Privacy Policy

• Data we receive from your Google Business Profile and from your Google account connection is never sold and is not used for advertising.
• With your permission, we use the contact details you give us and information about your visits to our website for marketing and advertising; you can withdraw your permission at any time.
• The authorization you give for your Google account is stored encrypted, and you can revoke it at any time.
• Content prepared by AI is published on Google with the automatic publishing permission you give at sign-up or with your approval; you can withdraw that permission at any time under Settings › Automation permissions (Ayarlar › Otomasyon onayları).
• Your card details never reach us: you enter them on Stripe's own payment page.
• BadePlus is operated by a company organized in the USA, which is the controller of your data and the seller of every paid plan, one-time service and map usage service.
• Besides essential cookies, analytics and advertising cookies are used only if you consent to them.
• The business websites we host for our customers set no cookies and have no analytics tools or forms (Google loads the map under its own rules); see Visitors to business websites for details.
• You can download your data from the panel and delete your account; your account is deleted automatically 7 days after your deletion request (Account and Data Deletion).

In this policy "BadePlus", "we" and "us" mean the company that operates BadePlus, a limited liability company organized in the State of New Mexico, USA, which is the data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). Its details are shown at the top of this page.

If you are in the European Union, the European Economic Area or the United Kingdom, Your rights under the GDPR also applies to you.

Your personal data is processed by BadePlus as the data controller, as described in this policy.

• Data controller: Velden LLC
• Address of the data controller: 1209 Mountain Road Pl NE Ste N, Albuquerque, NM 87110, USA

You can send your applications about your personal data to us (see How to use your rights).

BadePlus is also the seller of every paid plan, one-time service and map usage service; for payments on the payment page, for service orders and for card payments for the map usage service, the payment service is provided by Stripe, Inc. (USA). The card and billing details you enter on Stripe's payment page go directly to Stripe, which processes them for BadePlus and for its own purposes, such as fraud prevention, under the Stripe Privacy Notice.

Customer reviews in the business profiles you connect, and in the profiles for which you order a one-time service such as reputation management, contain the personal data of the people who wrote them. For this data the business that owns the profile is the controller; we process it on the business's behalf, as a processor, to provide the Service or to perform the service ordered.

This policy applies to people who visit our website or the business websites we host for our customers, fill in our forms, use the BadePlus panel, are invited to a workspace as team members, contact us, buy a paid plan, order a one-time service on our website (including people who order without an account) or use the map usage service from BadePlus.

Account details. Your name, email address, password (stored only in a non-reversible hashed form), profile photo and two-step verification setting.

Sign-up purpose and requests. What you will use BadePlus for (managing your own map listing, using the map usage service or getting a Google Business Profile set up), as you state it when you sign up or in the first step of setup. If you choose the map usage service or map setup, this is a request: your phone number, so that we can call you about your request (required), the note you add to it (optional; for example, the sector and area in which you are looking for a map), the status of the request and our team's notes about it are also recorded. This data is kept until your account is deleted and is deleted with your account.

Google connection. When you sign in with Google or connect your Google account: the name, email address and profile photo of your Google account, and the authorization you give us to manage your business profiles.

Business data. Information in the profiles you connect (name, address, phone number, opening hours, category, photos), customer reviews and replies, posts and performance metrics provided by Google. Customer reviews include the reviewer's name and profile photo as shown on Google, and may contain special categories of personal data, such as health information; such data is processed only to provide the Service to the business (preparing replies, reporting reviews by topic and sentiment, preparing profile suggestions, filing removal requests with Google for reviews that appear to break Google's rules) and is not used for any other purpose.

Content you create. Reply drafts, posts, images you upload, reply rules, keywords and reports.

Contact details and requests. The name, phone number, email address and business information you share in the contact, callback and free analysis forms; your support requests and live chat conversations.

Usage and security data. IP address, browser and device information, session information, a log of changes made in the panel and logs of errors that occur on our pages (page address, browser information and error message).

Mobile app data. If you use BadePlus through the iPhone or Android app, so that we can send you notifications: your device's notification token (if you allowed notifications) and the app version. Each time it connects to the panel, the app sends the app version and whether it is an iPhone or an Android device together with the browser information. The notification token is deleted when you sign out of the app or when your account is deleted; the token of a device not seen for 90 days is also deleted automatically. When you unlock with Face ID or a fingerprint, your biometric data stays on your device and never reaches us; when you upload a photo in the app, only the photo you select is sent.

Notification preferences and delivery records. Which push notifications you want to receive, your quiet hours, whether you keep announcements on and your promotional notification permission; whether the notifications sent to you were delivered to your phone; and, for announcements and campaigns, whether one was sent to you or why it was not (these delivery records are kept for 1 year).

