AccountSign in with Google

KVKK Privacy Notice

Version 1.2 · Effective

This is an English translation of the KVKK Aydınlatma Metni. If the two differ, the Turkish text prevails.

Summary

This notice is prepared under Turkey's Law No. 6698 on the Protection of Personal Data (“KVKK”) to inform you about the personal data processed when you use GSC PAP (GSC PAP). For more detail you can also read the Privacy Policy, which sets out the same rules from a global perspective.

1. Data Controller

The person operating this service as data controller: GSC PAP (Personal project (independent operator)). Contact: support@gscpap.com. GSC PAP is an independently operated personal project; there is no legal entity behind it. The operator is based in Türkiye.

2. Personal Data Processed

  • Identity and contact: the email address and display name from your Google account.
  • Authentication: Google OAuth refresh token (stored encrypted with AES-256-GCM) and MCP bearer token (stored only as a SHA-256 hash).
  • Usage records: the MCP tool called, a summary of its parameters, latency, error message, timestamp, the size of the result returned (row and character count) and the User-Agent of the AI client that made the call (kept for 90 days).
  • Search Console data: search analytics, daily totals, URL inspection and sitemap data we fetch from Google on your behalf (your personal archive).
  • Google Analytics data: if you have connected Analytics, it is fetched from Google on your behalf when your assistant asks. A copy may be kept to answer repeated questions faster and to preserve history; if kept, it is part of your personal archive and subject to the same rules.
  • Email records: a record of the account emails and weekly summaries we send you.
  • Technical records: IP address, browser information, timestamp and server logs. The web app keeps a random browser identifier (gp_vid) in your browser, and where your first visit came from (gp_first_touch: the referring site and utm_ tags). These are sent only to our own API; when you sign up, the second is stored with your account.

3. Purposes of Processing

  • Providing the service: connecting Google Search Console to AI assistants and managing your personal archive.
  • Account management: signing in, creating and revoking tokens, deleting the account.
  • Security and abuse prevention: rate limiting, detecting abnormal activity, verifying sessions.
  • Debugging and service improvement: finding errors, measuring performance and developing features through automated processing; aggregate statistics that identify no account, for our internal operations.
  • Compliance with legal obligations: responding to requests from competent authorities.
  • Operator access: a person looks at an account's data only for support you ask for, to investigate a bug, a security incident or abuse, or when the law requires it. Otherwise we work only with aggregate data that identifies no account. Every access is recorded in the audit log, with who looked at which account, when and why.

Your data is not used for advertising, profiling, training AI models or credit decisions. A new use not written in this notice (for example a feature that compares your site with anonymous data from many accounts) starts only after we update this notice, tell you by email and get your explicit consent in the product; if you do not consent, your data stays out of it. No such use exists today.

4. Legal Grounds for Processing

We rely on the following legal grounds under Articles 5 and 6 of the KVKK:

  • Formation and performance of a contract (Art. 5/2-c): the core account and token data needed to provide the service.
  • Legitimate interest of the data controller (Art. 5/2-f): security, abuse prevention, debugging, service quality.
  • Compliance with a legal obligation (Art. 5/2-ç): responding to legal requests.
  • Explicit consent (Art. 5/1): for processing beyond the above that requires specific approval (none exists yet; if added, you will be told first and asked for consent in the product).

5. Third Parties Data Is Transferred To

We do not sell, rent or trade your data. No other GSC PAP user can see your data. Data is transferred only to the following providers that run the service, and only for that purpose:

  • Google LLC (USA): Sign in with Google, and the Search Console, Analytics Data and PageSpeed Insights APIs we call on your behalf. Also Google Analytics for our own site's traffic (see section 9).
  • Contabo GmbH (Germany): servers in the European Union that run the service and host the database.
  • Cloudflare, Inc. (USA, global network): serves gscpap.com and app.gscpap.com, carries API and MCP traffic to our servers, runs Turnstile bot verification and delivers our emails.
  • Serper (serper.dev): runs the searches behind the live Google results tools. It receives only the search phrase your assistant asks for, the country and the language; it does not receive your account details.
  • Competent authorities: in case of a court order or legal obligation, limited to the data requested.
  • Acquiring party: if GSC PAP is ever merged or sold, only after obtaining your explicit consent first.

