Privacy policy

This policy explains how Venüs Yazılım Bilişim ve İnternet Hizmetleri, Küçükbakkalköy Mah. Dereboyu Cad. Brandium Residence No:3a, R5 Blok, K:7 D:48, 34750 Ataşehir/İstanbul, Türkiye ("Zefily", "we") processes personal data when you visit zefily.com, use the Zefily control panel, API, command-line tool or agent, or contact us. For personal data inside your sites and applications, we act as your processor; see section 9 and the Data Processing Agreement.

1. Controller and contact#

The controller for the processing in this policy is Venüs Yazılım Bilişim ve İnternet Hizmetleri. You can reach us at hello [at] zefily [dot] com or by post at Küçükbakkalköy Mah. Dereboyu Cad. Brandium Residence No:3a, R5 Blok, K:7 D:48, 34750 Ataşehir/İstanbul, Türkiye.

2. What we process#

Account and identity data — name, email address, password hash, passkeys (public keys only), two-factor settings, sign-in and session records (IP address, browser, time), language and theme preferences.

Organization data — organization name, members and their roles, invitations, API tokens (stored hashed), approval passkeys and the audit log of actions taken in the panel.

Server and service data — data the Agent reports about your servers: hostname, operating system, hardware, installed packages, service status, metrics, job parameters and results, and logs you open in the panel. Names of system users, sites, domains and databases. Secrets you store in the panel (for example environment variables, provider API tokens and backup credentials) are kept encrypted.

Terminal recordings — when you open a web terminal, the session is recorded encrypted so it can be reviewed in the audit trail.

Billing data — plan, subscription status, invoices and the identifiers of our payment provider. Card and bank details are handled by the payment provider and never reach us.

Support and contact data — tickets, messages and attachments you send us, and messages sent through the contact form (name, email, company, message, a hash of the sender's IP address used against abuse).

Website data — the public website uses no advertising. Our servers keep technical logs (IP address, requested page, browser, time) for security and operation. If you accept analytics cookies, Google Analytics measures how the website is used (pages viewed, referrer, device and approximate location, with IP addresses shortened); if you decline, it receives only cookieless, aggregated signals. The panel, API and agent never use analytics.

3. Why we process it and on what legal basis#

Purpose	Legal basis (GDPR art. 6 / KVKK art. 5)
Providing the service, running the jobs you request, support	Performance of a contract
Security: signing jobs, detecting abuse, audit trails, rate limits	Legitimate interest in securing the service and our customers; legal obligations
Billing, invoicing and taxes	Performance of a contract; legal obligation
Service emails (verification, security alerts, failed payments, ticket replies)	Performance of a contract
Product news and marketing emails	Consent, which you can withdraw at any time
Improving the service from aggregated, non-identifying usage figures	Legitimate interest
Website analytics cookies (Google Analytics)	Consent, which you can withdraw at any time under Cookie settings in the website footer
Complying with legal requests and defending legal claims	Legal obligation; legitimate interest

We do not sell personal data and do not use it for automated decisions with legal effects on you.

4. Who receives data#

We share personal data only with service providers that help us run Zefily, under contracts that bind them to protect it, and only as far as they need it:

• Infrastructure — Contabo GmbH and Leaseweb Deutschland GmbH (Germany) for the control plane servers; Cloudflare for DNS, content delivery and protection against attacks; Cloudflare R2 for agent downloads and encrypted backups of our own systems.
• Payments — Polar Software Inc., our reseller and merchant of record, for checkout, invoicing and taxes.
• Email — Spaceship, Inc. (Spacemail) for transactional email.
• Website analytics — Google Ireland Limited (Google Analytics), only for website visitors who accept analytics cookies.
• Integrations you connect — GitHub, GitLab, cloud and DNS providers receive the requests needed for the features you enable, under their own terms.

Authorities receive data only when the law requires it.

5. International transfers#

Our control plane is hosted in Germany (European Union). Some providers may process data outside your country, including in the United States. Where data leaves the European Economic Area, the United Kingdom or Türkiye, we rely on adequacy decisions, standard contractual clauses or, for Türkiye, the transfer safeguards of KVKK article 9 (including the notification of standard contracts to the Personal Data Protection Authority where required).

6. How long we keep data#

• Account and organization data — while your account exists, and up to 30 days after you delete it (backups up to 35 days).
• Audit log — for the life of the organization, then deleted with it; security-relevant entries up to 2 years where needed for investigations.
• Terminal recordings — 90 days, unless your plan sets a different period.
• Metrics and job history — for the retention period of your plan.
• Billing records — as long as tax and commercial law requires (in Türkiye generally 10 years).
• Support tickets and contact messages — up to 3 years after the last message.
• Website server logs — up to 30 days.
• Website analytics (Google Analytics) — 14 months; the consent choice cookie 6 months.

7. Security#

Every change on your servers is signed twice — by the control plane and by a separate signing service — and high-risk changes also need your passkey. Secrets are stored encrypted with keys held in a separate key management system. Access to production systems is limited to named staff with passkeys and is logged. No system is completely secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

8. Your rights#

Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent. Under KVKK article 11 you can also learn whether your data is processed, the purpose, the recipients at home and abroad, and claim compensation for damage caused by unlawful processing.

You can export and delete most data yourself in the panel. For other requests write to hello [at] zefily [dot] com; we answer within 30 days. You also have the right to complain to your data protection authority (in Türkiye, the Personal Data Protection Authority — KVKK; in the EU, the authority of your country).

9. Data in your sites and applications#

The data your sites and applications hold — visitors, customers, orders, form entries, files and databases — stays on your servers and the backup destinations you choose. Zefily processes it only on your instructions, for example when you run a backup, transfer a database or open a file, and acts as your processor under the Data Processing Agreement. You are the controller and must inform your own users.

10. Cookies#

The website and panel use cookies needed to run them: a session cookie, a security (CSRF) cookie, and cookies that remember your language, theme and cookie choice. The public website also asks whether it may use Google Analytics cookies (_ga, _ga_*); they are set only after you accept, and you can change your choice at any time under Cookie settings in the website footer. We do not use advertising cookies, and the panel uses no analytics.

11. Children#

The service is not meant for people under 18 and we do not knowingly collect their data.

12. Changes#

We may update this policy. We will announce material changes by email or in the panel before they take effect. The date at the top shows the latest version.