Visit and advertising data. If you consent to analytics and advertising cookies: the pages you visit on our website, the ad or link that brought you to the site, actions you take on the site (sign-up, form submission, purchase) and online identifiers of your device.

Service orders. When you order a one-time service on our website (for example, setting up or optimizing a business profile on Google Maps): the name, email address and phone number you give; the details of the businesses you order for (name, city, district, address, type of business, phone number, website, Google Maps link and the note you write); the records of the order, the payment and any refund; and the approvals you give when ordering. You do not need an account to order; an order placed while you are signed in is linked to your account. If we give you a custom price (a reference code), we also process the name, email address, phone number and business name you give us for the offer; for reputation management, we process the reviews you want removal requests for and the information and documents you give for a legal removal request.

Map usage service. When you use the map usage service from BadePlus (a Google business profile managed by BadePlus is used for your business): the map you use, the monthly service fee, the currency, the payment type, the start and period dates, the records of service fee payments and any refunds, your acceptance of the service terms and the contact details you want used on the profile (for example, a phone number and website).

Subscription and billing data. Your plan, subscription status, payment type (one-time payment or auto-renewing subscription), payment and refund records, and the billing details you give on Stripe's payment page: your name or company name, billing address, phone number and, if you give it, your tax number. We also keep your card brand and last four digits and the customer, payment and (for a subscription) subscription identifiers at Stripe. The full card number never reaches us.

Consent records. The approvals and preferences you give (acceptance of terms, form and payment approvals, cookie preference, automatic publishing permission, AI permission, promotional notification permission, marketing permissions and opt-outs), with the date, IP address, browser information and the version of the approved text.

We collect personal data electronically, in these ways:

• through the sign-up, contact, callback and free analysis forms and the fields you fill in in the panel,
• from Google, within the authorization you give when you connect your Google account,
• through the details you give on Stripe's payment page, which Stripe sends us, and through Stripe's payment and subscription notifications,
• through the one-time service order form on our website (you can order without an account) and our correspondence with you about a custom-price offer,
• through the map usage service we start for you, the Maps I use page in your panel and our correspondence with you about the service,
• through support requests, live chat and email correspondence,
• automatically, through cookies (analytics and advertising cookies only with your consent) and server logs, when you use our website and the panel,
• automatically, through the app, when you use the BadePlus iPhone and Android apps (notification token, app version),
• automatically, through server logs only, when you visit a business website we host (these sites set no cookies).

The legal bases under the GDPR are set out in Your rights under the GDPR.

Data we receive from Google (the content of your business profile and the information that comes with your Google account connection) is not processed for marketing or advertising.

You can withdraw a consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

When you connect your Google account, you are asked for permission to manage your business profiles. Data we receive with this permission:

• is used only for the features the Platform provides to you,
• is never sold, is not used for advertising and is not used to train our own AI models,
• is shared with the service providers listed below only as far as the Service requires.

BadePlus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke the permission at any time from the Accounts page (Hesaplar) in the panel or from your Google account permissions page. When you remove it in the panel, the encrypted key is deleted from our database and the authorization is also revoked at Google. If the same Google account is still connected in another workspace, the authorization at Google is kept so that workspace keeps working; to remove it completely, remove the account from every workspace or use your Google account permissions page.

To prepare a review reply, the review text, its rating, the reviewer's name as shown on Google (unless the review is anonymous) and your business's reply tone settings are sent to an AI provider. To summarize reviews by topic and sentiment, the review text and rating are used; to suggest a description or missing attributes for your profile, your business information and the text and rating of recent reviews (without the reviewers' names) are used. To prepare posts and images, your business information and the post topic are used.

To draft our reply to a message you send through the contact form or the panel, the subject and text of your message and the first word of your name may be sent to an AI provider; your email address and phone number are not sent. Our team reads and edits the draft before it is sent to you.

The provider used (Google Gemini, OpenAI or Anthropic; for images OpenRouter, with Wiro as a fallback) depends on your plan. These providers process the data under their own business API terms. We do not train AI models with your data.

If you do not want your data to be processed with AI, as the owner or an admin of your workspace you can refuse this, or withdraw a permission you have given, at any time in the panel under Settings › AI permission (Ayarlar › Yapay zekâ izni); your data is then not sent to AI providers for the work described above.

