This Privacy Policy explains how RecRam collects, uses, shares and protects personal data when you visit our website, create an account, buy a subscription or contact us, and what rights you have. It also explains our role when you answer a form that one of our customers sent you.
1. Who We Are and Our Role
RecRam as controller
For the personal data described in this policy (account, billing, support, security, website and marketing data), the controller (veri sorumlusu) is RECRAM YAZILIM A.Ş., Muallimköy Mh, Bilişim Vadisi, Deniz Cd. No:143/8-1, 41400 Gebze/Kocaeli, Turkey. Its affiliate RECRAM INC, 112 Capitol Trail Suite A1127, Newark, Delaware 19711, United States, helps support and operate the Services on its behalf, as a processor.
Privacy contact: gdpr@recram.com.
If you answered a form, recorder or chat (respondents)
When you answer a form, recording request, AI Chat form or Magnet created by one of our customers, that organization is the controller of your answers and recordings. RecRam processes them only on its behalf, as a processor, under our Data Processing Agreement. The organization decides what it asks, whether AI features are used, who sees your answers and how long they are kept. Please read its privacy notice and send requests about your answers (for example access, correction or deletion) to that organization. If you cannot reach it, write to gdpr@recram.com and we will pass your request on and help it respond.
Section 7 explains how RecRam’s AI features work on answers. In short: AI works on the content of answers (for example transcripts, summaries, translations and captions); it never evaluates or makes decisions about you.
2. Personal Data We Collect
- Account data: name, email address, phone number if you provide it, password (stored as a one-way hash), profile photo, job title, company and organization name, team memberships and permissions, language and notification preferences. If you sign in with Google, we receive your name, email address and profile photo from Google.
- Billing data: plan, billing country, billing contact and transaction records (amounts, dates, invoice references, subscription status). Payment is handled by Paddle, our Merchant of Record; we never receive your full card details.
- Support and communications: the content of messages, support requests, attachments and screen recordings you send us, and our replies.
- Security and log data: IP address, device and browser information, sign-in events, two-factor authentication events, and records of actions in your account (such as who changed a setting).
- Usage data: how you use the Services (for example features used and forms created), collected to operate and improve the Services.
- Website data: pages visited, referring website, campaign parameters, approximate location and device information, collected through cookies and similar technologies as described in our Cookie Policy.
- Marketing data: your email address, your subscription status for our newsletter and product emails, and records of your consent or opt-out.
- Integration data: when you connect a third-party service (such as Google, HubSpot, Salesforce or Zendesk), the identifiers and encrypted access tokens needed to keep the connection working.
Customer Content (forms, answers, recordings, files and AI output in your workspace) is processed by us as a processor on your behalf, under the Data Processing Agreement, and not for our own purposes. We do not use Customer Content to train AI models.
3. Why We Use Your Data and Our Legal Bases
We rely on the following legal bases under Article 6 GDPR (and the UK GDPR), and on the corresponding grounds in Article 5 of the Turkish Law on the Protection of Personal Data No. 6698 (“KVKK”):
| Purpose | Data | Legal basis (GDPR / KVKK) |
|---|---|---|
| Creating and running your account, providing the Services, service emails (for example new-response notifications and security alerts) | Account, usage, integration data | Performance of a contract (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK) |
| Subscriptions, billing and plan limits (with Paddle) | Account and billing data | Performance of a contract; legal obligation for tax and accounting records (Art. 6(1)(b) and (c) GDPR; Art. 5(2)(c) and (ç) KVKK) |
| Customer support | Support and account data | Performance of a contract; legitimate interest in resolving requests (Art. 6(1)(b) and (f) GDPR; Art. 5(2)(c) and (f) KVKK) |
| Security, fraud and abuse prevention, enforcing our Terms and Acceptable Use Policy | Security and log data, account data | Legitimate interest in protecting our users and Services; legal obligation where applicable (Art. 6(1)(f) and (c) GDPR; Art. 5(2)(f) and (ç) KVKK) |
| Improving the Services (for example understanding which features are used) | Usage data, aggregated or de-identified where possible | Legitimate interest in improving our product (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK) |
| Website analytics and advertising measurement | Website data | Consent where required by law, for example in the EEA, UK and Switzerland (Art. 6(1)(a) GDPR; explicit consent under Art. 5(1) KVKK); otherwise legitimate interest |
| Newsletter and product marketing emails | Marketing data | Consent, or for existing customers our legitimate interest in telling you about similar services where the law allows it; you can opt out at any time (Art. 6(1)(a) or (f) GDPR; Art. 5(1) KVKK and the Turkish e-commerce rules) |
| Complying with law and responding to lawful requests; establishing, exercising or defending legal claims | Any relevant data | Legal obligation; legitimate interest (Art. 6(1)(c) and (f) GDPR; Art. 5(2)(ç) and (e) KVKK) |
Where we rely on legitimate interests, you can object at any time (see Section 10). Where we rely on consent, you can withdraw it at any time without affecting processing before withdrawal.
