Privacy Policy
Version 1.0 · Effective 2026-11-07
This Privacy Policy explains how personal data is handled when you use NamSeo, an AI-assisted SEO service provided under the NamLab brand by Namiştain Global Dış Ticaret Limited Şirketi, a company registered in Türkiye ("NamLab", "we", "us"). It covers the NamSeo app for Shopify, the NamSeo web app at namseo.namlab.com.tr, the NamSeo Connector WordPress plugin, the NamSeo code snippet and our marketing website (together, the "Service").
In short. We use your data to provide the Service. We do not sell it and we do not use it for advertising inside the app. NamSeo does not write anything to your store or website without your approval, unless you turn on the optional automatic mode. The Shopify app does not access your orders or your customers' data. AI providers process page content under their commercial API terms, which state inputs are not used to train models. You can export or delete your data at any time.
1. Who we are and our role
Controller: Namiştain Global Dış Ticaret Limited Şirketi (NamLab), Çalı Mah. Ahıska Cad. Enmes Group No:209, Nilüfer / Bursa, Türkiye. Privacy requests: info@namistainglobal.com. Support: namlab@namistainglobal.com. We have not appointed a data protection officer; all privacy questions are handled through info@namistainglobal.com.
We act in two roles:
- As controller for the data we need to run our business: your account, subscription and billing information, security logs, support messages, legal acceptance records and the optional advertising measurement on our marketing site.
- As processor (service provider) for the content of your store or website that NamSeo reads or crawls, your Google Search Console data, the changes you approve and, if you use the code snippet, the technical request data of your site visitors. We process this data on your behalf and only on your instructions; you, as the store or site owner, are the controller. A Data Processing Agreement (DPA) for this processing is available on request at info@namistainglobal.com.
2. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, business or agency name, password (stored only as a one-way hash), language, user role | You |
| Shopify store data | Store name, myshopify domain and primary domain, store contact email, subscription status, the access token Shopify issues to NamSeo; titles, descriptions, text and image information (such as image URLs and alt text) of products, collections, pages and blog posts | Shopify, with the permissions you approve at installation |
| Website data | Text, image links and alt text, URLs and technical data of the public pages of your website; this may include personal data you have published (for example staff names or customer reviews) | Our crawler (NamSeoBot/1.0) reads only public pages |
| Search Console data (optional) | Queries, pages, clicks, impressions, average position, country and device breakdown | Google, only if you connect Search Console |
| SEO market data | Keywords you track, competitor domains, public search results and public Google Business Profile information (name, address, phone, opening hours, category, rating) | You and DataForSEO |
| Suggestions and change log | AI suggestions, content drafts, your instructions, approved changes with previous values, who approved or undid a change and when | Generated in the Service |
| Billing data | Shopify: plan, billing cycle and charge status as reported by Shopify (no card data). Direct purchases in Türkiye: name, address, phone, tax details and payment result from PayTR | Shopify, you, PayTR |
| Usage and security data | Session tokens (stored only as hashes), login attempts, IP address, timestamps, usage counters, accepted version of our terms with time and IP address | Automatically when you use the Service |
| Communications | Support emails and notes, your weekly summary email preference | You |
| Advertising measurement (marketing site, only with consent) | Google Ads click ID, cookie identifiers, IP address, browser information, visited page and the sign-up event | Your browser sends it directly to Google (see section 5) |
| Your site visitors (code snippet only) | IP address, browser user agent and referring page, processed briefly by Cloudflare to deliver the snippet; NamLab does not store them | Your visitors' browsers |
What we do not collect. The Shopify app requests only these permissions: read and write products, read and write content (blogs and articles), read and write online store pages. It does not request access to your orders or your customers, and NamSeo stores no personal data of your store's customers. We do not request special categories of data (such as health data) and we never receive card numbers. Please do not enter passwords, card data or sensitive personal data into instruction fields.