We advertise BadePlus, and for this we use some personal data on the basis of your consent:

• Cookies: if you choose "Accept all" (Tümünü kabul et), analytics and advertising cookies measure your visit to our website, and advertising platforms may show you BadePlus ads on other websites and apps (retargeting). See Cookies below.
• Your contact details: if you give marketing permission in one of our forms, the contact detail you allowed (for example, the phone number you share in the free analysis form) is used to send you campaign messages and to show you BadePlus ads on advertising platforms. For this, the detail is transferred to the advertising platform and matched with the platform's own users.
• In-app promotional notifications: promotional and campaign notifications in the panel and the mobile app (notification bell, phone notification, panel banner) are sent only if you turned on the "Promotional notifications" permission under Settings › Notifications (Ayarlar › Bildirimler). The permission is off by default; when you turn it on, the sentence you approved is recorded with the date and your IP address. Which campaigns are relevant to you is chosen based on your account and usage information (such as plan, number of businesses, language and the app you use). This permission does not cover email, SMS or phone calls.
• Data from Google is excluded: data we receive from your business profile and your Google account connection is not used for marketing or advertising.

The marketing permission is described in Marketing Consent.

You can withdraw your cookie consent at any time in the preference box on the Cookie Policy page, your message and advertising permission with the opt-out method in our messages or by writing to us, and your promotional notification permission under Settings › Notifications. Once you withdraw it, your data is no longer used for these purposes.

• Email for withdrawing a permission: kvkk@badeplus.com

When you buy a paid plan on the payment page, you pay through Stripe and choose the payment type: a one-time payment, which does not renew when the chosen duration ends, or an auto-renewing subscription, which renews every period until you cancel it. When US dollars are offered, you also choose the currency (Turkish lira or US dollars). BadePlus provides the Service and is the seller.

You are taken to Stripe's own page, where you enter your card details, name, billing address, phone number and, if you wish, your tax number. In a one-time payment your card is used only for that payment and is not saved for later payments; in an auto-renewing subscription it is saved at Stripe for the renewals. We take the payment and issue the invoice or receipt; the payment service is provided by Stripe, Inc. (USA).

For payments through Stripe we send Stripe your email address, your workspace's name and identifier and the plan, period and currency you choose and the language of the payment page, to be used in BadePlus's Stripe account. Stripe sends us the status of your payments and (for a subscription) of your subscription, the payment identifier and the address of the receipt or invoice page, your card brand and last four digits and the billing details you entered on its payment page.

The full card number and security code never reach us. If BadePlus turns on Stripe Tax for US dollar payments, the address you give on Stripe's payment page is also processed by Stripe to calculate the tax, and the tax amount calculated by Stripe is recorded with your payment.

Records of payments made through PayTR until 18 October 2026 (including the billing details and, for an individual invoice, the Turkish ID number) are kept for the statutory retention period; no data is sent to PayTR any more.

When you order a one-time service on our website, you also pay through Stripe, by card, as a one-time payment; BadePlus is the seller and your card is not saved for later payments. We send Stripe your email address and the order identifier (for a custom-price order, also the offer identifier and the reference code), the name of the service, the number of businesses and the amount; the business details you give in the order form and your phone number are not sent to Stripe. Stripe sends us the status and identifier of the payment.

When you use the map usage service from BadePlus and pay by card, you pay on Stripe's payment page and BadePlus is the seller. For monthly automatic payment your card is saved at Stripe for the renewals; for an advance payment for a period it is not saved for later payments. We send Stripe your email address, the service's identifier, the amount and the currency. If you pay the service fee by bank transfer or in person, nothing is sent to Stripe.

Agreed payments outside the payment page. If you pay by written agreement with us outside the payment page, for example by bank transfer (havale or EFT), no card details are processed and nothing is sent to Stripe. The seller is BadePlus. We record the payment method, date, amount and currency, the bank receipt or transaction reference number and the plan, number of businesses and duration it pays for. We also process the billing details you give us in writing to issue the invoice, the sender details (such as the name and account number) passed on by the banks in our bank records, and, if a refund is due, the bank account you tell us. This data is processed to verify and record the payment and activate your plan (performance of the contract), to issue the invoice or receipt and keep commercial and tax records (legal obligation) and to protect our rights in disputes and refunds, and is kept for the periods for subscription, payment and invoice records.

The Payment and Subscription Information Annex (Turkish: Ödeme ve Abonelik Aydınlatma Eki) describes the processing of payment data in full.

We share personal data only for the purposes above, as far as the Service requires, and for the marketing purposes you consented to:

Replies, posts and profile changes made on your instruction or with your automatic publishing permission are sent to Google and published publicly there.