4. Google API Services: User Data Policy
RecRam offers optional integrations with Google services. When you connect your Google account, we access certain Google user data as described below.
RecRam’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data accessed from Google
- Email address (userinfo.email): to identify which Google account is connected to RecRam.
- Google Sheets and Drive (drive.file): to create a spreadsheet for your form responses, or to write to a spreadsheet you pick in Google’s file picker, and to export form response data (answers, transcripts and other AI output) to it. This permission covers only files that RecRam creates or that you pick; we cannot see or open any other file in your Drive.
- Google Calendar (calendar.readonly and calendar.events): to list your calendars so you can choose one, and to create and manage calendar events for follow-ups you set up based on form responses (for example scheduling an interview).
How we use Google user data
- Exporting form responses: answers, transcripts, summaries and contact information are written to the Google Sheets spreadsheet you select.
- Scheduling events: when you enable the Calendar integration, RecRam creates or updates events based on the triggers you configure.
- Account identification: your Google email address is used to show which account is connected and to manage the connection.
What we do not do with Google user data
- We do not sell, rent or share your Google user data with third parties.
- We do not use Google user data for advertising, marketing profiling or any purpose unrelated to the integrations described above.
- We do not use Google user data to train AI or machine learning models.
- We do not allow humans to read your Google user data unless you explicitly ask for technical support, or where required by law.
- We do not store copies of your Google Sheets content or Calendar events on our servers, apart from the identifiers needed to keep writing to the spreadsheet or event you chose. Data flows directly between RecRam and Google’s APIs.
Token storage and revoking access
OAuth tokens are stored encrypted and associated with your organization. You can revoke access at any time by disconnecting Google in your RecRam settings or in your Google Account permissions. When you disconnect, the stored tokens are deleted.
5. Who We Share Data With
We do not sell your personal data for money. We share personal data only with:
- Service providers (processors) that host and run the Services for us, under contracts that limit their use of the data: application and infrastructure hosting (netcup GmbH and Contabo GmbH, both in Germany), file storage, content delivery and transactional email (Cloudflare), storage of some older files (Amazon Web Services, in Germany), database hosting (MongoDB Atlas, in Frankfurt, Germany), cloud and AI services (Google), and marketing and account email (Emailit, in the EU). The providers that may process Customer Content are listed in Annex III of our Data Processing Agreement.
- Paddle.com Market Limited, our reseller and Merchant of Record, which handles checkout, payment, taxes, invoices and refunds as an independent controller under its own privacy notice.
- Analytics and advertising providers on our website (such as Google, Meta, Microsoft Clarity and Yandex), as described in our Cookie Policy and subject to your cookie choices.
- Our affiliate RECRAM INC (United States), which supports and operates the Services on our behalf.
- Services you connect, such as Zapier, Make, n8n, Google Sheets, Slack, HubSpot, Salesforce or Zendesk, when you enable an integration.
