Privacy Policy

This policy explains how WebKoding Yazılım ve Teknoloji Çözümleri Ticaret Limited Şirketi ("WebKoding", "we"), Kastamonu Üniversitesi Teknokent, handles personal data in SpendByTeam. It is written with the EU GDPR and Türkiye's KVKK (Law No. 6698) in mind. For any privacy request, write to hello@spendbyteam.com.

Our role

For account, billing and website data, we decide how the data is used (controller). For the usage data your organization sends to the Service, your organization decides and we act on its instructions (processor). If you are a developer whose usage is reported, please contact your organization first.

What we never receive

We do not receive prompts, model responses, source code, file contents, file paths, tool inputs or shell commands. Our security page shows the exact data we receive and how we enforce this.

What we process

• Account data: name, e-mail address, password hash, two-factor settings, organization, role and team. If you sign in with Google, we receive your verified e-mail address and name.
• Usage data from your tools: developer e-mail or account identifier, session ID, model, cost, token counts, activity metrics, repository URL, branch name and ticket number. In anonymous mode, developer e-mails are stored as a keyed hash and the dashboard shows "Dev #4" instead of a name.
• Billing data: plan, number of active developers and subscription status. Paddle collects and handles your payment details; we do not see or store your card number.
• Technical data: IP address, browser details, request logs and an audit log of actions in the dashboard.

Why we process it

• To provide the Service and carry out our contract with your organization.
• To secure the Service, prevent abuse and investigate problems, which is our legitimate interest.
• To send service messages such as e-mail verification, invitations and budget alerts.
• To meet legal, tax and accounting obligations.

We do not sell personal data and we do not use it for advertising. The website sets no advertising or analytics cookies. The dashboard uses only the cookies needed for sign-in and security.

Who processes data for us

• Hetzner (Germany): servers, database and backups.
• Cloudflare: network security, content delivery and bot protection on sign-in forms (Turnstile).
• Paddle: checkout, payments, invoices and tax, as Merchant of Record.
• Our e-mail delivery provider: service e-mails.
• Google: only if you choose Google sign-in.
• Anthropic: only if your organization connects its provider key to compare costs. In that case we call its usage and cost endpoints on your behalf.

The Service stores its data in the EU. Some of these providers may process data in other countries. Where the law requires it, such transfers rely on the safeguards it provides for.

How long we keep it

• Usage data: 13 months by default, configurable for each organization. Minute-level raw data is kept for up to 30 days.
• Deleted organizations: data is permanently deleted after a 7-day grace period.
• Backups: encrypted backups are kept for about 4 weeks, so deleted data can remain in them until they expire.
• Billing and tax records: for as long as the law requires.

Your rights

Depending on where you live, you can ask to access, correct, delete, restrict or receive a copy of your personal data, and object to its processing. Under KVKK you can also ask whether your data is processed and who it has been shared with. You can complain to your data protection authority, which in Türkiye is the Personal Data Protection Authority (KVKK). We reply within the period the law requires.

Security

We separate each organization's data at database level, store ingest tokens only as hashes, encrypt backups and offer two-factor authentication. See our security page.

Changes

If we make a material change to this policy, we will tell you by e-mail or in the dashboard.