Privacy Policy

This policy covers our website, customer hub, Morpheus assistant and AI assistant connections (MCP). ChatGPT, Claude and other MCP clients can connect to https://veriteknik.com/api/mcp. The data controller’s identity and contact details are below.

When you visit our website or use our services, we may collect various information: • Contact information (name, email, phone) • Company information • Technical data (IP address, browser info) • Usage data (page views, clicks) • Data collected through cookies and similar technologies

• Connection record: application name, user and company association, permission groups, spend cap, creation, use, expiry and revocation dates; hashes of authorization codes, access and refresh tokens; approval requests and a short-lived tool-result cache. • Tool inputs sent by your assistant on your behalf: operational data such as server, domain and support ticket identifiers, file paths, read-only diagnostic commands, DNS values and support messages. • Data returned by tools according to your request and permissions: company members’ identity and organizational information (email, title, role, membership and access history); customer and staff names in support communications; server names, IP addresses, domains, DNS values and configurations; balances, spending, prices, tax, invoices, payment status and method, refunds and contracts; support messages and activity history. • Content and activity read from your servers at your request: file contents and paths, logs, usernames, connection IP addresses and times, processes, containers, backup information and command output. Monitoring and service history may include availability, latency, certificate status, events, bandwidth and snapshot information. • Server command records: who ran which command on which server, when, its exit code and standard output/error output (stdout/stderr). Audit and traffic records may include IP address, time, action, user and browser information. The MCP connection does not ask for card details and does not store or use card details for payment operations; card fields are removed from operation inputs. Free-form content such as support messages, files and command output may contain personal data. Do not include card details or secrets in this content.

We process data to establish and perform service contracts, manage customer relationships, invoices and payments, provide technical support, prevent fraud and maintain security, meet legal obligations and send marketing communications you have consented to. For AI assistant connections, the purposes are to manage authorization and permission boundaries, carry out your requested operations, return results to your assistant, obtain required approvals, enforce spend caps and audit operational security. Notifications inform you about connection, security, approval and service operations. Depending on the operation, we rely on the grounds under KVKK article 5 of establishing or performing a contract, legal obligations, establishing, exercising or protecting a right, legitimate interests and explicit consent where required. Authorization on the OAuth screen determines which operations the assistant can perform.

• The AI assistant provider you choose to connect (for example, OpenAI for ChatGPT or Anthropic for Claude) receives tool results and, where needed, an approval link at your request. That provider processes data under its own privacy policy. • For domain availability checks, only the queried domain name is sent to the selected registrar (Alastyr, OpenProvider or DomainNameAPI, depending on configuration). Domain registration is a separate operation and may require registrant information. • When you request a TLS certificate, Let's Encrypt receives the domain and the email address you supply, or your account email if you do not supply one. • For notification delivery, the email delivery service (Google in the default SMTP configuration; the service used may differ), Slack, Telegram, Bird SMS and browser push services receive the recipient address/phone/chat identifier and notification content according to the channel. Delivery depends on the event type, linked channels and notification preferences; security notifications require email delivery. Support notifications may include ticket information. Meta WhatsApp is used only for other eligible notifications; MCP connection, approval and administrative-command notifications are not sent through that channel. • Sentry is used for error monitoring. Collection of user information, cookies, HTTP headers and bodies, URL query parameters, AI inputs/outputs, database query data and local variables is disabled in the configuration. • Cloudflare Turnstile receives the verification token and IP address for bot protection at sign-in. • Publication operations you request make DNS records and web files public. Servers or package repositories contacted by network diagnostics and administrative commands may receive request data depending on the command. • Data is shared with infrastructure, payment and e-invoice service providers to deliver the service, and with competent authorities when legally required. • Memory derived from a notification subject is processed in the Morpheus memory service; the text is sent to the configured embedding service to create a numerical representation for similarity searches. • Advertising conversion measurement: when the advertising integration is configured, a completed VPS order may send the gclid advertising click identifier, conversion action, event time, order value and currency to Google Ads; it may send the oppref advertising reference, order event identifier, event type and time, source page address and channel information, value, currency and product details (product code, name, type, quantity, value and currency) to OpenAI (ChatGPT Ads). The purpose is to measure which advertisement led to the order. This includes VPS orders placed through an MCP connection. Order attribution relies on an advertising click captured when you accepted marketing cookies. For orders placed outside the browser, previously recorded consented advertising attribution on your account is used; it is not used if recorded marketing consent has been withdrawn. The recorded marketing preference is checked again before sending to OpenAI, and nothing is sent if consent has been withdrawn. In the Email Security Posture flow, when a gclid is present and the Google Ads integration is configured, a completed scan and a lead converted into a sale may send the click identifier, conversion action, event time, value and currency to Google Ads. The scan sends a value of TRY 0; a lead converted into a sale sends the recorded sale value and TRY. The purpose is to measure which advertisement led to the scan or sale. These sending paths do not check the marketing cookie preference; rejecting cookies does not automatically stop these sends. To stop order measurement that depends on marketing consent, write to gdpr@veriteknik.com to withdraw the marketing consent recorded on your account. Rejecting marketing in the cookie banner stops new advertising attribution from being recorded in that browser; on its own it does not withdraw consent already recorded on your account. You can also send objections to advertising measurement in the Email Security Posture flow to this address.