- Authorities, courts and advisers where required by law, to enforce our terms, or to protect rights, property or safety; and a buyer or successor in a merger, acquisition or sale of assets, subject to this policy.
6. International Transfers
RecRam is established in Turkey and its affiliate in the United States, our application servers and database are in Germany, and some of our providers (including our AI provider and our file storage and delivery network, Cloudflare, whose storage is not limited to the EU) process data in the United States and other countries. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses (with the UK Addendum or Swiss adaptations where relevant) or rely on a provider’s certification under the EU-U.S. Data Privacy Framework, together with additional safeguards such as encryption. Transfers from Turkey are made under Article 9 KVKK, using the standard contracts published by the Personal Data Protection Board where required. You can ask for more information at gdpr@recram.com.
7. How We Use AI
- RecRam’s AI features transcribe spoken answers, create captions, translate, summarize, extract topics and keywords, indicate the tone of the text of an answer, describe what is shown in images and recordings (not the people in them), pick out details a team asks for, and in AI Chat forms ask follow-up questions. They use Google’s AI services and may be processed in the United States.
- They never evaluate, score, rank, screen or classify people, never make decisions about people, and never infer emotions, personality, honesty, suitability or demographic or special-category traits. They do not perform emotion recognition, facial recognition or biometric identification, and do not alter anyone’s likeness or voice.
- The organization that sent the form decides whether AI runs on your answers: AI processing can be turned off for each video form and each recorder, and where it is on, the form shows you a notice about it. AI Chat forms always use AI and tell you that you are chatting with AI and that decisions are made by people.
- We do not carry out decision-making based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Decisions about respondents are made by the organization that sent the form, by people.
- Customer Content is not used to train AI models: we do not use it for training, and under Google’s paid cloud and API terms, Google does not either.
- Our team may use AI tools from the same provider to help summarize and route support requests. People at RecRam read and answer every request.
- If you use voice typing in a form, your browser’s built-in speech recognition may send your audio to the browser vendor (for example Google in Chrome or Apple in Safari) under that vendor’s terms. This is a browser feature, not a RecRam service.
More detail: How RecRam uses AI.
8. How Long We Keep Data
This table is the single reference for our retention periods. Where a period ends, we delete or irreversibly anonymize the data.
| Data | Retention period |
|---|---|
| Account data | For as long as the account exists. After the account is deleted or closed, deleted within 90 days, except a minimal deletion record (account identifier, deletion date, plan, payment provider references and a one-way hash of the email address) kept to establish, exercise or defend legal claims, billing records (see below) and, if you unsubscribed, the suppression entry described below. |
| Customer Content (forms, answers, recordings, files, AI output) | Controlled by the customer, who can delete it at any time. Deleted items are permanently erased 30 days after deletion, together with their AI output and stored files. After the account is deleted or closed: deleted from active systems within 90 days. Database backups are overwritten on our database provider’s rolling schedule, and deleted data is not restored to production. When a trial ends or a paid subscription is cancelled or expires, the account is locked but the data is kept, so the customer can subscribe again or ask us for a copy, until the account is deleted; we may close an account that has had no subscription and no sign-in for 12 months, after 30 days’ notice. |
| Billing and transaction records | 10 years after the end of the financial year of the transaction, as required by tax and commercial record-keeping laws. Paddle keeps its own records as Merchant of Record. |
| Support communications | 3 years after the request is closed. |
| Security logs (sign-ins, administrative access, audit records) | Up to 12 months. |
| Application and server logs | Up to 30 days. |
| Integration tokens | Until you disconnect the integration or delete your account. Access you grant to a connected app (for example an automation tool or AI assistant) lasts until you revoke it, and expires after 90 days without use. |
| Marketing preferences and consent records | Until you unsubscribe or withdraw consent, then a record of the consent and opt-out for 3 years as proof. Unsubscribed addresses are kept on a suppression list so that we do not email you again. |
| Website cookies and analytics | As listed in our Cookie Policy. |
We may keep data longer only where the law requires it or where it is needed for an ongoing legal claim, and only for that purpose.
