Privacy Policy
What personal data we process, why and on what legal basis, who receives it, and how to exercise your rights. The Turkish version (KVKK Aydınlatma Metni) prevails.
Effective: 2 November 2026
1. Controller
The data controller is Alta AI Teknoloji Limited Şirketi (“Nichle”, “we”), under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).
- Address: Mecidiyeköy Mah. Selahattin Pınar Aralığı Sk. Hüseyin Özer İş Merkezi No: 3 İç Kapı No: 8, Şişli / İstanbul, Türkiye
- MERSİS No: 0059142841500001
- E-mail: kvkk@nichle.com
2. Data we process
| Category | Data |
|---|---|
| Identity and contact | Name, e-mail address, your Google profile picture link. |
| Customer transactions | Plan and status, invoices, Stripe or iyzico customer and subscription ids, your optional answers to the cancellation survey. |
| Finance | Billing address, country, tax id if any, card last four digits and brand. We never see or store your card number; iyzico or Stripe takes the payment. For an iyzico subscription your mobile number, billing address and, if you choose to give it, your Turkish ID number (T.C. kimlik) are passed to iyzico and not stored by us; the ID number is optional. |
| Usage | Which tools you use and how often, saved channels and videos, folders, tracked channels, saved filters, exports. |
| Security | Session tokens, IP address and browser details (in server logs), sign-in times. |
| Your connected YouTube channel | Only if you connect it: channel id and title, access tokens (encrypted), its YouTube Analytics data (including revenue). |
| Support | What you write in bug reports, an optional screenshot, the page address, browser details. |
| Analytics (only with consent) | Paths of pages visited, traffic source, coarse device and location (Google Analytics). |
We process no special categories of personal data.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Creating your account, signing you in, providing the service | Performance of a contract (5/2-c) |
| Running subscriptions, payments, invoicing and cancellation | Contract (5/2-c); tax and commercial law (5/2-ç) |
| Enforcing plan limits, preventing abuse and fraud, security | Legitimate interest (5/2-f) |
| Answering bug reports and support requests | Contract (5/2-c); legitimate interest (5/2-f) |
| Showing analysis of a YouTube channel you connect | Contract (5/2-c) — only when you connect one |
| Improving the product from the cancellation survey | Legitimate interest (5/2-f); answering is optional |
| Measuring site traffic (Google Analytics) | Explicit consent (5/1), given in the cookie banner and withdrawable any time |
| Legal obligations, requests from authorities, protecting rights | Legal obligation (5/2-ç); establishing or defending a right (5/2-e) |
4. How we collect it
Electronically, automatically or partly automatically: from Google when you sign in with Google, from you when you use the web app and the Chrome extension, from iyzico or Stripe when you pay, and (if you allow it) through Google Analytics cookies.
5. What the extension sends, and what it never collects
Only while you are signed in to your Nichle account, and only on youtube.com, the extension sends nichle.com what its panels need: the channel and video ids, and the channel handle, of the channel and video pages you open; the ids of the videos visible on the home, subscriptions and search-results pages; and the term you search for on YouTube’s search page. They are used to fetch the metrics you asked for and are not stored against your profile as browsing history. Nothing is sent while you are signed out.
It never collects:
- Page content, keystrokes or form input other than the YouTube search box.
- Your browsing history outside youtube.com.
- Images you compress — those are processed entirely in your browser and never uploaded.
The use of information the extension receives adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
6. YouTube API Services and your own channel data
Nichle uses YouTube API Services to read public channel and video information — titles, descriptions, view and subscriber counts — and, only if you connect your own channel, that channel’s analytics. Public data is refreshed from YouTube or deleted within 30 days; we keep historical view and subscriber statistics so growth over time can be measured.
If you connect a YouTube channel, Google asks you to grant three read-only permissions, and we use them only to show that channel’s own reports to you on My Channels. youtube.readonly identifies which channel you connected (its ID and name). yt-analytics.readonly reads its views, watch time, audience retention, subscribers gained and lost, traffic sources, devices, geography and demographics. yt-analytics-monetary.readonly reads its estimated revenue, ad revenue, gross revenue, CPM and monetised playbacks. We never upload, edit, comment or act on your behalf.
The access tokens are encrypted at rest and never sent to your browser or the extension. The reports are kept as a short-lived cache so a page does not ask Google again on every visit, and are deleted within 30 days. Your channel’s data is shown only to you: it is never combined with other users’ data, never used for our estimates or benchmarks, and never shown to anyone else. If you disconnect in the app, we revoke the access with Google and delete the tokens and reports at once; if you revoke it in your Google account instead, we delete them the next time we check with Google, and at most within 30 days.
Nichle’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How Google handles data is described in the Google Privacy Policy.
You can revoke Nichle’s access to your YouTube data at any time from your Google security settings.
