Privacy Notice

Signing in with Google or authorising the Ubden® app? Section 13 explains exactly which Google user data the app accesses, how we use, store, protect, share and delete it, and how you can revoke access.

1. Introduction

This Privacy Notice describes how Ubden® LLC, Ubden Teknoloji A.Ş., and Ubden OÜ (collectively "Ubden," "we," "us," or "our") collect, use, disclose, and protect information. By using our services, you consent to the practices described in this notice.

We are not responsible for any damages, losses, or liabilities arising from your use of our website or services.

2. Information We Collect

We may collect the following types of information:

• Personal Information: Name, email address, phone number, company name, and any information you voluntarily provide
• Technical Information: IP address, browser type, device information, cookies, and usage data
• Business Information: Project requirements, communications, and service-related data

You are solely responsible for the accuracy and legality of any information you provide to us.

3. How We Use Information

We use collected information for:

• Providing and improving our services
• Communicating with clients and prospects
• Analyzing website usage and performance
• Complying with legal obligations
• Marketing and promotional purposes (with your consent)

We make no guarantees about the security or confidentiality of information transmitted over the internet.

4. Information Sharing, Service Providers and Processors

In line with our I.T.S.E. values and our principle of transparency, we disclose as fully as we can the technologies that may touch your data and the providers that process data on our behalf. We share information only with the parties below and only to the extent each task requires.

4.1 AI service providers

• Anthropic PBC (Claude; USA)
• OpenAI (ChatGPT and the OpenAI API; USA)
• Local models running on Ubden® servers (open models such as Qwen, run with Ollama): data sent to these models does not leave Ubden® infrastructure.

What for: drafting replies to support requests and correspondence, summarising and translating documents, software development, reporting and automating business processes. Which data: only the correspondence, documents and request content the task requires. We use cloud AI providers under commercial terms that do not allow our inputs and outputs to be used to train their models. Google user data is sent only to the provider named in 13.4.

4.2 Messaging and social media platforms

• Meta Platforms: WhatsApp and WhatsApp Business, Instagram, Facebook and Messenger
• LinkedIn, X and the other social networks where we have an account (e.g. YouTube)

What for: replying when you write to us on these channels, handling support and sales conversations, and sharing announcements and promotions. Which data: name or username, phone number, message content and files you share. These platforms also process data independently for their own services under their own privacy policies; the platform concerned is responsible for that processing.

4.3 Email, document and communication tools

• Microsoft (Microsoft 365): Exchange Online and Outlook email, SharePoint and OneDrive document storage, Teams calls and chats

What for: business email, storing and sharing documents such as quotes, contracts and invoices, and meetings. Which data: contact details, correspondence, documents and meeting information.

4.4 Cloud hosting and object storage (S3)

• Amazon Web Services (AWS)
• Cloudflare (DNS, content delivery, security and R2 object storage)
• Hetzner Online (Germany; servers and object storage)
• Google Cloud
• Our own servers controlled by Ubden®

What for: running our website, applications and databases, and storing files and backups. Which data: all categories of data processed in these services. Traffic between our systems is encrypted with TLS (HTTPS).

4.5 Remote support software

• AnyDesk, Alpemix, TeamViewer

What for: connecting to your device only in support sessions you request and approve; you can watch the session and end it at any time. Which data: device ID, IP address and connection logs; during the session, the content on your screen and any files you transfer.

4.6 Backup and security

• Acronis (backup, disaster recovery and malware protection)

What for: backing up our systems and, under a service contract, our customers' systems, restoring data after a loss and preventing security threats. Which data: the data on the systems being backed up.

4.7 Website analytics

• Google Analytics (Google)

Runs only if you allow analytics in your cookie preferences; it processes usage data such as visits, page views and device information.

If you have allowed analytics, the random visitor ID of Google Analytics is attached to a request you send through a form on the website or the WhatsApp button; in a WhatsApp message it appears as a "(Ref: …)" code. After the request has been handled in our customer communication platform, which runs on our own servers, its outcome (for example a qualified request or a new customer, and the deal amount where there is one) is reported to Google Analytics under the same ID. This lets us measure which pages and channels actually bring customers. Your name, email address, phone number and message content are not sent to Google. If you have also allowed marketing cookies, the ad click ID (gclid) is attached to the request. If you withdraw analytics consent, new requests are no longer matched.

