D1 database); each store sees only its own account, and a Google Ads account can be linked to only one store at a time. Ad spend is paid directly to Google; GoFly does not collect your ad budget and never receives your card details.
12.10 GoFly: Google sign-in
If you use "Continue with Google" in GoFly, you grant two separate permissions with your Google account, each requested in a separate step:
- Sign-in (name and e-mail;
openid,email,profile): used to show which Google account is connected and to suggest your e-mail for an optional manager invitation. We do not store your name; your e-mail is kept only in the encrypted connection record and shown masked. - Google Ads access (
adwords): used only to list the Google Ads accounts you can access (customer ID, account name, currency, time zone, status, whether it is a manager account) and, with your explicit approval, to link the account you choose to Aurora's manager account. Campaign operations are not performed with this permission; they are performed through Aurora's manager account with your approval for each change.
The authorization token we receive from Google is stored only server-side, encrypted with AES-256 and bound to your store; it is never given to browsers, the store panel, logs or third parties. Only a one-way hash of your Google account ID is kept. You can remove the connection at any time with the "Disconnect Google" button in your store panel or on your Google Account permissions page; when you disconnect from the panel, we also revoke the permission at Google and delete the token immediately.