Privacy
Policy

Where this Policy applies.

This Privacy Policy explains how Marmara Ticari Hizmetler Turizm ve Dış Ticaret Limited Şirketi (trading as OctaStudio, “we,” “us,” or “our”) collects, uses, protects, and discloses personal data and operational business information.

This Policy applies when you visit octastdio.com (the “Site”), initiate communications with OctaStudio via WhatsApp, email, or telephone, or engage OctaStudio for the Google Top 5 Package and modular add-ons (including Citation Sync, Automated Video Creation, 6X Social Repurposing, and Premium Landing Page Builds).

This Policy covers both contractor business data (provided directly by our commercial clients) and customer contact data (submitted by contractors to facilitate the automated 5-Star Review System).

Who is responsible and operational roles.

The entity responsible for personal data processing is Marmara Ticari Hizmetler Turizm ve Dış Ticaret Limited Şirketi, a Turkish Limited Şirketi (Ltd. Şti.) trading as OctaStudio.

Operational Roles:

• Data Controller: OctaStudio acts as the Data Controller with respect to contractor account information, owner contact details, trade profiles, billing records, and direct communications between the contractor and OctaStudio.
• Data Processor & CCPA Service Provider: With respect to homeowner and customer contact information provided by contractors for review collection, OctaStudio acts strictly as a Data Processor (under Turkish KVKK and EU/UK GDPR) and a “Service Provider” (under the California Consumer Privacy Act / CPRA). OctaStudio processes customer data solely on behalf of, and pursuant to the explicit instructions of, the contractor.

Information we process.

Contractor Business Information

• Contact Details: Business owner name, company legal and trade name, telephone numbers, WhatsApp contact details, email addresses, and physical business address.
• Profile & Service Area Details: Service area zip codes, primary and secondary trade categories, business licensing credentials, and Google Business Profile access permissions.
• Job-Site Media & Project Metadata: Job photos (2–4 photos submitted weekly via WhatsApp), project specifications, service notes, and descriptive metadata submitted for the 2 weekly Google Business Profile updates.
• Billing & Commercial Records: Payment transaction history, billing addresses, and invoice records. Payment card details are processed directly through secure third-party merchant providers and are never stored on OctaStudio servers.

Technical Information

• Standard technical log data including IP addresses, browser specifications, operating system versions, referring URLs, and interaction timestamps necessary for secure web delivery and system diagnostics.

Client Customer Contact Data for 5-Star Review System.

When contractors utilize the 5-Star Review System module of the Google Top 5 Package, the contractor provides homeowner contact details (such as customer first name and mobile phone number) following the completion of a home improvement project.

With respect to this homeowner data, OctaStudio operates strictly as a data processor / service provider on behalf of the contractor:

• Sole Purpose: Homeowner contact numbers are used exclusively to dispatch the automated, polite 5-Star Review SMS prompt inviting the homeowner to leave an honest Google review.
• Strict 24-Hour Follow-Up Disclosure: If the homeowner does not complete a review upon the initial invitation, the system dispatches exactly one gentle follow-up reminder after 24 hours. If uncompleted after 24 hours, the campaign automatically closes. No further review prompts are dispatched.
• Formal CCPA/CPRA Service Provider Certification: OctaStudio formally certifies that it will not retain, use, disclose, sell, or share homeowner personal information for any commercial purpose other than the specific commercial purpose of performing the review dispatch services specified in the agreement, nor retain or use customer data outside the direct business relationship.
• No Marketing or Cross-Selling: OctaStudio never uses customer phone numbers for marketing, advertising, promotional campaigns, or cross-selling of any kind.
• No Data Selling or Sharing: Customer contact lists are never sold, rented, leased, or disclosed to third-party data brokers, marketers, or affiliates under any circumstances.
• Strict Tenant Isolation: Customer contact data provided by one contractor is strictly partitioned in dedicated queues and is never pooled, aggregated, or cross-referenced across client accounts.
• Immediate Opt-Out Respect: Any homeowner who receives a review prompt may reply STOP at any time to immediately and permanently suppress all future text messages.
• Data Deletion: Upon written request by the contractor or homeowner, or upon termination of the client service agreement, customer contact records are permanently deleted from our messaging queues.

