Privacy Policy

1. Data controller

The data controller under KVKK is Arda Serdar Malkaş (Colega). Contact: support@colegapro.com · Kocaeli, Türkiye.

Payments are processed by Paddle.com as Merchant of Record; for your payment and billing data Paddle is a separate controller under its own privacy policy.

2. Data we process

• Account data: name, email address, username, optional profile photo and job title. If you sign in with Google, the name and email address Google shares with us.
• Company (Teams) data: company name and logo, members and their roles, invitations, documents and workflows company admins teach Colega, company rules and shared workspace content.
• App content: tasks and notes you create, your personal rules and (unless you turn it off in settings) a text history of the insights Colega shows you.
• Screenshots and audio: only as described in section 3 below, when you start them.
• Usage and security records: quota and usage counters, rate-limit records, error codes and timings.
• Payment and subscription data: your plan, subscription status, billing period dates and Paddle customer/subscription IDs. Your card details never reach us.
• Technical data: records such as IP address and browser/device information kept by our hosting and infrastructure providers to run and secure the Service.

3. Screenshots and audio

• Screen checks (Check Screen / Ask Colega): Colega captures your screen only when you start a check or ask a question. The image is sent through our servers to OpenAI for AI processing and is not stored by us after the answer is produced. There is no continuous or background screen monitoring.
• Hear Mode (meeting listening): when you start Hear Mode, Colega listens to the audio your computer plays and, optionally, your microphone. Audio is sent in short chunks through our servers to OpenAI for transcription; audio and meeting transcripts are not stored on our servers and are kept only in your device's memory during the session. You are responsible for respecting meeting participants' legal rights regarding being listened to.
• Voice typing: when you use the microphone button, your voice is sent to OpenAI for transcription in the same way and is not stored.
• Insights Colega generates (title, summary and suggestion text — not images) are saved to your account. You can turn this off in settings and delete your history.
• Under its own policy, OpenAI does not use data sent through its API to train its models by default, and may retain it for a limited period to monitor for abuse.

4. Why we process your data

• to create your account, authenticate you and provide the Service;
• to run the AI features you request (screen checks, meeting assistant, voice typing, teaching Colega company knowledge);
• to manage your subscription, trial and plan entitlements;
• to enforce usage limits, prevent abuse and security threats, and fix errors;
• to answer your support requests and send essential service notices;
• to comply with our legal obligations.

5. Legal bases

We process your personal data under KVKK Article 5(2) where it is necessary to conclude or perform a contract with you (c), to comply with our legal obligations (ç), to establish, exercise or defend a right (e), and for our legitimate interests provided they do not harm your fundamental rights and freedoms (f). Where none of these applies, we ask for your explicit consent. If you are in the EU/UK, the equivalent GDPR bases apply (contract, legal obligation, legitimate interests and consent).

6. Service providers and international transfers

We share your data with the following providers only as needed to provide the Service:

• Supabase — database, authentication, file storage and server functions (servers in the European Union, Frankfurt, Germany);
• OpenAI — AI processing of screenshots, audio and text (United States);
• Paddle — payments, invoicing and tax (Merchant of Record);
• Netlify — website hosting;
• Google — authentication, only if you choose to sign in with Google.

7. Retention

• Account and app data is kept while your account is open and deleted or anonymised within a reasonable period after you delete your account.
• Screenshots, audio recordings and meeting transcripts are not stored on our servers.
• Some data (e.g. local notes, app preferences and diagnostic logs) is kept only on your own device; you can delete it by uninstalling the app.
• Payment and invoice records are retained by Paddle in line with statutory retention obligations.

8. Cookies

Our website uses only cookies that are strictly necessary for it to work: authentication cookies that keep you signed in and a cookie that remembers your language preference. We do not use analytics, advertising or tracking cookies. The checkout is provided by Paddle, which may use its own cookies for payment security.

9. Security

We protect your data with technical and organisational measures such as encrypted connections (HTTPS), row-level access rules and keys kept only on the server side. No system is completely risk-free; in the event of a data breach we will inform you and the relevant authorities as required by law.

10. Your rights

Under KVKK Article 11 you have the right to learn whether your personal data is processed and to request information about it, to learn the purpose of processing and whether it is used accordingly, to know the third parties in Türkiye or abroad to whom it is transferred, to request correction of incomplete or inaccurate data and deletion or destruction under the conditions of KVKK, to request that these actions be notified to third parties to whom the data was transferred, to object to an outcome against you arising solely from automated analysis, and to claim compensation for damage caused by unlawful processing. If you are in the EU/UK, you also have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR.

Send your request from the email address registered to your account to support@colegapro.com. We will respond free of charge within 30 days at the latest. If you are not satisfied with our response, you can complain to the Turkish Personal Data Protection Board or, in the EU/UK, to your local data protection authority.

11. Age limit

The Service is not intended for anyone under 18 and we do not knowingly process their data.

12. Changes

We may update this policy. We will announce material changes by email or in-app notice before they take effect.