Privacy policy

The Turkish text is the primary text; the English text is informational.

Two roles. Crossell is the controller of your account data; for your buyers' data you are the controller and Crossell processes it only on your behalf and instruction, under the Data Processing Agreement and, for sellers in Türkiye, the KVKK Module 2 standard contract.
What we process. Full category list, purposes, legal bases and periods: the Privacy Notice. In short: account and contact data; subscription and payment records (card numbers go to Stripe, not to us); API keys and tokens of the channels you connect (AES-256-GCM); your products, stock, prices, orders and finance records; support requests; security and activity logs; analytics only with your consent.
What we do not do. We do not sell, rent or trade personal or store data; we do not use your buyers' data for our own purposes or advertising; we do not train AI models on your or your buyers' data; we do not scrape marketplaces; we do not use advertising or cross-site tracking cookies.
Sharing. Only with service providers we use to run the service (hosting, backup, e-mail, payments, AI, analytics with consent, e-invoicing) and with authorities where the law requires. Current list with countries: /subprocessors. Data goes to the channels you connect only through actions you take.
AI. When you start an AI feature, the relevant text or image goes through OpenRouter to the model provider (Google Gemini; OpenAI as a fallback on one task). Buyer names, e-mails, phones, ID and order numbers are masked first. AI output is never sent to a buyer without your approval; checking it is your responsibility.
Transfers abroad. Our servers are in the US. Transfers from Türkiye use the Board's standard contracts under KVKK Art. 9; explicit consent is not relied on.
Retention and deletion. Account data while the account is open; close the account in Settings › Account › Delete account or via [email protected]; a deletion request has a 30-day cancel window, after which your account and everything in it is deleted, except payment records the law requires us to keep. Buyer questions and messages are anonymised 2 years after the last message (buyer name and every buyer identifier removed; the question and answer text stays anonymous); your answers are kept while your account is active (the buyer's name is removed from them after 2 years); customer names on orders are kept while your account is active and erased with it; shipping-label files are deleted after 30 days. AI credits expire. Disconnecting a channel clears its credentials at once; your order and report history stays. Backups roll over in 30 days (weekly volume backups 84 days).
Security. HTTPS; AES-256-GCM for credentials; per-file keys for private files; 12+ character passwords changed every 365 days; optional two-step verification (mandatory for admins); feature-based team permissions; audit logs; daily backups; firewall and intrusion detection. No method is 100 % secure.
Breaches. We tell you by e-mail without undue delay. For data we control we notify the Board and data subjects (72 hours, Board decision 2019/10); for buyer data we tell you within 24 hours and give you what you need for your own notifications as controller.
Your rights. KVKK Art. 11 rights and how to apply: Privacy Notice section 7. Outside Türkiye you may also use the access, correction, deletion, portability and objection rights your local law gives you via [email protected].
Cookies. See the Cookie Policy; everything except necessary cookies needs your consent.
Children. Crossell is for businesses and not directed at anyone under 18.
Changes. We update the date; material changes are e-mailed and need acceptance.

To exercise a right under KVKK Article 11, use the request form. Data request form

Service provider