Skip to content
TR

Privacy Policy

Last updated: · Version 2026-10-11

We take your privacy seriously. This policy explains which personal data we process, and why, when you visit our website, use our free SEO checker or buy our services, and what your rights are.

In short

  • We do not use tracking, analytics or advertising cookies.
  • Your card details never reach us; payments are processed by Stripe.
  • We do not store the addresses you enter into the SEO checker.
  • We never sell your data. You can access, correct and delete it.

1. Data controller

The controller of your personal data is AKSOY SOFTWARE LTD, trading as Hoistly, a company registered in England and Wales (company number 14011830, registered office: Unit Da2 Sutherland House, Sutherland Road, London, United Kingdom, E17 6BU).

For any privacy request, contact: [email protected]

This policy has been prepared with regard to the UK GDPR and the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR) and, for people resident in Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK).

2. Data we collect

When you buy

  • Your name, email address and billing address;
  • Company or business name, website address and (if you enter it) tax or VAT number;
  • Payment details: your card number never reaches us. Stripe shares only limited details with us, such as card brand, last four digits, country and payment status;
  • Record of acceptance: the Package bought, date and time of acceptance, IP address, browser (user agent), language and the version of the terms accepted.

While we deliver the Services

  • Correspondence, call notes and business information you share with us;
  • Data in accounts you give us access to (for example Google Search Console, Google Analytics, Google Business Profile). We process end-user data in those accounts as a processor on your behalf.

When you use the free SEO checker

  • The page address you enter is used only to run that analysis. It is not written to a database and is not kept after the analysis finishes.
  • To prevent abuse, your IP address is held as a counter in server memory for no more than 10 minutes and then discarded.

When you visit the site

  • Our hosting provider keeps standard server logs for a short time for security and debugging, including IP address, browser type, page requested and time.
  • We do not use analytics, advertising or tracking cookies.

3. Why we process data and our legal bases

  • Entering into and performing the contract: taking your order, processing payment, delivering the Services and communicating with you (UK/EU GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
  • Legal obligation: keeping accounting, tax and anti-money-laundering records (Art. 6(1)(c); KVKK Art. 5/2-ç).
  • Legitimate interests: preventing fraud and misuse of the checker, keeping contract and consent records as evidence against payment disputes, securing the site and improving our services (Art. 6(1)(f); KVKK Art. 5/2-e and f).
  • Consent: processing based on your consent, such as optional marketing emails. You can withdraw consent at any time (Art. 6(1)(a); KVKK Art. 5/1).

4. Cookies

This site does no analytics or advertising tracking and sets no such cookies. The only cookies we use are:

  • lang: set when you press the language switch, to remember your chosen language (1 year). It contains no personal data.
  • Admin session cookie: used only when authorised Hoistly staff sign in to the admin panel. It is never set for visitors.

When you press "Buy now" you are taken to Stripe's checkout page on checkout.stripe.com. Stripe uses its own strictly necessary cookies for fraud prevention and payment security. See the Stripe Privacy Policy for details.

5. Who we share data with

We never sell your personal data. We share it only with the following recipients, and only as needed:

  • Stripe (payment processing and fraud prevention). Stripe acts as an independent controller for some processing.
  • Brevo (Sendinblue SAS, France; sending order confirmations and service emails, as a processor).
  • Hosting, email and business software providers (as processors, under contract).
  • Subcontractors (such as freelance writers), only with the information needed to deliver the Services and under a duty of confidentiality.
  • Accountants, legal advisers and auditors.
  • Competent public authorities and courts, where required by law.

We may use AI services (such as OpenAI) to help produce content. We do not send personal data about our visitors or clients to these services.

6. International transfers

Some of our providers may be located outside the UK and the European Economic Area (for example in the US). These transfers rely on appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement (IDTA) or Addendum, and EU Standard Contractual Clauses. Transfers of data about people resident in Türkiye rely on the safeguards in KVKK Art. 9 and on necessity for performance of the contract.

7. How long we keep data

  • Accounting and payment records: 6 years from the end of the financial year (UK legal requirement).
  • Contract and consent records: 6 years from the end of the contract (limitation period).
  • Service correspondence and deliverables: 3 years from the end of the contract.
  • Enquiries that do not lead to a purchase: 2 years.
  • SEO checker IP counter: no more than 10 minutes.
  • Server logs: no more than 30 days.

8. Your rights

Depending on the law that applies to you, you have the right to:

  • access your data and receive a copy;
  • have inaccurate or incomplete data corrected;
  • have your data erased (subject to legal retention duties);
  • restrict processing;
  • data portability;
  • object to processing based on legitimate interests and to direct marketing;
  • withdraw consent where processing is based on consent;
  • exercise the other rights in KVKK Art. 11.

Send requests to [email protected]. Once we have verified your identity, we reply within one month.

You can complain to the Information Commissioner's Office (ICO) in the UK, the data protection authority of your country in the EU, or the Personal Data Protection Authority in Türkiye. We would appreciate the chance to help first.

9. Security

We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls, two-factor authentication and access limited to the people who need it. Card data is processed by Stripe, which is certified to PCI DSS Level 1.

10. Automated decision-making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe may run payments through automated risk analysis to prevent fraud.

11. Children

Our services are for businesses and are not offered to anyone under 18.

12. Changes to this policy

We may update this policy when needed. We will announce significant changes on this page and, where appropriate, by email. The date of the last update is shown at the top of the page.

13. Contact

AKSOY SOFTWARE LTD · Unit Da2 Sutherland House, Sutherland Road, London, United Kingdom, E17 6BU · Privacy: [email protected]