The use and transfer of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Some of these providers are abroad (the European Union and the USA). These transfers are necessary to provide the service and are made only for the purposes above.

6. Retention Periods

  • Account data (email, encrypted OAuth token): for as long as your account exists; deleted within 30 days of deleting the account.
  • Personal archive (Search Console data, and Analytics data if kept): for as long as your account exists. Removing access on Google's side stops new data being added but does not delete the archive, so your history is still there when you reconnect. Deleted within 30 days of deleting the account. You can ask by email for specific properties or date ranges to be deleted sooner.
  • Usage records (tool calls): 90 days.
  • Email records: for as long as your account exists, so the same email is not sent twice.
  • Audit logs: 5 years, for security. They contain no Search Console or Analytics data.
  • Server logs: at most 30 days.
  • Aggregate statistics that identify no account (for example daily tool call counts) may be kept for the life of the service.

If you sign in again within 30 days of deleting your account, your account comes back; that is why deletion completes at the end of that period.

7. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of the KVKK you can apply to the data controller to exercise the following rights:

  • to learn whether your personal data is processed;
  • if it is, to request information about it;
  • to learn the purpose of processing and whether it is used in line with that purpose;
  • to learn the third parties in Türkiye or abroad to whom it is transferred;
  • to ask for it to be corrected if it is incomplete or inaccurate;
  • to ask for it to be erased or destroyed under the conditions set out in the KVKK;
  • to ask for corrections, erasure or destruction to be notified to the third parties it was transferred to;
  • to object to an outcome against you that results from analysis of the data exclusively by automated systems;
  • to claim compensation if you suffer damage because the data is processed in breach of the KVKK.

You can also delete your account directly from the "Delete account" section of the /account/profile page.

8. How to Apply

To exercise the rights above you can apply to the data controller in writing or by registered electronic mail (KEP). Under Article 13 of the KVKK, an application:

  • Email: support@gscpap.com (subject: "KVKK Application")
  • Contents: full name, Turkish ID number (passport number for foreign nationals), address for notifications, subject of the request.
  • Response time: answered within 30 days of the request at the latest.
  • Fee: free of charge; if an additional cost arises, the tariff set by the Board applies.

If you are not satisfied with the response to your application, you retain the right to complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

9. Cookies and Analytics

Strictly necessary cookies (no consent required): gscpap_session (session signature, 1 year), gscpap_known (session flag), gscpap_oauth_nonce (10 minute OAuth nonce), cf_clearance (Cloudflare bot verification). All are required for signing in and for security.

Analytics (Google Analytics 4): we use Google Analytics 4 (property G-7VFMNP7705) for page view and traffic statistics. IP anonymization is on: your full IP address is not passed to GA4. On gscpap.com a small script keeps a random visitor identifier in your browser's local storage; on app.gscpap.com Google's gtag.js script sets the _ga and _ga_* cookies (1 year). Nothing is sent to GA4 from your email, name, account ID, site address or your Search Console or Analytics data: IDs in page addresses are replaced with ":id", only utm_ tags are kept from the query string, and admin pages are not counted at all. There are no advertising pixels, third-party ad networks or sale of profiles.

Opting out: a browser-level ad blocker (uBlock, Brave Shields), Google's official GA Opt-Out add-on, or deleting the _ga* cookies is enough. The rest of the site keeps working.

10. Changes

This notice is in effect as of the date given above. Material changes are announced by email at least 14 days before they take effect. A change that would use your data for a new purpose also asks for your explicit consent in the product (see section 3).

Contact

For questions, requests or complaints: support@gscpap.com.