Is it required? An email address and a store or website are needed to create an account and provide the Service. Search Console is optional. Billing data is needed only for paid plans.
3. Purposes and legal bases
Where the EU or UK GDPR applies, we rely on the following legal bases (Article 6(1) GDPR):
| Purpose | Legal basis |
|---|---|
| Creating and running your account; crawling and reading your content; preparing suggestions; applying the changes you approve and undoing them; rank tracking, reports and the weekly summary email | Performance of a contract (Art. 6(1)(b)) |
| Managing plans, trials, usage limits and your Shopify subscription | Performance of a contract (Art. 6(1)(b)) |
| Customer support | Performance of a contract (Art. 6(1)(b)); for general enquiries, our legitimate interest in answering you (Art. 6(1)(f)) |
| Security, preventing abuse and preventing repeated free trials | Legitimate interests in protecting the Service and its users (Art. 6(1)(f)) |
| Keeping records of accepted terms, approvals and undo actions; establishing or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
| Tax, accounting and commercial record-keeping | Legal obligation (Art. 6(1)(c)) where the obligation arises under applicable law; otherwise our legitimate interest in complying with the Turkish laws that bind us (Art. 6(1)(f)) |
| Measuring whether our Google ads lead to sign-ups (marketing site only) | Consent (Art. 6(1)(a)), together with consent for the related cookies |
| Improving the Service using aggregated statistics that do not identify you | Legitimate interests (Art. 6(1)(f)) |
For data we process as a processor (section 1), the legal basis is determined by you as the controller. Where we rely on legitimate interests you may object (section 10). We do not currently send marketing emails; if we start, we will ask for your consent where the law requires it. Service emails (such as security notices, billing information and the weekly summary) contain no promotions, and you can turn off the weekly summary in Settings.
4. How we use AI
- Suggestions and drafts are prepared with Anthropic's Claude models. If Claude is unavailable, the request is automatically sent to an OpenAI model as a fallback.
- For each task we send only what is needed: the content and technical details of the relevant page or product, keywords, your business information, your instructions and, where needed, aggregated Search Console data with unnecessary personal data removed. We do not send your account, billing or payment details. Image files are not sent; alt text is suggested from the file name and surrounding text, and no facial recognition is used.
- Both providers are used under their commercial API terms, which state inputs are not used to train models. They may keep inputs and outputs for a limited period for safety and abuse monitoring, as described in their terms. We do not use your content to train any models.
- NamSeo makes no decisions about people that have legal or similarly significant effects (Article 22 GDPR). AI output can be wrong; you review every suggestion before it is applied.
- Text found on crawled pages is treated as content to analyze, not as instructions to NamSeo.
5. Cookies and similar technologies
Inside the app (including when NamSeo opens inside your Shopify admin) we use only essential browser storage and no third-party analytics, advertising or tracking scripts:
| Name | Purpose | Duration |
|---|---|---|
| ns_token (local storage) | Keeps you signed in (random session key) | Until logout; invalid on our server after 30 days at most |
| ns_site (local storage) | Opens the site you selected last | Until logout or until you clear browser data |
| ns_cerez, ns_dil (local storage) | Remembers your cookie choice and language | Until you clear browser data |
Shopify's own admin pages may use Shopify cookies, which are governed by Shopify's privacy policy.
On our marketing site and the sign-in/sign-up page, the Google Ads and Google Tag Manager tag loads only if you click Accept in the cookie banner. It measures whether a click on one of our Google ads led to a sign-up. It may set cookies such as _gcl_au and _gcl_aw (google.com / doubleclick.net), kept up to 90 days according to Google. If you click Reject or make no choice, the tag is not loaded. You can withdraw your consent at any time by clearing this site's data in your browser (this removes the ns_cerez choice) and choosing again; withdrawal does not affect earlier processing. We never pass your name, email address, website or account data to this tag.
On your website, the NamSeo code snippet sets no cookies or local storage and does not track or profile your visitors. Our fonts are served from our own servers.