Google AdSense ads are shown on our community forum (forum.ubden.com). If you allow third-party (Google) cookies in your cookie preferences, Google may use advertising cookies and personalise ads based on your interests; if you do not, ads are shown without advertising cookies and without personalisation (Google Consent Mode).

4.8 Other recipients

• Business partners, to the extent the service requires: software and hardware vendors and distributors (licensing, activation and warranty), payment institutions and banks, accountants and legal advisers
• Ubden® group companies (Ubden® LLC, Ubden Teknoloji A.Ş. and Ubden OÜ)
• Competent public authorities and courts where the law requires

4.9 Acceptance of this list and your choices

The providers above are technical components of our website, applications and services and cannot be switched off for individual users. By continuing to use the website, our applications or our services, you therefore accept that your data is processed through the providers listed in this section. If you do not accept one or more of them, you should not use the service or channel concerned; for example, you can write to us by email instead of WhatsApp.

This processing relies on the legal grounds of providing the service (entering into and performing a contract), our legal obligations and our legitimate interests (KVKK Art. 5(2)(c), (ç), (f); GDPR Art. 6(1)(b), (c), (f)). Processing that the law makes subject to consent, such as analytics and marketing cookies and promotional messages, falls outside this acceptance: it happens only with the consent you give in your cookie preferences or separately, and you can withdraw that consent at any time. Your right to object to processing based on legitimate interests and your other rights in Section 6 remain unaffected.

We update this section when the list changes. You can ask which provider is used for a specific service at privacy@ubden.com.

5. Data Retention

We retain information for as long as necessary to fulfill the purposes outlined in this notice, comply with legal obligations, resolve disputes, and enforce agreements. We reserve the right to retain or delete data at our discretion.

6. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the use of your personal information. To exercise these rights, contact us at privacy@ubden.com.

We will respond to requests at our discretion and are not obligated to fulfill all requests.

7. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to enhance user experience and analyze website traffic. Strictly necessary cookies that the website needs to work are always used; analytics and marketing cookies run only if you allow them in your cookie preferences, and you can withdraw that permission at any time. You may disable cookies in your browser settings, but this may limit website functionality.

8. International Data Transfers

We operate globally (USA, Turkey, Estonia). Because of the providers in Section 4, your data may be transferred in particular to the United States and to countries of the European Union and the European Economic Area (e.g. Germany, Ireland), and may be processed in the providers' data centres worldwide. For these transfers we rely on the following safeguards:

• Transfers from Turkey (KVKK Art. 9): transfers to countries covered by an adequacy decision of the Board; where there is none, appropriate safeguards such as standard contracts, binding corporate rules or a written undertaking; and, in occasional cases where these cannot be provided, the exceptions listed in the Law (for example where the transfer is necessary to perform a contract, or with your explicit consent).
• Transfers from the EU and EEA (GDPR Chapter V): adequacy decisions of the European Commission (including the EU-U.S. Data Privacy Framework where the recipient is certified) or the Commission's Standard Contractual Clauses.

Whatever country the recipient is in, transferred data is limited to the purposes in this notice and is encrypted with TLS in transit. You can ask which safeguard we rely on for a specific transfer at privacy@ubden.com.

9. Security

While we implement reasonable security measures, we cannot guarantee absolute security. You acknowledge that internet transmission and data storage carry inherent risks. We are not liable for unauthorized access, data breaches, or security incidents.

10. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect information from children. If we discover we have collected such information, we will delete it promptly.

11. Changes to This Notice

We reserve the right to modify this Privacy Notice at any time without prior notice. Changes become effective immediately upon posting. Your continued use of our services after changes constitutes acceptance.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, UBDEN® SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING FROM YOUR USE OF OUR WEBSITE OR SERVICES, INCLUDING BUT NOT LIMITED TO DATA BREACHES, PRIVACY VIOLATIONS, OR UNAUTHORIZED ACCESS.

