Privacy Policy

Service: Cernio (getcernio.com, app.getcernio.com) Controller: GADULABS YAZILIM LİMİTED ŞİRKETİ (a Turkish limited liability company), Mustafa Kemal Paşa Mah. Yalova-Bursa Yolu Cad. A Blok 1. Kademe No: 123/1 İç Kapı No: 10, Merkez / YALOVA, Türkiye; trade registry no. 14632; MERSIS no. 0388200542700001; tax office Yalova, tax ID 3882005427. Data protection contact: privacy@getcernio.com Effective date: 6 November 2026

1. Who We Are

Cernio is a B2B SaaS platform for AI-assisted buyer discovery, lead scoring and contact management, operated by GADULABS YAZILIM LİMİTED ŞİRKETİ ("we", "us"). Registered address: Mustafa Kemal Paşa Mah. Yalova-Bursa Yolu Cad. A Blok 1. Kademe No: 123/1 İç Kapı No: 10, Merkez / YALOVA, Türkiye. Trade registry no. 14632 · MERSIS no. 0388200542700001 · tax office Yalova, tax ID 3882005427. This Privacy Policy explains what personal data we process, why, on what legal basis, who we share it with, and what your rights are.

For the purposes of this Policy:

• We act as a controller for data about our account holders and website visitors (Sections 3–4).
• We act as a processor for customers' own use of third-party personal data in their workspaces, including workspace records, later edits, notes, lists and outreach (see Section 5 and our DPA). The shared company-identity catalogue and shared contact pool are outside this processor role.
• We act as an independent controller for the shared catalogue containing only company identity data: name, website, domain, country and city (see Section 5.2a).
• We act as an independent controller for the shared contact pool, including public-source business identity fields and the name, business email and business phone that customers enter when adding contacts (see Section 5.2b).

VERBİS (Turkish Data Controllers' Registry). We are not registered with VERBİS. Under the exemption criterion currently in force, a data controller with fewer than 50 employees and an annual balance-sheet total below TRY 100 million, whose main activity is not the processing of special-category personal data, is not required to register. GaduLabs is below both thresholds and Cernio does not process special-category data (health, biometric, religion, origin and the like), so no registration obligation arises today. We re-check this every financial year and will register if a threshold is exceeded.

2. Scope

This Policy applies to the Platform and related communications. It does not apply to third-party websites or services that we link to or integrate (see Section 8).

3. Personal Data We Process (as Controller)

Sentry error diagnostics. In the application, Sentry sends a session replay only when an error occurs; general session sampling is disabled. The purpose is to diagnose and fix application failures, independent of your optional analytics choice. All text and inputs are masked, and media are blocked before transmission. The browser buffers browser interactions before an error; if an error occurs, that context is sent and Sentry continues recording after the error until the replay session ends. Technical context includes page addresses, navigation and network metadata; we filter secrets from URLs and scrub error data. Replays are stored in the EU (Germany). Retention follows the Sentry plan in effect when the replay is received: Sentry documents default replay retention of 30 days on the Developer plan and 90 days on paid plans (Sentry retention periods).

We do not knowingly collect special categories of personal data or data from minors.

4. Why We Process It and Legal Bases (Controller)

Where we rely on legitimate interests, we have balanced those interests against your rights (see our LIA for the buyer-discovery processing). Where we rely on consent, you may withdraw it at any time.

Product usage events (legitimate interest, right to object). To understand where users get stuck — for example between sign-up and the first useful search result — and to improve the Service, our servers send PostHog a small, fixed set of product events for every user, whatever cookie choice you make. We rely on our legitimate interest in measuring and improving our own product. We have weighed this interest against your rights: the events use only pseudonymous identifiers that we generate (your user account ID and your organization ID), the event name and fixed technical values; they contain no name, e-mail address, IP address, page address, free text, company, contact or search-result data; they are stored in the EU (Frankfurt) for the retention period of PostHog's plan, at most seven years; only GaduLabs can see them; and they are not used for advertising, profiling of individuals or decisions about you. Your browser does not send PostHog anything unless you allow analytics. You may object at any time: write to privacy@getcernio.com from the e-mail address of your account with the subject "Objection to product analytics". We then stop sending PostHog any event about your account, from our servers and from your browser, and delete the PostHog record of your account. We confirm when this is done, at the latest within 30 days. Objecting does not change how the Service works for you.