6. Who receives your data
We do not sell personal data. We share it only with the providers that help us run the Service and with the independent services you choose to connect.
Our processors (sub-processors)
| Provider | What they do | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, crawling, delivery of the code snippet, network security | All Service data described above | US company; data centers worldwide |
| Anthropic, PBC | AI suggestions and drafts (Claude) | Content described in section 4; no account or billing data | United States |
| OpenAI, L.L.C. | Fallback AI model, only when Claude is unavailable | Same as Anthropic | United States |
| DataForSEO OÜ | Rankings, competitor, backlink and Google Business Profile data | Keywords, your and competitor domains, business name, location and language | Estonia (EU) |
| Zoho Corporation B.V. (Zoho Mail, EU data center) | Service, billing and weekly summary emails | Name, email address, email content, order and billing details | European Union |
Independent controllers
| Recipient | When | Note |
|---|---|---|
| Shopify (Shopify Inc., Canada / Shopify International Ltd., Ireland) | If you install NamSeo on Shopify | Handles installation, store access and billing under Shopify's own terms and privacy policy |
| Google LLC (Search Console) | Only if you connect Search Console | NamSeo reads data with read-only access; you can remove access in Search Console › Settings › Users and permissions |
| Google LLC / Google Ireland Ltd. (Google Ads) | Only if you accept cookies on our marketing site | See section 5 |
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (Türkiye) | Only for direct card payments made in Türkiye | Not used for Shopify billing |
We may also share data with our e-invoicing provider and accountant in Türkiye (for Turkish invoices), professional advisers where needed to establish or defend legal claims, and public authorities when the law requires it, after checking that the request is lawful and limiting what we disclose. We will notify you at least 15 days in advance in the app and by email before adding or replacing a sub-processor, and you may object.
7. International transfers
NamLab is based in Türkiye, and our team accesses data from Türkiye. Your data is also processed in the United States, in the European Union and in Cloudflare data centers worldwide. Türkiye and the United States are not covered by a general EU adequacy decision. Where the EU or UK GDPR applies and personal data is transferred to a country without an adequacy decision, we use standard contractual clauses approved by the European Commission (with the UK Addendum or UK International Data Transfer Agreement for UK data) or another mechanism recognized by the applicable law, such as an adequacy decision or a recipient's certification under the EU-U.S. Data Privacy Framework. Transfers from Türkiye follow the Turkish data protection law (KVKK) standard contracts. You can request a copy of the relevant safeguards at info@namistainglobal.com.
8. How long we keep data
| Data | Retention |
|---|---|
| Shopify installations | When you uninstall the app, the access token is revoked immediately. When Shopify sends its store data deletion request (shop/redact, normally 48 hours after uninstall), we delete your account and store data. |
| Account and site data (crawls, suggestions, change log, Search Console and ranking data) | While your account is active. For web accounts, up to 90 days after your trial or paid period ends so you can export or reactivate; immediately when you use Settings › Delete account |
| Backups | Up to 30 days |
| Session tokens | Invalid at logout; deleted after 30 days at most |
| Failed login counters | Up to 24 hours |
| Support correspondence | 3 years after the request is closed |
| Approval metadata (who approved which type of change and when, without content) | 90 days after access ends; longer only during an actual dispute |
| Records of accepted terms | At least 3 years; up to 10 years where Turkish commercial law requires |
| Invoices and payment records (direct purchases in Türkiye) | 5 years from the end of the year (tax law); commercial records 10 years |
| Trial-use record (one-way hash of the email address) | 2 years, only to prevent repeated trials |
| Security incident records | Until resolved, at most 2 years |
| Traffic data required by Turkish Law No. 5651, where applicable | 1 to 2 years, kept separately |
| Code snippet request data | Not stored by NamLab; only in Cloudflare's short-term platform logs |
| Copies held by AI and data providers | The limited period stated in the provider's API terms |
| Deletion logs | At least 3 years |
Deleting your data in NamSeo does not undo changes already written to your store or website.