9. Security
We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access control with least privilege, multi-factor authentication for our internal administration panel, logging and monitoring with personal data masked in application logs and operational alerts, refresh tokens of connected apps stored only as one-way hashes and expiring after 90 days without use, backups, vulnerability management, staff confidentiality obligations, and incident response procedures. You can protect your account by using a strong password and enabling two-factor authentication. No system is completely secure; if we become aware of a breach that affects you, we will notify you and the authorities as the law requires.
10. Your Rights
EEA, UK and Switzerland
You have the right to access your personal data; to rectification; to erasure; to restriction of processing; to data portability; to object to processing based on legitimate interests and, at any time, to direct marketing; to withdraw consent; and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We respond within one month, which may be extended by two further months for complex requests.
Turkey (KVKK Article 11)
You have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under Article 7 KVKK; to request that third parties to whom the data was transferred be notified of such correction or deletion; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation for damage arising from unlawful processing. We respond within 30 days, free of charge unless the request requires additional cost as permitted by the Board’s tariff.
United States
Depending on your state of residence (for example California, Virginia, Colorado, Connecticut, Utah or Texas), you may have the right to know and access the personal information we collect, use and disclose; to correct it; to delete it; to receive a portable copy; and to opt out of the sale of personal information, of “sharing” for cross-context behavioral advertising and of targeted advertising. We will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our decision; if the appeal is denied, you may contact your state attorney general. You may use an authorized agent, and we may ask you to verify your identity and the agent’s authority. We respond within 45 days, which may be extended as the law permits.
Sale and sharing. We do not sell personal information for money, and we do not sell or share Customer Content or respondents’ data. On our marketing website we use advertising cookies and pixels to measure and improve our ads, which some US state laws may treat as “sharing” or “targeted advertising”. You can opt out by declining advertising cookies in our cookie settings. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out for that browser, wherever you are; see Your privacy choices. We do not use sensitive personal information to infer characteristics about you. We do not knowingly sell or share the personal information of consumers under 16.
How to exercise your rights
Email gdpr@recram.com from the address linked to your account. You can also view and correct your profile in your account settings, and export or delete responses in the app while your subscription or trial is active. To delete your account, or to receive a copy of your account data (account, team, organizations and form details) at any time, email us; our team handles these requests. Requests under KVKK can also be sent in writing to RECRAM YAZILIM A.Ş. at the address in Section 1 or by registered email (KEP), in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. If you are a respondent, please contact the organization that sent you the form first (see Section 1).
Complaints
You can lodge a complaint with the data protection supervisory authority where you live, work or where an alleged infringement took place (in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner). In Turkey, after applying to us, you may complain to the Personal Data Protection Board (KVKK Kurulu) within the periods set out in Article 14 KVKK. We would appreciate the chance to address your concern first at gdpr@recram.com.
11. Cookies
We use cookies and similar technologies as described in our Cookie Policy. You can change your choices at any time in the cookie settings on our website or in your browser.
12. Children
RecRam is not directed to children under 16, and we do not knowingly collect their personal data for our own purposes. Customers must not use RecRam to collect personal data from children without the parental consent required by law. If you believe a child has given us personal data, contact gdpr@recram.com and we will delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the new version here with a new “Last updated” date, and for material changes we will notify account owners by email or in the product at least 30 days in advance where practicable.
14. Contact
Privacy and data protection: gdpr@recram.com
General inquiries: info@recram.com
Technical support: support@recram.com
RECRAM YAZILIM A.Ş., Muallimköy Mh, Bilişim Vadisi, Deniz Cd. No:143/8-1, 41400 Gebze/Kocaeli, Turkey
Affiliate: RECRAM INC, 112 Capitol Trail Suite A1127, Newark, Delaware 19711, United States