By connecting a channel you also agree to the YouTube Terms of Service.
7. Who receives it
We do not sell your data or share it for advertising. To provide the service we transfer it only to these providers, acting as processors, for the purposes above:
| Recipient | For | Location |
|---|---|---|
| Supabase Inc. (on Amazon Web Services) | Database, authentication and file storage | Database: EU (Paris, France); company: USA |
| Vercel Inc. | Hosting the web app, server logs | Servers: EU (Paris) and a global edge network; company: USA |
| Contabo GmbH | Background jobs (data refresh, preparing export files) | Germany |
| Upstash Inc. | Background job queue (job records may carry your user id) | USA / EU |
| iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) | Payments and subscriptions (new subscriptions) | Türkiye |
| Stripe (Stripe Payments Europe Ltd. / Stripe Inc.) | Payments, subscriptions and invoices | Ireland / USA |
| Google LLC | Google sign-in, YouTube API Services, Google Analytics (with consent) | USA |
| Functional Software Inc. (Sentry) | Error reports (may include your user id, the page address and browser details; never your email) | USA |
| Resend, Inc. | Billing notification e-mails (trial ending, payment problem, cancellation confirmation); includes your e-mail address and subscription details (date, amount) | Servers: Japan; company: USA |
Public YouTube channel and video information (titles and descriptions), which contains no personal data, is also sent to OpenAI and TypeSafe as service providers, to classify channels and find similar channels and videos. They receive none of your account data, none of your connected channel’s analytics and none of the ids the extension sends.
We may also disclose data to competent authorities and courts where the law requires it (KVKK Art. 8). Some of the providers above are outside Türkiye, so your personal data is transferred abroad within the meaning of KVKK Art. 9. We have asked our main providers (Vercel, Supabase, Sentry) to sign the standard contract published by the Turkish Personal Data Protection Board; any standard contract that is signed is notified to the Authority within five business days of signature. The transfer for Google Analytics rests on your explicit consent, which you can withdraw at any time from the cookie preferences.
8. How long we keep it
- Account, usage and saved content: while your account is open; deleted within 7 days of a deletion request.
- Invoices and payment records: as long as tax and commercial law require (up to 10 years under the Turkish Commercial Code Art. 82 and the Tax Procedure Law Art. 253).
- Connected YouTube channel tokens and reports: reports for at most 30 days; both deleted the moment you disconnect in the app, or within 30 days if you revoke access from your Google account.
- Bug reports: at most 2 years after they are resolved.
- Server logs: for the provider’s retention period, for security (typically days to weeks).
- Your cookie choice: 1 year.
9. Your rights (KVKK Art. 11)
You may ask us whether your data is processed and for information about it; learn the purpose and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; have it corrected if incomplete or wrong; have it erased or destroyed under Art. 7; have corrections and erasures notified to recipients; object to an adverse outcome produced solely by automated analysis; and claim compensation for damage caused by unlawful processing. You can withdraw analytics consent any time from the “Cookie settings” link.
10. How to apply
Write to us in Turkish or English with your name, signature (for written applications), national id or passport number, address, e-mail and your request: in writing to Mecidiyeköy Mah. Selahattin Pınar Aralığı Sk. Hüseyin Özer İş Merkezi No: 3 İç Kapı No: 8, Şişli / İstanbul, Türkiye; or from the e-mail address registered to your account to kvkk@nichle.com. We answer free of charge within 30 days. If we refuse, answer insufficiently or do not answer in time, you may complain to the Turkish Personal Data Protection Board (KVKK).
11. How we protect your data
- In transit: every connection to Nichle uses HTTPS (TLS), and plain HTTP is redirected and refused by HSTS. Our servers reach the database over TLS as well.
- Google access and refresh tokens are encrypted (AES, OpenPGP symmetric encryption) before they are stored. The encryption key is kept in our servers’ secret configuration, separately from the database, so a copy of the database alone does not reveal a token. Tokens are only ever decrypted on our servers, when they are needed to call Google, and are never sent to your browser, the extension or our logs.
- At rest: the database and its backups are held by Supabase, which encrypts stored data at rest.
- Access: every request for your channel’s data checks that you are signed in and that the connection belongs to your account, and the tables that hold it enforce the same rule at the database level (row-level security). Access to production systems is limited to the people who operate Nichle, and only to run the service.
- Minimisation: we request read-only permissions only, keep reports for at most 30 days, and delete tokens and reports as soon as access is revoked. If we learn of a breach affecting your data, we will notify you and the authorities without undue delay, as the law requires.
- Payment details: your card number never reaches our servers; the payment provider takes the payment.
12. Children
Nichle is not intended for anyone under 18, and we do not knowingly collect their data.
13. Changes
We may update this policy; the current version is always here with its effective date. We will tell you about material changes. Questions: destek@nichle.com.