Among the recipients above, AI assistant providers and international notification, certificate and bot protection services (for example, OpenAI, Anthropic, Slack, Telegram, Let's Encrypt and Cloudflare) may process data outside Turkey. When you connect an AI assistant and request an operation, tool results are sent to your chosen provider on your instruction. The KVKK provisions on international transfers apply to these transfers. Google (Google Ads) and OpenAI (ChatGPT Ads), which receive the data described above for advertising conversion measurement, may also process data outside Turkey in this role.

• Account and company profile: while the account is active. When the account is closed it is archived; records with a financial or legal footprint are kept for 10 years. • Invoices, contracts and payment records: 10 years. • AI assistant connection record (application name, permission groups, spend cap, dates): while the connection is valid (90 days, renewed on reconnect); deleted 2 years after revocation or expiry. A connection record tied to a paid order is kept for the same period as the order record (10 years). • The record of a billable operation (VPS creation or domain registration) whose outcome remains unresolved, and its associated connection record, are retained until reconciliation is complete; the 2-year deletion rule above does not apply to these records. • Access / refresh tokens: valid for 1 hour / up to 60 days; stored only as hashes; deleted 7 days after they stop being valid. • Authorization code: valid for 60 seconds; deleted after 24 hours. • Approval requests / short-lived retry cache of a tool result: valid for 15 minutes / 10 minutes; deleted 24 hours after they expire. • Audit and traffic logs (IP address, time, action): 2 years (Law No. 5651 article 5/3). • Governance audit ledger (sign-in, permission, DNS and approval events; who, when, IP address, browser): kept as a tamper-evident chain your company can audit; retained for the life of the account and 10 years after the account is closed. • Server command log (who, which server, which command, time, exit code and command output): 2 years. • Service data (server configuration, DNS records, domains, support tickets): for the duration of the service and the account. • Assistant memory derived from a notification subject: removed from active memory after 14 days; its copy in the search index is deleted by the nightly cleanup; the record is permanently deleted 30 days after that deletion is confirmed.

We do not sell your personal data. MCP tool calls are not sent to a conversational model on our side to execute the tools. Memory created from notification subjects remains short-lived memory and is not promoted into persistent learning memory. This statement does not cover the data processing practices of your chosen AI assistant provider.

We implement industry-standard security measures to protect your data: • SSL/TLS encryption • Firewalls and monitoring • Access control and authorization • Regular security audits • ISO 27001 compliant processes

In the customer hub, go to Settings > Agent Connections > Connected Apps (MCP) to list your connections, revoke access, narrow permission groups and change each connection’s monthly spend cap. Revocation immediately ends the connection’s authorization; stored records remain subject to the periods above. A connection expires after 90 days unless renewed. If you have permission to manage servers, you can review the commands run on your servers, who ran them and their output for the whole retention period (2 years) in the customer hub under Activity History > Server commands; credentials in commands and output are masked. Destructive operations requiring approval wait for your approval in the hub. Not every change requires approval. The one deletion exception: a VPS that a connection created and marked as disposable at creation can be deleted by that same connection without approval. You can use the preference settings in the cookie banner, block cookies in your browser or clear site data and choose your preferences again. Clearing site data also removes your session and visitor identifier and does not withdraw the marketing consent recorded on your account; to do that, write to gdpr@veriteknik.com. You can withdraw marketing consent through the contact channels below. To exercise your rights under KVKK article 11, including information, correction, deletion and objection, contact gdpr@veriteknik.com, the registered electronic mail (KEP) address veriteknik@hs01.kep.tr, the postal address below or use the KVKK request form. Requests are answered within 30 days.

We use cookies on our website. For detailed information about cookies, please see our Cookie Policy. You can manage or disable cookies through your browser settings.

As part of the Morpheus AI Operations Assistant service, your interaction data is processed for service delivery. CogMem-AI cognitive memory system extracts operational patterns from these interactions and irreversibly anonymizes them before adding to a collective knowledge base. The anonymization process includes removal of personal identifiers, statistical generalization, and differential privacy techniques. Anonymization completes within 30 days. Anonymized data falls outside the scope of KVKK Article 28/1-b. You can opt out of collective learning at any time. Visit our KVKK information page for details. The Morpheus/CogMem description above is not the retention period for MCP tool results. The relevant sections of this policy apply to MCP connections and notification memory.