Sign in Sign up Free scan
Legal

Privacy Policy

Privacy Policy

This policy explains how Protan Bilişim Reklam ve Danışmanlık Hizmetleri Ltd. Şti. ("Protan", "we") collects, uses, protects and shares personal data when you use the protan.ai website, the free scan, a paid GEO measurement package, a Monitoring subscription, or any of our contact channels. It should be read together with the Cookie Policy.

Effective: 12 September 2026 · Version: 1.2

Contents

  1. 1. Who we are
  2. 2. What we collect
  3. 3. Why we use it, and on what legal basis
  4. 4. Measurement data and AI engines
  5. 5. Who we share it with
  6. 6. International transfers
  7. 7. How long we keep it
  8. 8. Children
  9. 9. Security
  10. 10. Your rights
  11. 11. Third-party links
  12. 12. Changes
  13. 13. Contact

1. Who we are

protan.ai is a GEO (Generative Engine Optimization) measurement and visibility service operated by Protan Bilişim Reklam ve Danışmanlık Hizmetleri Ltd. Şti., a company established in Türkiye. The service measures how often and how accurately a brand is mentioned in the answers of generative AI engines (ChatGPT, Gemini, Perplexity, Claude, Grok).

For the processing described here, Protan is the controller.

| | | | --- | --- | | Controller | Protan Bilişim Reklam ve Danışmanlık Hizmetleri Ltd. Şti. | | Address | 1471 Sok. No.9 D.51 Alsancak, Konak / İzmir, Türkiye | | E-mail | info@protan.ai |

This policy covers protan.ai and its subdomains, the free scan flow, the customer panel, and our e-mail, messaging and telephone correspondence. Links to third-party sites are governed by those sites' own policies.

2. What we collect

  • Free scan details: site URL, e-mail address, brand name and sector. Nothing beyond this is requested for a free scan.
  • Information you give us directly: name, telephone, company, contact person, positioning notes, competitor list and the content of your message, from the contact and order forms.
  • Contract data: order and subscription history, payment and collection records, invoicing details where these are required of us.
  • Measurement data: the prompt texts used during a scan, the publicly available answers returned by the AI engines, the calculated score components, competitor comparison output and scan timestamps. Together these are called the measurement record.
  • Automatically collected data: IP address, browser type, operating system, visit time, pages viewed, referring site, panel session records.
  • Cookie data: as described in the Cookie Policy.

Card details: your payment card details are never transmitted to our servers, never displayed to us and never stored by us. They go directly to the payment institution.

3. Why we use it, and on what legal basis

| Purpose | Legal basis (GDPR Art. 6) | | --- | --- | | Running a free scan you requested and sending you the result | Performance of a contract / steps taken at your request — Art. 6(1)(b) | | Setting up and performing a paid package or a Monitoring subscription: calculating the score, producing the roadmap and PDF report, publishing them in the panel, running periodic re-scans and score-drop alerts | Performance of a contract — Art. 6(1)(b) | | Invoicing, payment and statutory bookkeeping | Legal obligation — Art. 6(1)(c) | | Handling requests, complaints and technical support | Performance of a contract / legitimate interests — Art. 6(1)(b), (f) | | Protecting the service against fraud, abuse and attack; keeping security logs | Legitimate interests — Art. 6(1)(f) | | Improving the measurement methodology and site performance, using anonymised and aggregated data only | Legitimate interests — Art. 6(1)(f) | | Marketing e-mail, where you have asked for it | Consent — Art. 6(1)(a) | | Analytics cookies | Consent — Art. 6(1)(a) |

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that the processing is limited to what a user of this kind of service would reasonably expect.

We do not sell, rent or market your data to third parties, other than anonymous aggregate statistics. One customer's measurement record is never made available to another customer as competitor analysis or benchmarking input.