PostHog product analytics — KVKK Art. 10 information summary

• Controller: GADULABS YAZILIM LİMİTED ŞİRKETİ (details in Section 1).
• Data processed: pseudonymous IDs that we generate for the user account and the organization, product event names and fixed technical values (status, duration, count range, plan, language, role). If you allowed analytics, also browser events: fixed screen names, the time until results first appear, leaving a page while a search runs.
• Purpose: measure how the product is used, find the steps where users get stuck and improve the Service.
• Legal ground and collection method: server events are collected automatically by our servers on the ground of legitimate interest (KVKK Art. 5(2)(f)). Browser events are collected automatically in your browser, only with the explicit consent you give in the cookie preferences (KVKK Art. 5(1)).
• Recipient and purpose of transfer: PostHog Inc. (our processor), to provide the analytics service. Data is stored in the EU (Frankfurt). The transfer outside Türkiye uses the Board's standard contract under KVKK Art. 9, notified to the Authority within five business days of signature (Section 7).
• Retention: the retention period of PostHog's plan, at most seven years; deleted earlier when the account is permanently deleted or when you object (Section 9).
• Your rights (KVKK Art. 11): to learn whether your data is processed, to request information, correction, deletion or destruction, to learn the third parties it is transferred to, and the other Art. 11 rights. The objection route for this processing is in Section 4; it applies in the same way to everyone under the GDPR and the KVKK.

5. Customer Data Processed on Behalf of Customers (Processor)

5.1. When a customer uses the Service to discover buyers or find decision-makers, the Service processes information about third-party businesses and their contacts (e.g. company name, website, business phone, address, job title, and business email), obtained from publicly available web sources via AI and search providers. Company results may also come from the shared company-identity catalogue described in Section 5.2a, which includes the identity fields of companies that customers add. Contact results may also come from the shared contact pool described in Section 5.2b.

5.2. For a customer's own use of discovery and contact-search results (which results it keeps, the workspace records of contacts it adds, and its later edits, notes, lists and outreach), the customer is the controller and we are the processor, acting on the customer's documented instructions under our Data Processing Agreement (DPA). The shared company-identity catalogue (Section 5.2a) and the shared contact pool (Section 5.2b) are outside this processor role.

5.2a. Our controller role for the shared company catalogue. To operate the Service, we maintain a shared catalogue containing only company identity data: name, website, domain, country and city. These fields come from public sources and from companies that customers add to their workspaces (Terms of Service Section 9.1). It holds no business-contact data; contacts are in the separate shared contact pool (Section 5.2b). For this company data, we act as an independent controller and rely on legitimate interests (GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f)), as assessed in our Legitimate Interests Assessment. A customer's own use of this data in its workspace remains under the customer's control, with Cernio acting as processor under Section 5.2. To exercise your rights, use the routes in Sections 5.4 and 10.

5.2b. Our controller role for the shared contact pool. To avoid researching the same person again for every customer, we keep one shared record of the business identity of each business contact: name, job title, business email, business phone, professional profile link, company, and an automatic job-function label (contact_role) that the Service derives from the job title. The Service obtains these fields from publicly available web sources during contact searches. The shared contact pool also contains the name, business email and business phone that a customer enters when adding a contact; Cernio does not verify that these entered values appear in a public source. Another customer can receive those values when its contact search links to the same contact at the same company, including through a saved qualification, even if its own search does not find the entered email or phone. A later contact search by another customer can replace the entered name or phone and update the job details in the shared pool; the workspace then shows those shared values unless the customer has made its own edits to those fields. Customer edits made after creation, notes, lists and outreach records stay private to the workspace that wrote them. Where present, the record also holds the derived data-quality confidence described in the AI and Data Use Notice and contact metadata: is_primary (primary-contact flag) and status (record status). For the shared contact pool, we act as an independent controller and rely on legitimate interests (GDPR Art. 6(1)(f) / KVKK Art. 5(2)(f)). Our Legitimate Interests Assessment addresses public-source data and customer-entered identity fields separately. We handle your requests about the pool ourselves (Section 5.4).

5.3. The customer is responsible for having a lawful basis (typically legitimate interest for B2B contact) and for honoring data-subject rights regarding its own use of this data. We assist customers with such requests as described in the DPA.