As BadePlus is organized in the USA, your personal data is processed in the USA by BadePlus. Part of our Service also runs on providers whose servers are abroad. Your personal data is therefore transferred to the following recipients:

The providers of the advertising and analytics services we use with your consent may also be abroad. Phone verification SMS may also be sent within Turkey through Netgsm.

Transfers abroad are made under Article 9 of the KVKK. If the Personal Data Protection Board has issued an adequacy decision for the destination country, the transfer relies on that decision. For countries without an adequacy decision, we rely on the appropriate safeguards provided by the KVKK, first of all the standard contracts announced by the Board. Standard contracts are notified to the Personal Data Protection Authority within five business days of signature. A transfer without an adequacy decision or appropriate safeguard may only be made occasionally and in one of the cases listed in Article 9(6) of the KVKK, for example where it is necessary to perform our contract with you. We send providers only the data the task requires.

For transfers outside the European Union and the United Kingdom, see Your rights under the GDPR.

We keep personal data for as long as the purpose of processing requires and for the periods set by law:

For payments through Stripe, the customer, payment and invoice records at Stripe are kept under BadePlus's and Stripe's responsibility for the periods set by the law they are subject to. In an auto-renewing subscription your card is saved at Stripe, linked to your customer record in BadePlus's Stripe account; a saved card is not deleted automatically when the subscription ends, but nothing is charged to it unless you start a new subscription, and you can ask for it to be deleted. When your account is deleted, an auto-renewing subscription you still have is cancelled, and your customer record and saved card are also deleted from Stripe; invoices, receipts and payment records remain at Stripe.

When you ask for your account to be deleted, it is deleted automatically 7 days after your request; what is deleted and what is kept is described in Account and Data Deletion.

Data whose retention period has expired is deleted, destroyed or anonymized periodically. If there is a dispute or an official request, only the records concerned may be kept for as long as it lasts.

• The authorization keys we use to access your Google account are stored encrypted in the database.
• Your card number and security code never reach our servers; you enter your card on Stripe's own payment page.
• The connection between your browser and us is encrypted (HTTPS).
• Each workspace's data is kept separate from the others; users see only the workspaces they are members of.
• You can add a layer of protection to your account with two-step verification.
• Sign-in and forms are limited against repeated requests.
• Important changes made in the panel are logged.
• Access to data is limited to the people who need it.

Under Article 11 of the KVKK, by applying to us, you have the right to:

• learn whether your personal data is processed,
• request information about the processing if it has been processed,
• learn the purpose of the processing and whether the data is used in line with that purpose,
• know the third parties in Turkey or abroad to whom the data is transferred,
• ask for incomplete or inaccurate data to be corrected,
• ask for the data to be deleted or destroyed under the conditions in Article 7 of the KVKK,
• ask for the correction, deletion or destruction to be notified to the third parties to whom the data was transferred,
• object to a result against you that arises from the analysis of your data exclusively by automated systems,
• claim compensation for damage caused by unlawful processing.

In the panel you can also download your data and delete your account under Settings → My data (Ayarlar → Verilerim; the account is deleted automatically 7 days after your request, see Account and Data Deletion), withdraw the automatic publishing permission under Settings › Automation permissions (Ayarlar › Otomasyon onayları), revoke Google access from the Accounts page (Hesaplar) or your Google account settings, change your cookie preference on the Cookie Policy page, and change your push notifications, quiet hours, announcements and promotional notification permission under Settings › Notifications (Ayarlar › Bildirimler). Mandatory service notices, such as changes to the agreement, security and planned outages, are delivered in the notification bell and by email regardless of these preferences. If you are in the European Union, the European Economic Area or the United Kingdom, Your rights under the GDPR also applies.

You can send your application under the KVKK to BadePlus. You can use the contact form on our website or the support form in the panel by choosing the "KVKK başvurusu" (data protection request) topic; we may ask for additional information to verify your identity. The other channels are listed below.

• By email, from the email address registered in our system: kvkk@badeplus.com
• By a signed letter sent by post to BadePlus: 1209 Mountain Road Pl NE Ste N, Albuquerque, NM 87110, USA

For applications under the KVKK, the Communiqué on the Procedures and Principles of Application to the Data Controller requires the application to be in Turkish and to include your name and surname, your Turkish ID number (for foreigners, your nationality and passport or identity number), your address for notifications, your email address or phone number for notifications if you have one, and the subject of your request.

We conclude your application free of charge as soon as possible, depending on its nature, and within 30 days at the latest. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find our answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application.

If you are in the European Union, the European Economic Area or the United Kingdom, your personal data is also protected under the General Data Protection Regulation (GDPR) or its United Kingdom equivalent (UK GDPR). Under these rules too, BadePlus is the data controller.