9. Security
- Each customer's data is kept in a separate, isolated database object; accounts and sessions are stored in a separate directory database.
- All connections use HTTPS/TLS. Passwords are hashed with a per-user salt (PBKDF2-SHA256); session tokens are stored only as hashes.
- Search Console access is read-only and limited to the properties you add. The WordPress plugin key can be renewed or revoked by you at any time.
- Request contents are not written to application error logs. Service keys are kept outside the source code; access is limited to authorized people on a need-to-know basis.
- No card numbers or security codes ever reach our systems.
If a personal data breach occurs, we will notify the competent authority and affected people where the law requires. Where we act as your processor, we will inform you without undue delay and in any case within 24 hours of becoming aware of it.
10. Your rights
EU, EEA and UK. You have the right to access your data, to correct it, to have it erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting earlier processing. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where the alleged infringement took place (in the UK, the Information Commissioner's Office).
California and other US states. We do not sell personal information. Apart from the optional Google Ads measurement tag on our marketing site, which loads only if you click Accept, we do not share personal information for cross-context behavioral advertising, and you can decline it or withdraw your consent as described in section 5. You have the right to know which personal information we collect, use and disclose (the categories, sources, purposes and recipients are in sections 2, 3 and 6), and the rights to access, delete and correct it. We do not use sensitive personal information to infer characteristics about you, and we will not discriminate against you for exercising your rights. You may use an authorized agent; we may ask for proof of authorization.
Brazil (LGPD) and other countries. You may request confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share it with, and you may revoke consent. You may also complain to your local data protection authority (in Brazil, the ANPD; in Türkiye, the Personal Data Protection Board).
How to exercise your rights. You can correct most data in Settings, download your data in JSON format with Settings › Download my data, and delete your account with Settings › Delete account. On Shopify you can also uninstall the app. For any other request, email info@namistainglobal.com from the email address registered with us. We may need to verify your identity. We reply within one month (within 45 days where California law applies); if a request is complex, we may extend this period as the law allows and will tell you why. Requests are free unless they are manifestly unfounded or excessive.
If your data appears on one of our customers' sites or stores, that customer is the controller. We forward your request to them within 2 business days and help them respond. If you are a customer of a Shopify store that uses NamSeo: NamSeo does not store your personal data, so there is nothing for us to export or delete; please contact the store directly.
11. Children
The Service is meant for businesses and is not directed to children under 16; account holders must be at least 18. We do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We update this policy when our processing changes and show the version and effective date at the top. We will announce material changes in the app and by email at least 15 days before they take effect. Where a change requires your consent, we will ask for it. Previous versions are available on request.
13. Contact
Namiştain Global Dış Ticaret Limited Şirketi (NamLab) — Çalı Mah. Ahıska Cad. Enmes Group No:209, Nilüfer / Bursa, Türkiye — Trade Registry: Bursa 137340 — MERSİS: 0629172069800001.
Privacy requests: info@namistainglobal.com — Support: namlab@namistainglobal.com — Registered electronic mail (KEP): namistain.global@hs01.kep.tr — Phone (Türkiye): 444 4 982.
This policy is available in English and Spanish. If the versions differ, the English version prevails unless mandatory law provides otherwise. Customers in Türkiye: our Turkish notices, including the KVKK disclosure, are at /yasal/.
Namiştain Global Dış Ticaret Limited Şirketi (NamLab) · Çalı Mah. Ahıska Cad. Enmes Group No:209, Nilüfer / Bursa, Türkiye · Trade Registry Bursa 137340 · MERSİS 0629172069800001 · Tax Çekirge 6291720698 · Support namlab@namistainglobal.com · Privacy info@namistainglobal.com · All legal texts · Türkçe yasal metinler · Back to NamSeo