Legal basis for processing.

We process information pursuant to the following lawful grounds under Turkish Law No. 6698 (KVKK) and international data protection standards:

• Performance of Contract (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)): To execute the deliverables of the Google Top 5 Package, publish 2 weekly Google updates, manage review flows, and provide monthly performance reporting.
• Legitimate Interests (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)): To respond to prospective client inquiries, evaluate zip code exclusivity, safeguard our infrastructure, prevent fraudulent transactions, and maintain business records.
• Legal Compliance (KVKK Art. 5(2)(ç), GDPR Art. 6(1)(c)): To satisfy tax, accounting, and telecommunications statutory obligations under applicable law.
• Consent (KVKK Art. 5(1), GDPR Art. 6(1)(a)): Where explicit consent is required, such as specific opt-in operational alerts or localized communications.

Purpose of data processing.

• Evaluating prospective contractor territories to enforce our strict single-contractor-per-trade exclusivity rule.
• Building, optimizing, and monitoring Google Business Profile listings and category locks.
• Drafting keyword-rich project descriptions from contractor job notes and publishing 2 geotagged Google Business Profile updates weekly.
• Dispatching review prompts to verified customers and monitoring public reviews for rapid speed review reply drafting.
• Compiling monthly geographic radar reports tracking rank advancement toward top 5 and inbound call trends.
• Formatting business profile entity data, service metadata, and structured schema markups for AI SEO optimization (Siri, Apple Intelligence, ChatGPT, Google AI Overviews).
• Syndicating 2 weekly Google updates to Facebook, Instagram, and LinkedIn (under 6X Social Repurposing).
• Direct client communication via WhatsApp and phone for account administration, onboarding, and support.

Google API user data policy & AI non-training certification.

Adherence to Google API Services User Data Policy: OctaStudio connects to Google APIs strictly to manage Google Business Profile listings, publish updates, monitor incoming reviews, and publish authorized review replies. OctaStudio’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Assistive AI Processing Boundaries: Where OctaStudio deploys assistive AI models (such as assisting in drafting weekly Google post descriptions or formulating context-specific speed review replies), data is processed in stateless, transient execution sessions solely to draft content for that specific client listing. Client operational data and Google API data are never fed into foundational public models, shared across client partitions, or used for model pre-training or fine-tuning.

Communications standards & carrier compliance.

Communications between OctaStudio and contractors occur primarily via WhatsApp, email, and direct phone. When automated SMS triggers are employed for the 5-Star Review System, OctaStudio operates in strict adherence to cellular carrier Application-to-Person (A2P 10DLC) standards, CTIA Messaging Principles, and the Telephone Consumer Protection Act (TCPA):

• Message Frequency: Text messaging frequency is strictly confined to transactional review prompts (one initial invitation and one gentle 24-hour reminder). No recurring marketing text blasts are ever sent.
• Rates & Tolls: Standard message and data rates may apply depending on the recipient’s cellular carrier and mobile rate plan.
• Opt-Out & Help: Recipients can opt out at any time by replying STOP, or receive assistance by replying HELP. Opt-out requests are processed immediately and automatically.
• Carrier Non-Liability: Wireless carriers and mobile network operators (including AT&T, Verizon, T-Mobile, and regional carriers) are not liable for delayed, misrouted, or undelivered messages.

Third-party processing partners.