13. Google User Data and the Ubden® App

This section applies to the Google OAuth application that Ubden® publishes under the name Ubden® (the "App"). It is the name you see on the Google sign-in and consent screen; the App's home page is www.ubden.com/google-integrations. This section explains which Google user data the App accesses, how we use, store, protect and share that data, how long we keep it, and how you can revoke access and have it deleted. For Google user data, this section prevails over any more general or less protective statement elsewhere in this Privacy Notice, including sections 4, 5, 6 and 9.

13.1 Who uses the App

The App is not a public consumer product and has no self-service sign-up. It is used by authorised Ubden® staff and by clients who have engaged Ubden® under a service agreement to manage their Google Ads, Google Analytics or Google Business Profile accounts. Account holders grant access themselves on Google's consent screen and can withdraw it at any time (see 13.8). The App is not intended for anyone under 18.

13.2 Google user data the App accesses

The App requests only the Google OAuth scopes listed below. Each scope is used only for the purpose stated next to it.

• Google Ads (https://www.googleapis.com/auth/adwords): names and IDs of the Google Ads accounts you can access (in practice the accounts linked to our manager accounts "Ubden Self", 635-427-6533, and "Ubden Agency", 610-350-6076), their campaigns, ad groups, ads, keywords, audiences, budgets, bids, conversion actions and performance statistics such as impressions, clicks, cost and conversions. Purpose: reporting on and managing the campaigns the account holder has asked us to manage.
• Google Analytics, read-only (https://www.googleapis.com/auth/analytics.readonly): Analytics accounts, properties and data streams, their settings, and aggregated reports such as users, sessions, traffic sources, events and conversions. Purpose: performance reporting. The App cannot change Analytics settings or data.
• Google Business Profile (https://www.googleapis.com/auth/business.manage): business locations and their details (name, address, phone number, opening hours, categories, website, attributes), customer reviews including the reviewer's public name and review text, review replies, local posts, and performance metrics such as Search and Maps views, calls, direction requests and search keywords. Purpose: keeping listings accurate, replying to reviews and publishing posts for profiles we own or have been asked to manage.
• Google Cloud (https://www.googleapis.com/auth/cloud-platform): resources in Google Cloud projects owned by Ubden®, such as BigQuery datasets and query results, Cloud Storage objects, logs and monitoring metrics. Purpose: running and analysing Ubden®'s own cloud infrastructure. We do not use this scope to access Google Cloud projects of other people or organisations.
• Sign-in (openid, https://www.googleapis.com/auth/userinfo.email and, where requested, https://www.googleapis.com/auth/userinfo.profile): your Google account ID, your email address and, if requested, your name and profile picture. Purpose: identifying which account authorised the App and signing you in.

The App does not use any Google Workspace API (such as Gmail, Google Drive, Google Calendar or Google Contacts) and never receives your Google password.

13.3 How we use Google user data

We use Google user data only to provide and improve the features the account holder has asked for:

• preparing reports and answering the account holder's questions about their own advertising, analytics, business listing and cloud data;
• creating, editing, pausing or optimising Google Ads campaigns, budgets, keywords and ads on the account holder's instructions;
• updating Business Profile information, replying to reviews and publishing local posts that the account holder has requested or approved;
• running scheduled tasks the account holder has agreed with us, such as a recurring report or a planned post;
• keeping the App secure, preventing abuse and meeting legal obligations.

We do not use Google user data for our own or anyone else's advertising (for example to build audiences, retarget people or personalise ads), to build user profiles or databases for any other purpose, to sell it or give it to data brokers or information resellers, to determine creditworthiness or for lending, or for any purpose unrelated to the service the account holder requested.

13.4 AI-assisted processing

Ubden® staff operate the App through an AI assistant. When a staff member asks the assistant a question about an account (for example, to summarise last month's campaign results), only the Google user data needed to answer that question is sent to our AI service provider, Anthropic PBC (provider of the Claude assistant), which processes it on our behalf to produce the answer. We use this provider only under terms that do not allow our inputs or outputs to be used to train its models. Google user data is not used by us, or by anyone we share it with, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.

