Privacy Policy: Usherfly
California residents have additional rights under CCPA. See Section 10.
1. Introduction
Usherfly takes the privacy of your personal data seriously. This Privacy Policy explains what personal data we collect when you use the Usherfly platform, how we process it, how long we retain it, and how you can exercise your rights. This policy is prepared under the Turkish Personal Data Protection Law No. 6698 (KVKK). It also covers your rights under the California Consumer Privacy Act (CCPA) (see Section 10).
Contact: [email protected]
1.1 Controller and Processor Roles
Usherfly acts in different roles depending on the type of data it processes:
- For account data (email, name, organization name, password hash), Usherfly is the data controller.
- For onboarding flow data (uploaded documents, form responses, e-signature data), the Organization (Organization Admin) is the controller and Usherfly is the processor. Usherfly processes this data only on the Organization's instructions.
For Onboardees: To exercise your rights (access, rectification, erasure) over documents, form responses, and e-signature data you share within an onboarding flow, contact the Organization that invited you first. As the Organization's processor, Usherfly supports such requests on the Organization's behalf. The detail of these roles is defined in the Data Processing Agreement.
The legal entity acting as data controller is Truemium OÜ (Estonian Business Register code 17381638), registered at Paavli tn 5a/1, Põhja-Tallinna linnaosa, 10412 Tallinn, Estonia. Contact: [email protected]
2. Data We Collect
| Category | Examples | For Whom |
|---|---|---|
| Identity and contact | First name, last name, email address | All users |
| Account information | Password (hashed), organization name | Organization Admin |
| Onboarding content | Uploaded documents, form submissions, e-signature data | Onboardee |
| Payment information | Billing address (card data not stored by Usherfly) | Paid plan users |
| Session and log data | IP address, browser type, page visits, timestamps | All users |
2.3 Demo and Sales Lead Data
When a visitor submits a demo request or contact form on the Usherfly website, we process their name, email address, company name, and message solely to respond to the request. This data is processed by Truemium OÜ (Estonian Business Register code 17381638), registered at Paavli tn 5a/1, Põhja-Tallinna linnaosa, 10412 Tallinn, Estonia, acting as data controller, under consent (GDPR Art.6(1)(a); KVKK Art.5/1), given by ticking the consent checkbox on the demo form, and is not shared with third parties. Retention: up to 12 months after the request is responded to. To request deletion: [email protected].
3. Purposes and Legal Bases for Processing
Account creation and service delivery (contract performance); security and fraud prevention (legitimate interest); product improvement and analytics (legitimate interest); email notifications (contract performance); marketing emails (explicit consent); compliance with legal obligations; anonymous analytics (KVKK Art. 28).
Product telemetry is processed in two layers: browser-side analytics and session replay run only with your explicit cookie consent; server-side product events such as signup, activation, limit, and upgrade events are processed pseudonymously, without cookies, under legitimate interest / contract performance (D-165).
4. Retention Periods
User profile and document data is retained for the duration of the active account and permanently deleted upon deletion request (D-024). Event logs are retained for 3 years after user identifier anonymization. Security logs are retained for a maximum of 1 year.
5. Data Recipients
AWS (a single EU region): server hosting and compute (document storage is MinIO running on infrastructure we operate ourselves; AWS is not used as an object-storage provider); Paddle Billing: payment processing; transactional email provider: notifications; PostHog (EU data region, eu.i.posthog.com): product analytics and consent-gated, masked session recordings; Sentry: error tracking; Anthropic (Claude), OpenAI: AI onboarding flow generation, active from June 14 to August 24, 2026, suspended on August 24, 2026 (D-190) (admins were instructed not to include onboardee personal data in these fields; nothing from a generation was retained: no prompt, no role, no draft, the only thing kept is an aggregate counter that holds no personal data). During that period, data was transferred to the United States under an asserted Standard Contractual Clauses (SCC) safeguard; execution of those SCCs was never confirmed; the transfer has ceased; Google (OAuth / Workspace): sign-in identity authentication (name, email, Google account id), United States; SMS providers (Twilio, İletimerkezi): delivery of transactional onboarding messages and opt-in marketing messages by SMS (phone number, message content), region / transfer mechanism to be finalized before go-live, a GDPR-adequate safeguard will be in place; WhatsApp provider (planned): delivery of transactional onboarding messages and opt-in marketing messages over WhatsApp (phone number, message content), provider selection to be finalized before go-live. We do not sell, rent, or share personal data for advertising purposes. Current sub-processor list: Sub-Processor List.
6. Data Security
We apply encryption in transit, access controls, and regular security reviews. In the event of a breach, we will notify you and relevant authorities as required by applicable law.
7. Your Rights Under KVKK
You have the right to be informed, access your data, request rectification, request erasure, restrict processing, object to processing, claim compensation for unlawful processing, and obtain information on data transfers. Submit requests to [email protected] or via account settings (responded to within 30 days). Supervisory authority: KVKK (kvkk.gov.tr).
8. Cookies
Analytics cookies and session replay are enabled only with the explicit consent you give in the cookie banner; choosing "necessary only" means no analytics cookies are used. For details, see Cookie Policy.
9. International Data Transfers
Primary storage and processing take place in a single EU region (D-179), which meets GDPR-equivalent adequacy standards. Documents are stored in MinIO running on infrastructure we operate ourselves; the hosting infrastructure is provided by AWS. There are two categories of US transfers: AI flow generation (Anthropic, OpenAI), which was active from June 14 to August 24, 2026. While it ran, the admin-provided flow description, role, and context text was transferred transiently under an asserted Standard Contractual Clauses (SCC) safeguard whose execution was never confirmed. Admins were instructed not to include onboardee personal data in these fields. Nothing from a generation was retained: no prompt, no role, no draft; the only thing kept is an aggregate counter that holds no personal data. The feature was suspended on August 24, 2026 and this transfer has ceased; it will not resume until our self-hosted EU model ships. The second category is Google OAuth sign-in (based on the user's consent at sign-in), under Standard Contractual Clauses (SCCs) via the Google Cloud DPA. For details, see the sub-processor list and Section 5.
10. Additional Rights for California Residents (CCPA)
California residents have the right to know, access, delete, and opt out of sale of personal data. Usherfly does not sell personal data. Submit requests to [email protected] (responded to within 45 days). Supervisory authority: CPPA (cppa.ca.gov).
11. Changes to This Policy
For material changes, we will notify you by email in advance.
12. Contact
Privacy questions: [email protected]