We do not sell personal data. We disclose operational data only to trusted service partners necessary to fulfill our core services under written data processing agreements:

• Telecommunications & SMS Gateways: Regulated telecommunication API providers utilized to transmit 5-Star Review System review prompts and transactional notifications.
• Directory Aggregators: For clients opting into the Citation Sync module, business data (NAP) is syndicated across 50+ authorized local business directories (e.g., Apple Maps, Bing, Yelp).
• Social & Video Distribution Networks: For 6X Social Repurposing (included in the Google Top 5 Package) and optional Automated Video Creation, completed 2 weekly project updates and video assets are published to designated platforms (Meta/Facebook, Instagram, LinkedIn, and YouTube) via authorized API connections.
• Encrypted Cloud Infrastructure: Enterprise cloud hosting providers utilized for encrypted file storage, audit log archiving, and reporting databases.
• Professional Counsel: External legal, accounting, and compliance advisers bound by strict professional confidentiality duties.

Cross-border processing.

Where processing requires the transfer of information outside the Republic of Türkiye, such transfers are conducted under the protections established by Turkish Personal Data Protection Law No. 6698 (KVKK Art. 9) and applicable international data protection standards, including standard contractual clauses and rigorous technical and organizational safeguards (TLS 1.3 in transit and AES-256 at rest).

Minimal website storage.

Our website utilizes strictly necessary technical mechanisms for site performance, font rendering, and dark-mode zero-flash layout persistence. We do not deploy invasive cross-site behavioral tracking cookies, third-party advertising pixels, or remarketing scripts.

Storage periods & retention schedules.

We retain records only for as long as reasonably necessary to fulfill the commercial purposes outlined in this Policy:

• Contractor Account Records: We retain contractor commercial records for the duration of the commercial relationship and for the minimum statutory period required for tax, accounting, and commercial dispute compliance (ten years under Turkish commercial law).
• WhatsApp Job Photos & Communication Logs: Raw job-site photos submitted weekly via WhatsApp and communication histories are retained for the duration of active service plus a post-contract period of twenty-four (24) months solely for warranty defense, copyright verification, and dispute resolution, after which they are permanently purged from active storage.
• Customer Review Phone Numbers: Client customer phone numbers used for review dispatches are purged from active queues following completion of the 24-hour campaign window and permanently deleted within thirty (30) days of service termination or upon written request.

Protection measures.

We implement appropriate technical, administrative, and physical safeguards to prevent unauthorized data access, disclosure, alteration, or destruction. Access to client Google Business Profile accounts and communications channels is restricted to authorized personnel operating with multi-factor authentication, end-to-end data encryption (TLS 1.3 in transit and AES-256 at rest), and strict tenant isolation.

Statutory rights under KVKK and international privacy laws.

Depending on your geographic location and applicable jurisdiction, you possess specific statutory rights regarding your personal information:

• Turkish KVKK (Law No. 6698, Article 11): Turkish data subjects have the right to learn whether personal data is processed; request information regarding processing; learn the purpose and whether data is used in line with purpose; know third parties to whom data is transferred; request rectification of incomplete or inaccurate data; request erasure or destruction under Article 7; request notification of rectification/erasure to third parties; object to adverse results from automated analysis; and claim compensation for damages due to unlawful processing.
• California & US State Privacy Laws (CCPA / CPRA): California residents (and residents of states with comprehensive privacy laws) have the right to know what personal information has been collected, used, or disclosed; the right to request deletion of personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information (OctaStudio does not sell or share personal information); and the right not to receive discriminatory treatment for exercising privacy rights.
• European Union & UK GDPR: Data subjects in the EEA and UK have the right of access (Art. 15), right to rectification (Art. 16), right to erasure / right to be forgotten (Art. 17), right to restriction of processing (Art. 18), right to data portability (Art. 20), right to object (Art. 21), and the right to lodge a complaint with a competent supervisory data protection authority.

To exercise these rights, submit a written request to admin@octastdio.com. Requests will be evaluated and answered without undue delay and within thirty (30) days in accordance with statutory procedures.

Inquiries and revisions.

We may update this Privacy Policy periodically to reflect technological adjustments or legal developments. Revised policies become effective upon posting with a renewed “Last updated” timestamp.