Privacy Policy
This policy explains how personal data is processed in the inMOLA Analytics service (the analytics.inmola.com panel and the measurement tag added to websites), in line with the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
1. Data controller
inMOLA Teknoloji Yazılım Hizmetleri A.Ş.
Sanayi Mah. Teknopark Bulvarı No:1/4C İç Kapı No:Z08, Pendik, İstanbul, Türkiye
Pendik Tax Office · Tax ID 4781247392 · MERSIS 0478124739200001
Contact: destek@inmola.com
2. Our two roles
- For panel users (people who create an account), inMOLA is the data controller.
- For visitors of websites where the tag is installed, the site owner is the data controller and inMOLA is the data processor acting on the site owner's behalf and instructions. The site owner is responsible for informing their visitors.
3. Data about panel users
| Data | Purpose | Retention |
|---|---|---|
| Name, email, organization, invitation code used, language preference | Account creation, sign-in, invitation check, notification and weekly report emails | Until the account is deleted |
| Password | Authentication. The password is never stored in plain text; only an irreversible hash (scrypt) is kept. | Until the account is deleted |
| Sign-in and admin action logs (time, action, IP address at sign-in) | Account security, abuse detection, legal obligations | 12 months |
Session cookie (ia_session) | Keeping you signed in. Strictly necessary; no advertising or tracking purpose. | Up to 14 days |
| Email verification and password reset links | Verifying the account, resetting the password | Valid 48 hours / 1 hour; single use |
Legal bases: performance of a contract (KVKK Art. 5/2-c), legal obligation (Art. 5/2-ç), legitimate interest — security and service improvement (Art. 5/2-f).
4. Data about website visitors (tag)
The tag uses no cookies and writes nothing to the visitor's device (no cookies, localStorage or sessionStorage).
- IP addresses and full browser strings (User-Agent) are not stored. They are used only at request time, hashed one-way (SHA-256) together with a random key for that day, to create a daily anonymous visitor ID. The key changes every day and is deleted within 2 days, so the same person cannot be linked across days.
- Processed information: the path of the visited page (query parameters are not stored, except
utm_source,utm_medium,utm_campaign), the referring site's domain, channel (e.g. search, social, AI assistant), country and city (derived from network location without storing the IP), device type, browser and operating system name, visible time on page, scroll depth, page speed metrics (LCP, CLS, INP), the target domain of outbound clicks, the name of downloaded files, the name/ID of submitted forms and custom events defined by the site owner. - Form contents, typed text, screenshots or mouse movements are not collected.
- Purpose: providing the site owner with aggregate visit statistics. This data is not used for advertising, profiling or sold to third parties.
- Retention: up to 3 months, then deleted automatically.
5. Google and Bing account connections (search queries)
If you want to use the “Search queries” section of the panel you can connect your Google account or your Bing Webmaster API key. Connecting is optional; the rest of the panel works without it.
- Google data accessed: the list of Google Search Console properties you have access to and the search performance of the property you select (search queries, pages, clicks, impressions, click-through rate, average position). Access is read-only (
https://www.googleapis.com/auth/webmasters.readonly). Your Google account email address is also received so we can show you which account is connected (openid,email). We cannot change anything in Search Console. - Use: this data is used only to show you your own search queries and pages in your panel and to place them next to your own website's visit statistics. inMOLA Analytics does not send Google data to any AI service. The data is not used for advertising, profiling or training AI models, is not sold and is not transferred to third parties; it is kept only with the hosting providers listed below, to deliver the service.
- Retention and deletion: the refresh token issued by Google is stored encrypted. Search Console data is cached for at most 6 hours for fast loading and then refreshed. When you disconnect in the panel or delete your account, the token is also revoked at Google and the cache is deleted. You can also revoke access at any time at myaccount.google.com/permissions.
- Limited Use: inMOLA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Bing: your Bing Webmaster API key is stored encrypted and used only to read search statistics for the site you select; it is deleted when you disconnect. Bing data is also cached for at most 6 hours.
- inMOLA Pulse: inMOLA Pulse (pulse.inmola.com), which uses the same Google app, reads Google Analytics (
analytics.readonly) and Search Console (webmasters.readonly) data read-only with the user's permission and uses it only for that user's reports in the Pulse panel; the cache is refreshed every 24 hours and the token is deleted when you disconnect. In Pulse, summaries derived from this data may be sent via API to an AI service provider (OpenAI) solely to prepare the recommendation text in the same user's report; the provider does not use this data to train models. The use and Limited Use principles above also apply to Pulse.
6. Transfers and service providers
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Collecting and storing tag data | Global network (abroad) |
| Hetzner Online GmbH | Panel server (account data) | Germany |
| Hostinger International Ltd. | Sending service emails | Abroad |
| Google LLC / Microsoft Corp. | Only if you connect them: reading Search Console / Bing Webmaster data from your own account | USA |
These providers process data only to deliver the service and under our instructions. Transfers abroad are made under the conditions and safeguards set out in Article 9 of KVKK. Data is never sold.
7. Your rights
Under Article 11 of KVKK you may learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the recipients, request correction, deletion or destruction, object, and claim compensation. Send requests to destek@inmola.com; we respond within 30 days.
If you are a visitor of a website, please contact that site's owner first; we will assist them with your request.
8. Changes
This policy may be updated; significant changes are announced in the panel or by email.