Cobista Privacy Policy

1. Controller and processor

The controller of account, subscription and site visit data is Projera Partners Eğitim Danışmanlık Koçluk ve Dijital Hizmetleri A.Ş., 19 Mayıs Mah. İnönü Cad. Samlı No: 97 İç Kapı No: 7, Kadıköy, İstanbul, Türkiye.

For the business data our customers enter into the service (their employees, customers, suppliers and the like) the customer is the controller; Projera Partners Eğitim Danışmanlık Koçluk ve Dijital Hizmetleri A.Ş. processes that data on the customer's instructions as a processor.

2. Data we process

Account data: name, surname, e-mail, a hash of your password or your Google / Microsoft sign-in identity, language and time zone preferences.

Business and subscription data: the business's legal name, country, tax number, the chosen plan and modules. Your card details never reach us; Paddle takes the payment.

Usage data: sign-in records, IP address, browser information and activity records kept for security.

Work traces: a “Your world” summary derived each night from a person’s own work with records (ownership, project membership, time and expense entries, documents they created, records they opened). Team membership, the reporting line and approvals given count as traces too. It is shown only to that person, as an order in pickers, search and lists; it never reaches another user, a report, an export, an AI or an MCP tool. The one exception is the anonymous “Your team’s world” group: a record in the summaries of at least 2 teammates is shown to the others, without a number or a name, while the person’s teams together have at least 4 members who sign in.

Contact data: what you write to us through the contact form or by e-mail.

3. Purposes and legal bases

To provide the service and perform the contract (account, subscription, support); to meet our legal obligations (invoices and record keeping); our legitimate interests (security, preventing abuse, improving the service); your consent where consent is required.

4. Service providers and international transfers

Data is stored in the United States (US East region) on the infrastructure of Vercel Inc. and Neon Inc., where the service is hosted.

Payments run through Paddle.com Market Limited (United Kingdom) and transactional e-mail through Resend (Ireland region). When AI assistance is used in an import, the file's column names and masked sample values are sent to Anthropic PBC (United States). With Google or Microsoft sign-in, those providers authenticate you.

These transfers are made with the safeguards required by KVKK Article 9 and the GDPR's rules on international transfers (standard contracts and, where needed, explicit consent).

5. Cookies

We use strictly necessary cookies to keep you signed in and to remember preferences such as language. Site visit statistics are collected with Vercel Analytics, which uses no cookies. We use no advertising or tracking cookies.

6. Retention

We keep account and business data while your account is open. After the account is closed, data is deleted or anonymised, except where the law requires us to keep it.

7. Your rights

Under KVKK Article 11 and the GDPR you have the right to access your data and to ask for its correction, deletion or restricted processing, to object, and to data portability. Send your request to info@projera.com; we answer within thirty days. You may also complain to the Turkish Personal Data Protection Authority or to the data protection authority of your country.

8. Security

Data is encrypted in transit and at rest; access is limited by roles and permissions, businesses are kept apart from one another and significant actions are recorded.

9. Changes

We may update this policy and announce material changes before they take effect. The current text is always on this page.