13.5 Sharing, transfer and disclosure

We do not sell Google user data, and we do not share it with advertisers, data brokers or any third party for that party's own purposes. We share or disclose it only:

• with Google, when we write changes back to your Google services at your request;
• with service providers that process it on our behalf and under our instructions, limited to what each request needs: our AI service provider (see 13.4) and the providers that host servers controlled by Ubden®;
• between the Ubden® companies that deliver the service to you (Ubden® LLC, Ubden Teknoloji A.Ş. and Ubden OÜ);
• when required by applicable law, regulation or a court order, or when necessary to protect against fraud, abuse or security threats;
• as part of a merger, acquisition or sale of assets, after giving you notice; or
• with your explicit consent.

Ubden® staff look at Google user data only when this is needed to provide the service you engaged us for, with your consent, for security purposes such as investigating abuse, or to comply with the law. One client's data is never shown to another client.

13.6 Where the data is stored and how we protect it

OAuth tokens and Google user data are stored only on devices and servers controlled by Ubden®. Our AI service provider holds them only while a request is processed and for the limited period defined in its terms. We protect the data with the following measures:

• Encryption in transit: all traffic to Google APIs, to our AI service provider and between our own systems is encrypted with TLS (HTTPS).
• Encrypted storage of credentials: refresh tokens and OAuth client secrets are kept in encrypted storage (an encrypted secrets vault or encrypted disks) and never in source code, URLs or shared documents. Access tokens are short-lived (about one hour) and are requested again when needed.
• Access control: only a small number of authorised Ubden® staff can use the App, each with a personal account protected by Google 2-Step Verification; access is removed as soon as it is no longer needed.
• Least privilege: the App reaches only the accounts, properties, profiles and projects to which the account holder has given access, and requests read-only access where that is enough (Google Analytics).
• System security: our servers are kept up to date and protected by firewalls and intrusion-prevention tools; access to them is restricted and logged.
• Incident response: if a security incident affects Google user data, we notify the affected account holders, and Google where required, without undue delay.

13.7 Retention and deletion

• OAuth tokens are kept only while the integration is active. They are deleted within 30 days after you revoke access, after the service agreement ends, or after you ask us to delete them.
• Google user data retrieved for a request is used for that request only. Working copies that may contain it, such as AI assistant session logs and temporary exports, are deleted automatically within 30 days.
• Reports delivered to you at your request are kept for the duration of the service agreement so that you can refer back to them, and are deleted within 30 days after the agreement ends or when you ask, unless the law requires us to keep them longer.

13.8 How to revoke access and request deletion

• You can revoke the App's access at any time on your Google Account's third-party apps and services page: select Ubden® and remove its access. After that the App can no longer read or change your data.
• You can also remove the link to Ubden®'s manager account in Google Ads, remove Ubden® as a manager of your Business Profile, or remove Ubden® users from your Google Analytics property.
• To have the Google user data we hold deleted, email privacy@ubden.com with the subject "Google data deletion", preferably from the email address of the Google account concerned. We delete the data within 30 days and confirm in writing when it is done.

Revoking access does not undo changes that were already made in your Google services at your request, such as a published post or an edited campaign. You can change or remove those directly in the Google product.

13.9 Limited Use disclosure

Ubden®'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13.10 Changes and contact

If we change how the App accesses, uses, stores or shares Google user data, we will update this section before the change takes effect, inform authorising account holders by email and, where required, ask for their consent again. Questions about this section: privacy@ubden.com. Contact details of Ubden® LLC, Ubden Teknoloji A.Ş. and Ubden OÜ are in section 14.

14. Contact Information

For privacy-related questions or requests, contact us at:

• Email: privacy@ubden.com
• USA: 312 W 2nd St Unit #A1052, Casper, WY 82601
• Turkey: Maslak Mah. AOS 55. Sok. No 2/25, Istanbul 34398
• Estonia: Veskiposti tn 2-1002, Tallinn 10138