Privacy Policy
Last updated: 26 October 2026. This policy covers the Premisey web application and fulfils our notice obligations under Türkiye's personal data law (KVKK) and, where applicable, the GDPR.
1. Data controller
Data controller: Cenk Alper Tantoğlu (Urastech) (address: Fatih Mahallesi No:74, Muratlı / Tekirdağ, Türkiye). Requests, objections and deletion requests can be sent to merhaba@premisey.com.
Premisey is a web application that assesses whether a startup idea is worth building, using live web research and source verification. A report is decision support, not investment, legal or tax advice.
2. Data we process
The table below is the complete list. No category outside it is collected.
| Category | Contents | Why | Required? |
|---|---|---|---|
| Account | Email address, irreversible password hash, session data | Creating the account and securing sign-in | Required |
| Founder profile | Technical level, current situation, team, goal, tools you use, budget range, weekly time, geography, domain expertise, previous startup, unfair advantage, risk tolerance | Personalising the report and the founder–idea fit score | Optional |
| Idea and clarification | Your idea text, answers to clarifying questions, competitor links you provide | Running the research and producing the report | Required for an analysis |
| Reports and monitoring | Generated reports, MVP Blueprints, monitored ideas and notifications | Showing results and sending monitoring alerts | If you use the feature |
| Credit records | Credit balance and credit movements | Running the service and tracking payments | Required |
| Programme pilot form | Full name, organisation, work email, organisation type, your note | Answering the pilot request | Only if you submit the form |
| Technical logs | Irreversible hash of your IP address, request time, error logs | Rate limiting, abuse prevention, troubleshooting | Created automatically |
| Stored in your browser | Idea draft written before sign-up (only in your browser), language preference cookie | Keeping your idea after sign-up; remembering your language | See Cookie Policy |
Raw IP addresses are not stored. No special-category data is collected. Your idea is never shown to other users.
3. AI and research
To produce a report, your idea text, clarification answers and profile are sent to Anthropic's Claude models, which run live web searches and write the report. Your email and password are never sent to the model.
- Anthropic states that data sent through its API is not used for model training by default.
- Scores and the final verdict come from a transparent formula on our server, not from the model.
- Every source cited in a report is checked with a request from our server; this request carries no personal data.
- Competitor links you provide may be read via Apify; keywords derived from your idea are searched on Google Play and the App Store.
- MVP Blueprint images are generated with fal.ai from a visual brief derived from your idea summary.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account and service delivery | Performance of a contract |
| Producing reports, blueprints and monitoring | Performance of a contract |
| Credit and payment tracking | Performance of a contract; legal obligation |
| Abuse prevention and rate limiting | Legitimate interest |
| Troubleshooting and service quality | Legitimate interest |
| Monitoring alert emails | Performance of a contract — stop by turning monitoring off |
| Statutory retention and lawful requests | Legal obligation |
5. Who we share data with
We do not sell your data, share it with ad networks or profile you for advertising. We use only these service providers:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database and authentication | Account and content data in section 2 | Abroad (cloud) |
| Vercel | Hosting and server functions | Data passing through a request, technical logs | US / EU |
| Anthropic | Research and writing the report | Idea text, clarification answers, profile | US |
| Brevo or Resend | Transactional email (verification, password reset, monitoring alert) | Email address and message content | EU / US |
| fal.ai | Generating MVP Blueprint images | Visual brief derived from the idea | US |
| Apify | Reading competitor links you provide | Competitor link | EU |
| TrustMRR | Looking up verified revenue data | Search term derived from the idea | Abroad |
International transfers are necessary to deliver the service. We respond to lawful requests from competent authorities as required by law.
6. Payments
Credit packs are currently paid by bank transfer and credited to your account manually; we do not ask for or store card details. When card payments open, they will be taken by a payment provider acting as merchant of record; your card details will not reach us and this section will be updated.
7. Retention
- Account, profile, ideas and reports: while your account is open; deleting the account deletes linked records.
- Deletion requests: completed within 30 days; purge from backups within 90 days.
- Technical and error logs: up to 12 months.
- Credit and payment records: for the period required by tax law, for legal purposes only.
- Pre-sign-up idea draft: stays only in your browser and is removed after sign-up or expiry.
8. Your rights and account deletion
You have the right to access, rectify, erase, object, port your data and seek redress under KVKK article 11 and, if you are in the EU, the GDPR.
To delete your account and all data, email merhaba@premisey.com from your registered address. Requests are answered free of charge within 30 days.
9. Security
- All traffic is encrypted with TLS.
- Passwords are irreversibly hashed; plain-text passwords are never stored.
- Row-level security is enabled on every table: a user sees only their own records.
- API keys live only on the server and are never sent to the browser.
- In case of a breach we notify the authority within 72 hours and affected users as soon as reasonably possible.
10. Children
Premisey is not intended for anyone under 18; we do not knowingly collect their data and delete it if we learn of it.
11. Changes and contact
When we update this policy the date above changes. Material changes affecting the data collected or the providers are emailed before they take effect.
Questions about privacy: merhaba@premisey.com. You may also complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or your local EU supervisory authority.