4. Measurement data and AI engines

  • During a free scan, no query is sent to any AI engine. The score is limited to the Structure and Authority components, computed from your publicly available website and public records.
  • In paid packages, the AI engines operated by OpenAI, Google, Perplexity AI, Anthropic and xAI are queried through their publicly available interfaces. What we send to them is limited to sector-generic prompt text and brand names; no personal data relating to you, your staff or your customers is sent to those engines.
  • The answers returned are stored in our own infrastructure as the measurement record, together with the brand name and sector, and are used for reporting, comparison and for assessing any objection you raise.
  • Part of the scan runs automatically and part is checked manually by our operators. Access to a measurement record is limited to the operator running that scan and to the customer account it belongs to.
  • What the results are: scores reflect model behaviour at the moment of the scan. AI output changes over time and from query to query; results are neither a guarantee nor an undertaking.
  • Trade marks: ChatGPT, Gemini, Perplexity, Claude and Grok are trade marks of their respective owners. protan.ai is an independent service; it is not affiliated with, endorsed by or sponsored by any of them.

5. Who we share it with

Your data may be shared, where performance of the contract, a legal obligation or your consent requires it, with:

  • our processors: hosting and cloud infrastructure, e-mail and notification delivery, accounting, legal and audit advisers;
  • Dodo Payments, which acts as merchant of record and handles the payment and the associated tax and invoicing obligations;
  • competent public authorities and courts, where a lawful request is made;
  • a new controller, in the event of a merger, transfer or acquisition of the business.

AI providers are not on this list. No personal data is transferred to them.

6. International transfers

Our infrastructure is operated in Türkiye, which is not covered by a European Commission adequacy decision. Where personal data of individuals in the European Economic Area or the United Kingdom is transferred to us, that transfer is made on the basis of the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with the technical and organisational measures described in section 9.

You may request a copy of the relevant safeguards at info@protan.ai.

7. How long we keep it

| Data | Retention | | --- | --- | | Free scan records | 90 days from the request, then deleted automatically — earlier on request | | Customer account and measurement records | For the duration of the customer relationship and, afterwards, for the period required by the applicable statute of limitations | | Invoicing and payment records | For the statutory bookkeeping period | | Contact form and correspondence | Until the matter is closed, plus a reasonable period for follow-up questions | | Security and access logs | Short-term, only for as long as they serve a security purpose | | Cookie data | As stated in the Cookie Policy |

8. Children

The service is not directed at people under 18 and we do not knowingly collect their personal data. If we learn that we hold data about a child, we delete it as soon as possible.

9. Security

We apply SSL/TLS, a web application firewall, DDoS protection and regular backups. Connections are forced onto an encrypted channel with HSTS; stored payment keys are encrypted in the database. The customer panel and administration interfaces are password-protected, the administration interface can additionally be restricted by IP, and failed sign-in attempts are rate-limited. Access is granted on a need-to-know basis and our staff are under confidentiality obligations.

No data transmitted over the internet is ever completely secure. In the event of a personal data breach we notify the competent supervisory authority within 72 hours where the breach is notifiable, and we inform affected individuals where the breach is likely to result in a high risk to them.

10. Your rights

Where the GDPR or the UK GDPR applies to you, you have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these, write to info@protan.ai. We respond within one month; where a request is complex we may extend that period by a further two months and will tell you if we do. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

In addition, without needing to invoke any of the above:

  • you may ask us to delete your free scan record at any time by writing to info@protan.ai;
  • you may end a Monitoring subscription from the customer panel whenever you wish; it takes effect at the end of the period already paid for;
  • you may unsubscribe from any marketing e-mail using the link at the foot of the message;
  • you may change your cookie choices as described in the Cookie Policy.

Complaints. You have the right to lodge a complaint with a supervisory authority — in the EEA, the authority of the member state where you live, work, or where the alleged infringement took place; in the UK, the Information Commissioner's Office. In Türkiye, the Personal Data Protection Authority (KVKK) is competent. We would ask you to contact us first so that we have the chance to put things right.

11. Third-party links

Our pages and reports contain links to third-party sites — source articles, directories, addresses cited in AI answers, social media. protan.ai is not responsible for their content or their privacy practices; we suggest reading a site's own policy before leaving ours.

12. Changes

When we make a material change we update the effective date at the top of this page, and, where it matters, tell you by e-mail or a notice in the service.

13. Contact

Protan Bilişim Reklam ve Danışmanlık Hizmetleri Ltd. Şti. 1471 Sok. No.9 D.51 Alsancak, Konak / İzmir, Türkiye info@protan.ai

This English text is published so that you can read it in your own language. Protan is established in Türkiye and the Turkish version of this policy, at protan.ai/tr/gizlilik, is the version that governs; nothing in this text limits any right you have under the GDPR, the UK GDPR or your local law.