We process your data on these legal bases:

• performance of a contract (GDPR Article 6(1)(b)), to open your account, provide the Service and manage your payments and subscription,
• compliance with a legal obligation (Article 6(1)(c)), to keep invoice, tax and commercial records; where the obligation arises from law outside the European Union or the United Kingdom, our legitimate interests (Article 6(1)(f)),
• our legitimate interests (Article 6(1)(f)), to keep the Platform secure, prevent abuse and protect our rights,
• your consent (Article 6(1)(a)), for analytics and advertising cookies, marketing messages and matching on advertising platforms.

You have the right to:

• access your data and receive a copy of it,
• ask for inaccurate or incomplete data to be corrected,
• ask for your data to be erased or for its processing to be restricted,
• receive the data you gave us in a structured, commonly used format and ask for it to be transmitted to another service (data portability),
• object to processing based on legitimate interests, and object at any time to direct marketing,
• withdraw your consent at any time; the withdrawal does not affect the lawfulness of processing before it.

To download your data and ask for your account to be deleted, use Settings → My data (Ayarlar → Verilerim) in the panel; send your other requests to us by email. We answer requests within one month at the latest; where the complexity or number of requests requires it, this period may be extended by two further months, and we will let you know.

• Email for your requests: kvkk@badeplus.com

If you believe that the processing of your data breaches the law, you can lodge a complaint with the data protection supervisory authority in the country where you live or work or where you believe the infringement took place; in the United Kingdom this authority is the Information Commissioner's Office (ICO).

Your data is processed in the USA and in the other countries where our service providers are located (see Transfers abroad). Transfers outside the European Union and the United Kingdom rely on the grounds the GDPR provides: an adequacy decision, appropriate safeguards such as the European Commission's standard contractual clauses, or transfers that are necessary to perform our contract with you.

We use cookies and similar browser storage (localStorage and sessionStorage). In short:

• Essential cookies keep you signed in, keep forms secure and remember the workspace you selected and the choices you make during sign-up. They cannot be turned off.
• Preference storage remembers settings such as your theme and the locations you visited recently; it stays on your device.
• Third-party services: the live chat window (Crisp) is loaded on our website only if you choose "Accept all" (Tümünü kabul et), and in the panel as part of the support service; Cloudflare Turnstile checks forms for bots; Stripe's payment pages and your bank's 3D Secure page use their own cookies; Google Maps is shown in the rank tracking map in the panel.
• Analytics and advertising cookies (today Google Analytics and Google Tag Manager) are used on our website and in the panel only if you choose "Accept all" (Tümünü kabul et), and never on the payment page.

If the scope of "Accept all" is extended, your earlier acceptance no longer counts and we ask you again. We record your cookie preference with the date, IP address, browser information and your device's random consent identifier so that we can prove it; this record is deleted automatically after 2 years. The controller of the personal data processed through cookies is BadePlus. The full list of cookies and the box for changing your preference are in the Cookie Policy.

The Platform is not designed for people under 18, and we do not knowingly collect personal data from people under 18. If you notice that we have, write to us and we will delete the data.

We may update this policy to reflect changes in the law and in our Service. The current text is published on this page with its effective date, and we announce important changes by email or panel notification. A change to this text does not by itself mean new explicit consent; if new processing that requires your explicit consent is introduced, we will ask for your consent separately.

BadePlus hosts one-page websites for businesses that are our customers ("business websites"). The business information on these sites (name, address, phone, opening hours, services and photos) is approved by the owner of the business and belongs to the business. When you visit a business website:

• No cookies or measurement: the site sets no cookies and has no analytics, advertising or measurement tools and no contact form.
• Server logs: to deliver the site to you and protect it against abuse, technical information such as your IP address, browser and device information, the page you request and the time of the request is processed in our server logs. As the traffic of these sites is carried through Cloudflare, this information is also processed by Cloudflare. These logs are kept to operate and secure the site and are not kept longer than the period stated for security logs under How long we keep your data.
• Map: if the site shows a map, it is loaded with Google's map embedding tool (Google Maps). When the map loads, your browser connects directly to Google, and Google processes information such as your IP address, and any cookies it may use within the map frame, under the Google Privacy Policy.
• Call, WhatsApp and directions: these buttons open your phone's call app, WhatsApp or Google Maps. This contact does not pass through BadePlus; in your contact with the business, the business acts as the controller of your data.

BadePlus is the controller of the information in the server logs; you can use your rights about it as described under How to use your rights. For requests about the business information on the site, you can contact the business directly.