Privacy Policy

At Pumpmedya we value your privacy. This policy explains what data we collect when you use our website, why, and your rights. For details on processing of personal data, also see our Data Protection Notice (KVKK).

Data We Collect

• Information you give us: name, email, phone, company, message and form/chat content
• With your consent: marketing source (UTM, ad click ids) and usage/analytics data
• Technical data: session, language and security info via strictly necessary cookies

How We Use Data

• Responding to your requests and providing services
• Ensuring site security and core functionality
• Subject to your consent, measuring marketing performance and improving the site

Cookies

We use strictly necessary cookies to run the site, and analytics/marketing cookies only with your explicit consent. See our Cookie Policy for details and preference management.

Sharing with Third Parties

We do not sell your data. We may share it only with our hosting, email and analytics providers, and with authorized authorities under legal obligations, with appropriate safeguards.

Google Account Connections and Google User Data

This section applies only to customers using our GrowthOS panel. It takes effect when you connect your own Google account inside the panel. If you are only visiting this website, this section does not apply to you.

Which permissions we request and why

• Google Analytics (analytics.readonly): to read traffic and conversion reports for the property you connect and display them in your panel.
• Google Calendar (calendar.events): to create calendar events and open a Meet link for meetings we hold with you. We only touch events we create ourselves.
• Google Search Console (webmasters.readonly): to read your search queries, clicks and ranking data and produce your SEO reports.
• Google Ads (adwords): to read your campaign performance and show it in your panel. We only read; the Google Ads API offers no read-only scope, so this is the only scope available.
• Merchant Center (content): to read the status of your product feed and its approval errors and show them in the panel.

What we store

We store the authorization tokens you grant us, the id and name of the property you connect, and the reports we pull from Google in a form aggregated by day. We do not store person level raw data about your visitors. We never request access to Gmail, Drive, contacts, photos or any similar data.

Where and how we store it

Data is held on our own server in Germany, inside the European Union. Access is limited by role based authorization, so only the team members working on your account can see it. All connections are encrypted with TLS. Authorization tokens are stored encrypted at rest (AES-256-GCM).

Who we share it with

We do not sell data obtained from your Google account, do not use it for advertising targeting, do not use it to train artificial intelligence models, and do not transfer it to any third party outside of providing the service. Where a legal obligation arises, it is disclosed only to the competent authority and only to the extent required.

AI assistant

Our panel includes an AI assistant (PumpAI). When you or our team ask it a question about your performance, a text summary of aggregated metrics from your connected accounts is included in the request, for example 30 day session totals, top pages, top search queries and campaign spend. This summary is processed by Anthropic's Claude API, which we use under Anthropic's commercial terms; those terms prohibit using our data to train their models. No user level or raw event data is sent, and no Google Calendar data is ever sent to any AI service. We do not use Google user data to create, train or improve any AI or machine learning model.

The use of raw or derived user data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use

Pumpmedya's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to withdraw your permission

You can remove the connection from the Connections page under the Growth section of the panel. When you remove it, your authorization tokens and the metrics belonging to that connection are deleted from our systems. You can also withdraw the grant on your Google account at myaccount.google.com/permissions. If you want confirmation that your data has been deleted, write to info@pumpmedya.com and we will resolve the request within 2 business days.

Data Security

We apply reasonable technical and organizational measures (encryption, access control, bot/spam protection) to protect your data against unauthorized access.

Your Rights

Under KVKK Art. 11 you have rights to access, correct, erase and object to the processing of your data. For details and requests see the Data Protection Notice (KVKK) or contact info@pumpmedya.com.

Changes

We may update this policy from time to time. The current version is published on this page.

Contact

For questions: info@pumpmedya.com

Visitors and customers in the UK and the EU (UK GDPR / GDPR)

If you are in the United Kingdom or the European Economic Area, the UK GDPR and the EU GDPR apply to our processing of your personal data alongside Turkish law. Pumpmedya Yazılım ve Dijital Pazarlama A.Ş. (Ankara, Türkiye) is the data controller.

What we process and why. Contact details and the information you give us in a form, chat or order (name, email, company, website address, your message) to answer you and to deliver the service you asked for (legal basis: performance of a contract or steps before entering one, Art. 6(1)(b)); technical and security data needed to run the site (legitimate interest, Art. 6(1)(f)); analytics and marketing data only with your consent (Art. 6(1)(a)), which you can withdraw at any time from the cookie settings.

Paid audits. When you order a diagnostic website audit, we process your website address, email and payment status to prepare and deliver the report. Card payments are processed by iyzico Ödeme Hizmetleri A.Ş.; we never receive or store your card details.

International transfers. Your data is processed in Türkiye and on EU-hosted infrastructure of our providers (hosting, email delivery, analytics). Where data leaves the UK or the EEA we rely on appropriate safeguards such as standard contractual clauses.

Retention. Enquiry and order data is kept for as long as needed to provide the service and to meet legal and accounting obligations, then deleted or anonymised.

Your rights. You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent. To exercise them write to info@pumpmedya.com; we respond within one month. You may also complain to your supervisory authority, in the UK the Information Commissioner's Office (ICO).