5.4. If you are a business contact who appears in results and wish to exercise your rights, please contact us at privacy@getcernio.com. We handle requests about your record in the shared contact pool ourselves, as its controller: we can tell you what it holds, correct it, remove it or stop using it. Requests about a customer's own use of your data, such as its notes or its messages to you, we route to that customer and, unless legally required to act, act on the customer's instructions under the Data Processing Agreement (DPA). You can also contact the customer directly.

5.5. Notice to business contacts (GDPR Article 14). For the shared contact pool, this Privacy Policy is our notice as controller. For business identities obtained from public web sources, we rely on Article 14(5)(b). These records come from separate public sources, not from a direct relationship with each person. Individual notification would require checking a reliable channel for each person, sending and tracking an individual notice, and, where a reliable channel is absent, collecting further contact data solely to give notice. We assess that effort as disproportionate to the limited impact of reusing professional identity for B2B discovery, with the safeguards recorded in our LIA. This is not an exemption based on public availability or cost alone. We make this Privacy Policy publicly available and handle access, correction, erasure and objection requests ourselves at privacy@getcernio.com (Sections 5.4 and 10).

When a customer first contacts a person, the customer, as controller of that use, provides a short notice and a link to this Privacy Policy under Article 14(3)(b); for people for whom no contact channel is available, the customer relies on Article 14(5)(b). Cernio, as processor, supports the customer with the same safeguards.

6. How We Share Data — Subprocessors and Recipients

We share personal data with vetted service providers. They are our processors for data that we control and sub-processors for Customer Personal Data that we process on a customer's behalf. We also share payment data with the payment institution, which acts as an independent controller. Key recipients:

When you submit the contact form, Google processes the reCAPTCHA data on our behalf and on our instructions, as our processor, under the Google Cloud Terms of Service and the Cloud Data Processing Addendum.

Note on data location: Core data is hosted in the EU (Frankfurt). See Section 7 for international transfers involving providers outside the EU/EEA.

We do not sell your personal data. We may disclose data where required by law, to protect our rights, or in connection with a merger or acquisition (with notice where required).

Our DPA (Annex B) lists sub-processors of Customer Data. The table above also names the processors of data for which Cernio acts as controller, including website, security and contact-form data.

7. International Transfers

Some subprocessors are located outside the EU/EEA and Türkiye (e.g. in the USA). For transfers under the GDPR, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) or adequacy decisions where available. For transfers under the KVKK, we use the standard contracts of the Personal Data Protection Board (KVKK Article 9, as amended by Law No. 7499, in force since 1 June 2024) and notify the Authority within five business days of signature. We do not use explicit consent for these recurring transfers. You may request more information at privacy@getcernio.com.

PostHog stores our analytics data in the EU (Frankfurt); because PostHog Inc. is a US company and Frankfurt is outside Türkiye, we rely on the European Commission's Standard Contractual Clauses in PostHog's data processing agreement and, under the KVKK, on a standard contract notified to the Authority as described above.

8. Third-Party Links and Services

The Service may surface links to third-party websites (e.g. company websites found during discovery). We are not responsible for the privacy practices of those sites. The hosted payment page is operated by the payment institution under its own privacy policy.

Cookies and similar browser storage — including the optional analytics services above, which run only after your consent, and how to change your choice — are described in our Cookie Policy.

