Privacy Policy

This Privacy Policy explains how Alphacore Yazılım Anonim Şirketi("we", "us") collects, uses, shares, and protects personal data when you use Quilpen (the "Service"). We are the data controller for personal data processed through the Service.

1. What we collect

You give us

• Account data: name, email, hashed password, and (if you sign in with Google) Google account ID + profile photo URL.
• Project content: manuscripts, chapter outlines, sources you upload, citations, and any text you generate or edit through the Service.
• Billing data: handled by our payment processor (Paddle); we receive only a customer ID, subscription status, the last four digits of the card, country, and invoice metadata. We never see your full card number.

Collected automatically

• Usage data: AI-operation logs (which feature, how many credits, model used, token counts), error logs, request paths, timestamps.
• Device data: IP address (truncated for analytics), browser type, OS, screen size, and a session cookie used to keep you signed in.

2. Why we use it (legal bases under GDPR)

• To provide the Service — performance of the contract you have with us (Art. 6(1)(b) GDPR).
• To process payments and send transactional email — performance of contract.
• To secure the Service, prevent abuse, and debug issues — legitimate interest (Art. 6(1)(f)).
• To improve the Service in aggregate (anonymised metrics) — legitimate interest.
• To comply with legal obligations (tax, accounting, lawful requests) — legal obligation (Art. 6(1)(c)).

We do not use your project content to train AI models, and we do not sell personal data to third parties.

3. How AI processing works

When you trigger an AI operation (e.g. drafting a section, generating an abstract), the relevant excerpt of your project — and only that excerpt — is sent over TLS to Anthropic's API. Anthropic processes the request to return a completion and does not retain the data for model training under the API terms applicable to us. See Anthropic's privacy policy.

4. Subprocessors

We share personal data only with the following subprocessors, each bound by a data processing agreement and appropriate transfer safeguards (Standard Contractual Clauses where applicable):

5. International transfers

Some subprocessors (Anthropic, Cloudflare, Resend, Google) are based in the United States. Where we transfer personal data outside the EEA / United Kingdom, we rely on the European Commission's Standard Contractual Clauses (and equivalent UK IDTA) as the transfer mechanism, supplemented by encryption in transit and at rest.

6. How long we keep data

• Account & project content: for as long as your account is active. Deleted immediately on account deletion request, except backups (purged within 30 days).
• Billing records: retained for the period required by tax law (typically 5–10 years).
• Server & AI-operation logs: 90 days, then deleted or anonymised.

7. Your rights

Under GDPR, KVKK (Türkiye), and similar laws, you have the right to:

• access the personal data we hold about you,
• correct inaccurate data,
• delete your data (the "right to be forgotten"),
• restrict or object to processing,
• receive your data in a portable, machine-readable format,
• withdraw consent (where consent is the legal basis),
• lodge a complaint with your supervisory authority (in the EU/UK) or the Personal Data Protection Authority of Türkiye (KVKK Kurumu).

To exercise any right, email [email protected]. We respond within 30 days.

8. Cookies and analytics

We use a single first-party session cookie to keep you signed in. It is strictly necessary and is set whether or not you accept anything else. The Paddle checkout iframe sets cookies necessary for payment fraud-prevention; see Paddle's cookie policy.

We use Google Analytics to understand how the site is used — which pages are visited, where visitors arrive from, roughly where in the world they are. It runs only if you accept it on the banner shown on your first visit. If you decline, or if your browser sends a Do Not Track or Global Privacy Control signal, the Google Analytics script is never loaded at all: no request is made and no analytics cookie is set. Declining changes nothing about how the product works.

We do not use advertising cookies, and Google Analytics is configured with advertising features and ad personalisation switched off and IP addresses anonymised. Analytics never receives your email address, your account identifier, or anything you write or upload.

Your choice is stored in your browser, not on our servers, so it is per browser and per device. To change it, clear this site's stored data in your browser settings; the banner will then ask again. See Google's privacy policy for how Google processes the data it receives.

9. Security

We protect personal data with TLS 1.2+ in transit, encryption at rest in the database, role-based access control for engineering, and regular dependency patching. No system is 100% secure; we will notify affected users without undue delay if a breach affects their personal data.

10. Children

The Service is not directed to children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes

We will post material updates here and notify active users at least 14 days before they take effect.

12. Contact

For privacy questions or to exercise your rights, email [email protected]. The data controller is Alphacore Yazılım Anonim Şirketi, Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. A1 Blok No: 151/1C İç Kapı No: B35, Esenler/İstanbul, Türkiye (tax office: Esenler; tax ID: 0570603499).