Privacy Policy

click27 (click27.com and its subdomains) is operated by Bilgesam LLC, a limited liability company organized under the laws of the State of Wyoming, USA ("we", "us"). Address: —. Privacy contact: ltd.bilgisam@gmail.com, or use our request and complaint form.

This policy applies worldwide. In addition: residents of the EEA, the UK and Switzerland have the GDPR rights below; residents of US states with consumer privacy laws see the US State Privacy Notice; people in Türkiye see the KVKK Aydınlatma Metni and the Turkish Gizlilik Politikası. Where a regional notice gives you more rights, it prevails for you.

For your account, billing and request data we are the controller.

For the analytics data collected on your website, you (the site owner) are the controller and we are your processor; see the Data Processing Agreement.

The tracking script and the free counter widget set no cookies and use no browser storage. They send the page address, referrer, screen width and, for custom events, the properties the site owner chooses. They never read form fields.

The IP address and user agent are used only in memory to compute a visitor identifier with a secret salt that rotates every day, to resolve the country and approximate city and to filter bots. The IP address is not stored. The approximate city location (rounded to about 10 km) is kept only in the live view (the latest 100 events, used for the live map) and is not stored with the analytics data, which keeps the country only. Because the salt is discarded daily, a visitor cannot be recognised across days or across websites.

Free counters created without an account have a public statistics page that shows aggregate numbers (no visitor identifiers) to anyone with the link.

Raw events are deleted automatically when the site owner’s plan retention period ends (1 to 24 months) or immediately when the owner deletes the site data.

Name, email address, password hash (scrypt), optional two-step verification secret, workspace memberships and settings: to provide the service (GDPR Art. 6(1)(b), KVKK md. 5/2-c).

Payments are collected by Bilgesam LLC through Stripe. Card data is processed by Stripe only; Stripe also receives your billing address and, if you provide it, your tax ID. We store only customer and subscription identifiers. Invoices are kept as long as tax law requires (GDPR Art. 6(1)(c)).

For security we keep rate-limit counters keyed by IP address or email for at most one hour (GDPR Art. 6(1)(f), KVKK md. 5/2-f).

If you connect api14.com for AI analysis, your api14 key is stored encrypted (AES-256-GCM). Only aggregated report numbers — never raw events or visitor identifiers — are sent to the model through your own api14 account.

Before any formal step, we ask you to contact us through the request and complaint form. We record your name, email address, optional phone number, country, request type, subject, message, language and — if you are signed in — your account ID. No IP address is stored with the request.

We use this data only to identify you, handle and answer your request, and document how we handled it in case of a dispute or a regulator’s inquiry (GDPR Art. 6(1)(c) and (f); KVKK md. 5/2-ç and 5/2-e). Request records are deleted automatically 3 years after submission.

Bilgesam LLC is established in the United States; the service and its database are hosted in the European Union. Personal data may be accessed from the US by us and is shared with our processors: hosting and database provider (EU), Stripe (payments), our transactional email provider, and api14.com only when you connect it with your own account.

For transfers from the EEA, the UK and Switzerland we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable); for Türkiye, on the safeguards in KVKK md. 9.

You can request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interests. You can export your data and delete your account yourself under Account settings, or write to us. We answer within one month (extendable by two months for complex requests, with notice).

You may also complain to the data protection authority where you live or work. We ask you to contact us first so we can try to resolve the issue.

We do not sell personal data, show advertising, build cross-site profiles or make decisions with legal effect based solely on automated processing.

click27 is a business tool and not directed at children under 16. We do not knowingly collect their personal data; if you believe we have, contact us and we will delete it.

Account data is kept while your account exists and deleted when you delete it, except invoices we must keep by law. Analytics data follows the plan retention period. Request records: 3 years from submission.

Encryption in transit, encrypted secrets at rest, tenant isolation on every query, role-based access and mandatory two-step verification for administrators.

We announce material changes by email or in the product at least 30 days before they take effect. The date at the top shows the current version.