Privacy Policy

1. Who we are

Perquery is published and sold by Peaksense and developed by Suzy Studio. In this policy, “Perquery”, “we” and “us” mean Peaksense.

Peaksense is the data controller for your account, team and billing data. For the data you add to Perquery about your own sites and business (sites, prompts, personas, uploaded logs and connected accounts), we process it on your behalf to provide the service.

To contact us about privacy, use the contact form at peaksense.com.tr/iletisim.

2. Data we collect about you

• Account: your first name, last name and email address, and your password, which we store only as an Argon2 hash. If you sign in with Google, we receive your name, email address and Google account ID.
• Profile: your answers to the onboarding questions about your role and team size.
• Organisation and team: the organisations you belong to, your role in each, and the email addresses of people you invite.
• Security: your active sign-in sessions with the IP address and browser user agent, password reset requests with the IP address and user agent, your two-factor settings (stored encrypted) and API keys (stored hashed).
• Billing: your plan, subscription status, payment amounts and dates, and the reference numbers iyzico gives us.
• Service emails we send you, such as invitations, password resets and billing notices.

At checkout you enter your phone number, Turkish ID number and billing address. These go directly to iyzico for the subscription and are not stored by Perquery. Card details are entered only in iyzico’s payment form and never reach our servers.

3. Data you add to Perquery

• Sites, domains, competitors, personas and prompts you create, and the answers AI engines give to your prompts.
• Public page content we crawl from the sites you add, and the screenshots and HTML that LLM Inspect captures.
• Server access logs you upload. We keep the raw file for at most one hour while we read it, then delete it. We keep daily counts per AI bot, page and status code. We do not read or store the IP addresses in your logs. We keep up to five user agent strings that did not match a known bot, shortened to 120 characters.
• Google Search Console, Google Analytics 4 and Google Ads accounts you connect. We store the access tokens encrypted and import only aggregated metrics such as queries, clicks, impressions, sessions, conversions and cost.

Do not put personal data about other people in prompts or persona descriptions. They are sent to AI providers to produce answers.

4. How we use your data

• To create and secure your account and to let you work with your team.
• To run scans, analyses and tools you ask for.
• To take payments and manage your subscription.
• To send service emails about your account, team and billing.
• To detect abuse, failed sign-in attempts and security problems.

We do not sell your data, we do not use it for advertising and we do not use analytics or tracking tools on the site or in the app.

Under the Turkish Personal Data Protection Law (KVKK) and, where it applies, the GDPR, we rely on performance of our contract with you, our legal obligations and our legitimate interest in keeping the service secure.

5. How AI providers receive your data

To measure AI visibility, Perquery asks your prompts to the AI engines you track. Each engine receives the prompt text, the persona description and the market (country and language).

To score answers, we send your brand and competitor names and domains and the answer text to OpenAI. Crawled page text is sent to OpenAI to build your brand profile, suggest prompts and personas, run the content tools and create search embeddings.

These providers process the data under their API terms. We do not send your account details, such as your name or email address, to AI providers.

6. Who processes data for us

AI engines that you do not track for a site do not receive that site’s prompts.

7. Transfers outside Türkiye

Several of these providers, including OpenAI, Anthropic, Google, Perplexity, xAI and DeepSeek, process data outside Türkiye, for example in the United States or China. We transfer data to them only as needed to provide the features you use, and in line with the rules on cross-border transfers in the KVKK and, where it applies, the GDPR.

8. How long we keep data

When an organisation is deleted, its data is erased after a 30-day grace period. Audit and usage records are kept for the periods above without a link to the organisation.

9. How we protect data

• Passwords are hashed with Argon2; API keys and recovery codes are stored hashed.
• Two-factor secrets and integration tokens are stored encrypted.
• All traffic is encrypted with TLS.
• Sessions end after 12 hours of inactivity and after 7 days at most, and accounts lock after repeated failed sign-ins.
• Our logs redact passwords, tokens, card numbers, ID numbers, phone numbers and addresses.

10. Your rights

Under the KVKK (Article 11) and, where it applies, the GDPR, you can ask us whether we process your data, get a copy of it, have it corrected or deleted, object to processing, ask which third parties receive it, and ask for compensation if you are harmed by unlawful processing.

To make a request, including deleting your account or organisation, use the contact form at peaksense.com.tr/iletisim. We answer within 30 days. You can also complain to the Personal Data Protection Authority (KVKK) in Türkiye or to your local data protection authority.

11. Children

Perquery is a business service and is not meant for people under 18. We do not knowingly collect data from children.

12. Changes to this policy

We will update this page when our practices change and change the date at the top. For significant changes, we will tell account owners by email before they take effect.

13. Contact

Peaksense publishes Perquery. For questions about this policy or your data, use the contact form at peaksense.com.tr/iletisim.