Legal
Privacy policy
Last updated 30 July 2026
This policy explains what personal data LediCRM collects, why, and what rights you have. The controller is Turgut Tak, trading as LediCRM, Pendik, İstanbul, Türkiye.
1. What we collect
- Account data — name, work email, company, role, and authentication details.
- Billing data — subscription plan, seat count, billing address and tax identifiers. Card details are handled by our payment providers and never reach our servers.
- Customer content — the products, companies, contacts, quotations and documents you enter or import. This may contain personal data about your own contacts, for which you are the controller and we are the processor.
- Usage data — log records, feature usage, token consumption, and error diagnostics.
2. Why we process it, and on what basis
- To provide the service under our contract with you.
- To take payment and meet accounting obligations — contract and legal obligation.
- To keep the platform secure and diagnose faults — legitimate interest.
- To send service notices such as trial and billing emails — contract.
3. AI processing
When you use the assistant, catalogue import, smart search or the pricing assistant, the relevant content is sent to Anthropic’s API for processing and a result is returned. This can include product data and, depending on your query, records from your account. Anthropic processes it as our sub-processor and does not use it to train models. If you would rather no content left the platform this way, use the Standard plan, which does not include AI features.
4. Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Railway Corp. | Application and database hosting | European Union (Amsterdam) |
| Anthropic | AI features | United States |
| Plausible Insights OÜ | Website analytics | European Union |
| Brevo | Transactional email | European Union |
| Paddle.com Market Ltd | Payments, merchant of record | United Kingdom |
5. International transfers
Your account data and customer content are hosted in the European Union, in Amsterdam, the Netherlands.
Two sub-processors operate outside the European Economic Area: Anthropic, in the United States, which processes the content you send to the AI features, and Paddle, in the United Kingdom, which processes your billing details. Those transfers are made under the European Commission’s standard contractual clauses and, in Paddle’s case, the United Kingdom’s adequacy decision. Under Turkish data protection law they rest on the legal ground applicable to transfers abroad.
6. Retention
Account and customer content is kept for as long as the account is active. After termination it is available for export for 30 days and then deleted. Billing records are retained for 10 years to meet accounting law. Logs are kept for 90 days.
7. Your rights
Subject to local law you may request access to your personal data, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Write to hello@ledicrm.com. You may also complain to your supervisory authority.
If you are one of our customers’ contacts rather than an account holder, please direct your request to the company that holds your details; we will assist them in answering it.
8. Security
Data is encrypted in transit. Each account’s records carry a tenant identifier which is enforced on the server for every query. The assistant’s read path uses a database user with read-only rights, and any change it proposes requires explicit confirmation from a signed-in user.
9. Cookies and analytics
The only cookies we set are strictly necessary ones: they keep you signed in and protect the session against request forgery. They cannot be switched off, and the law does not require consent for them.
We do not set analytics, advertising or cross-site tracking cookies. There is no consent banner on this site because there is nothing to consent to.
Analytics
We measure traffic with Plausible Analytics, an open-source tool run by a company in Estonia and hosted entirely on infrastructure owned by European companies. It sets no cookies, assigns no persistent identifier and builds no profile of you. What it records is aggregated: page views, unique visitor counts, referring sites, most-read pages, country, device type and browser. None of it identifies you, and none of it leaves the European Union.
Because no personal data is collected and no cookie is set, there is nothing for you to opt out of and nothing for us to delete on request. If you would still rather not be counted, any content blocker that blocks plausible.io will stop the measurement.
10. Changes
We will post updates on this page and, where the change is material, notify you by email.