9. Data Retention

• Account data: kept for the life of your account. A deletion request starts a 30-day waiting period — there so you can undo an accidental deletion — after which the data is permanently deleted, unless a longer period is required by law.
• Authentication session records: deleted together with your account.
• Product analytics (PostHog): events are kept for the retention period of PostHog's plan, at most seven years. When your account is permanently deleted (after the 30-day waiting period above), or when you object (Section 4), we also delete the PostHog record of your account.
• Sentry error replays: retained under the Sentry plan in effect at ingestion; default replay retention is 30 days on the Developer plan and 90 days on paid plans. This is separate from authentication session records and account deletion.
• Activity and security logs: retained for security, abuse detection and accountability. When your account is deleted, the personal data in those records is scrubbed and the record is de-identified so it can no longer be linked to you; what remains is no longer personal data.
• Payment provider event records: deleted automatically after 90 days.
• Unpaid payment orders: a checkout that never completes leaves an order record without an invoice, so there is nothing to retain. Orders that are still awaiting payment, failed or cancelled become eligible for deletion 24 hours after they were created; an order that never reached the payment step becomes eligible after 1 hour. A clean-up that runs once a day deletes eligible orders in batches, so an unpaid order is typically gone within a day or two of becoming eligible. Paid orders are billing records (see the next item).
• Billing and financial records: retained for the period required by tax and commercial law (10 years for commercial books and records under Turkish law).
• Website enquiries: the message you send from the contact form, and the address you gave us, are kept as correspondence in our mailbox so we can answer you and keep a record of what was discussed. We do not copy them into a separate database, and you may ask us to delete them (Section 10).
• Customer Data (processor): deleted or returned per the DPA following termination.
• Contact data: a contact's record in the shared contact pool (Section 5.2b), including customer-entered identity fields, remains in the pool after the workspace record is deleted or the account closes, until we honour a request from that person to correct or remove it (Section 5.4) or an objection under GDPR Art. 21 (Section 10). The workspace record and later edits, notes, lists and outreach are kept until the customer deletes them or the account closes; they are then deleted or returned under the DPA. Deleting a workspace record does not itself remove the shared identity fields from the pool.
• Shared company-identity catalogue: the company identity data in the shared catalogue (name, website, domain, country and city; Section 5.2a) is kept while the company is listed in the catalogue, or until we honour a request from the company concerned to remove or suppress it (Acceptable Use Policy Section 5.4) or an objection under GDPR Art. 21 (Section 10).
• Deletion mechanics: the Service implements soft-deletion followed by scheduled hard-deletion (right-to-be-forgotten) of queued requests.

10. Your Rights

Subject to applicable law (GDPR and/or KVKK), you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate data;
• erase data ("right to be forgotten");
• restrict or object to processing (including profiling and direct marketing);
• object to product usage events at any time, as described in Section 4 ("Product usage events").
• data portability;
• withdraw consent at any time (without affecting prior processing);
• under KVKK, to learn whether your data is processed, request correction/deletion, and object to results arising exclusively from automated analysis;
• lodge a complaint with a supervisory authority — in the EU/EEA your local Data Protection Authority; in Türkiye the Turkish Personal Data Protection Authority (KVKK).

These rights are available to you except where retention is required by applicable law. Billing and invoice records are retained for the periods required by applicable tax and commercial law, including after an account is closed (Section 9); a deletion request cannot be honoured for those records before the statutory period expires.

To exercise your rights, contact privacy@getcernio.com. We will respond within the timeframes required by law (generally one month under GDPR; 30 days under KVKK).

11. Automated Decision-Making

The Service uses AI to rank and score potential buyer companies ("lead scoring"). These outputs are decision-support tools, not automated decisions producing legal or similarly significant effects on individuals. Human review by our customers is expected. If you believe you are subject to a decision based solely on automated processing, contact us.

12. Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit, access controls, row-level security for tenant isolation, hashed credentials, optional MFA, PII masking in session-replay/analytics, and error-data scrubbing. No system is perfectly secure; we cannot guarantee absolute security.

Security and audit logs. To keep the Service secure and to investigate abuse, we record security-relevant actions in an activity log: for example sign-ins and sign-in attempts, changes to members and roles, exports and administrative actions. A log entry can contain the account that acted, the organization, the time, the IP address and the browser's user agent. A small number of authorized Cernio platform administrators can view these entries across all customer organizations, only after multi-factor authentication, and only for security, abuse-prevention, support and legal-compliance purposes. Every such view is itself recorded in the log. Organization owners and managers can see the entries of their own organization only. Retention and de-identification of these entries follow Section 9.

13. Children

The Service is not intended for anyone under 18. We do not knowingly process children's data. If you believe a child has provided us data, contact us for deletion.

14. Changes to This Policy

We may update this Policy. For material changes we will provide reasonable notice (email or in-app). The "Effective date" indicates the latest version.

15. Contact

• Data protection: privacy@getcernio.com
• Controller: GADULABS YAZILIM LİMİTED ŞİRKETİ, Mustafa Kemal Paşa Mah. Yalova-Bursa Yolu Cad. A Blok 1. Kademe No: 123/1 İç Kapı No: 10, Merkez / YALOVA, Türkiye
• KVKK data controller contact: privacy@getcernio.com

This Policy is provided for transparency and does not constitute legal advice.