Privacy policy

[LEGAL NAME - person or company] (“Samuraize”, “we”), of [STREET ADDRESS], [CITY], [POSTCODE], Türkiye, runs samuraize.ai and is the data controller for what is described here. This page says what we collect, why, on what legal basis, for how long, who it goes to, and what you can do about it. The short version: we keep the minimum needed to run the service, we don’t sell data, analytics that set cookies are off until you say yes, and you can delete everything yourself from Settings.

What we collect, and why

• Account details - name, email address, a hashed password (or the identity provider you signed in with), which version of the Terms you accepted and when. Basis: performing our contract with you. Kept: until you delete your account.
• Content you summarize - the link, text or file you submit is sent to our AI provider to produce the summary. If you are signed in, the summary is saved to your library together with the extracted text of videos, articles, ebooks, slide decks and pasted text (so you can re-cut it and ask questions about it); PDFs are processed as page images and their text is not kept. Uploaded files themselves are processed in memory and not stored. Your questions and the answers, and any flashcards or quizzes generated, are saved with the summary. Basis: contract. Kept: until you delete the summary or your account.
• Published summaries, comments and votes - public under your nickname, with your chosen avatar and rank, for as long as they stay published. Basis: contract (you chose to publish).
• Allowance and usage - how much of your daily and weekly allowance each summary used (a ledger with a reference id per summary, so a wrong count can be reported and traced), your bonus time, daily and weekly usage counts, and any usage report you file. Visitors without an account are counted against a salted, monthly-rotating hash of their network address that cannot be turned back into an IP address. Basis: contract, and our legitimate interest in enforcing plan limits. Kept: ledger until account deletion; anonymous counters for the month.
• Phone number - only if you choose to start the free trial, collect invite bonuses or claim a promo code. We send a verification code by SMS through Twilio and keep a one-way hash of the number plus its country code and last two digits (so you can recognise it in Settings). The number itself is discarded after verification: we cannot call or text you and cannot give it to anyone. It exists to make sure one person cannot collect the free allowance on many accounts. Basis: our legitimate interest in preventing abuse of a free service. Kept: until you ask us to delete it (your free daily summary then switches off) or delete your account.
• Abuse-prevention signals - at sign-up and when a referral is paid, we record one-way hashes of your email address, network address (salted monthly) and a browser identifier, and compare them with other accounts to detect duplicate accounts and referral farming. Flags raised by these checks are reviewed by a person. Basis: legitimate interest in preventing fraud. Kept: sign-up events 180 days; resolved flags 180 days.
• Payment details - handled entirely by Stripe. We never see your card number; we store a Stripe customer id, your subscription status and a record of purchases. Basis: contract, and legal obligations to keep accounting records. Kept: for as long as tax law requires (typically 10 years for invoices), even after account deletion.
• Support and reports - messages you send through the contact form, content reports, usage reports and copyright notices, with your email so we can reply. Basis: legitimate interest in answering you and handling complaints; legal obligation for copyright notices. Kept: as long as the matter is open, then up to 12 months.
• Our own analytics (no cookies) - for each page view we record the page, the referring site, campaign tags, device type, browser and operating system, and the country and region derived from the connection. We do not store your IP address: it is combined with a secret and the date into a one-way hash that changes every night, so we can count a day’s visitors but cannot follow anyone from one day to the next. Signed-in page views are linked to your account so we can see which features members use. Product events (“a PDF summary succeeded”) are also sent to PostHog without cookies, under a random id that is not stored on your device. Basis: legitimate interest in understanding use of the service. Kept: page-view records 90 days; daily totals indefinitely.
• Third-party analytics (cookies, only with your consent) - see Cookies below.
• Notifications and email - in-app notices (rank-ups, replies, summary-ready), and transactional email through Resend (verification codes, password resets, receipts, notices about your content). We do not send marketing email unless you have separately opted in, and every marketing email has an unsubscribe link. Kept: notices up to 180 days.

Cookies and similar technologies

Strictly necessary: a session cookie after you sign in, so the site knows it is you; the record of your cookie choice, kept in your browser’s local storage; and the browser identifier used to count free tries for visitors without an account. These need no consent.

Analytics, only if you accept: when you first visit we ask whether we may use Microsoft Clarity (session replays, heatmaps, rage and dead clicks - Clarity masks the text you type by default) and Google Analytics 4 (where visitors come from; IP addresses are anonymised and advertising features are off). Both set cookies and both send data to the United States. Neither loads unless you choose “Accept analytics”; “Reject” is honoured for as long as you like, and you can change your answer any time from “Cookie settings” in the footer. Choosing not to accept has no effect on the service. Basis: your consent.

Bot protection: sign-up, sign-in and anonymous summaries are protected by Cloudflare Turnstile, which may process your IP address and browser characteristics to tell humans from bots, under Cloudflare’s privacy policy.

Who receives your data

We use these providers, each under a data-processing agreement, for the purposes stated:

• Anthropic (US) - the text or file you summarize and your questions, to generate outputs. They do not use it to train their models.
• TranscriptAPI.com - the YouTube URL you submit, to fetch its transcript.
• Google (YouTube Data API) - channel or video ids, to list a channel’s videos.
• Google Sign-In (only if you choose “Continue with Google”) - Google tells us your email address, name and profile picture so we can open or sign in to your account. We never see your Google password.
• Vercel (US) - hosting and edge delivery; also a cookieless page-view counter.
• Neon (US) - the database that holds your account and library.
• Stripe - payments and subscriptions.
• Resend - transactional email.
• Twilio - the SMS verification code (they see the number for delivery; we keep only a hash).
• Cloudflare - bot protection.
• PostHog (US) - product events, without cookies.
• Microsoft Clarity and Google Analytics (US) - only if you accepted analytics cookies.

We do not sell personal data, do not share it for advertising, and do not share it with anyone else except where the law requires (for example a valid legal order) or to enforce our terms and protect the service and its users.

International transfers

We are based in Türkiye and our providers are mostly in the United States, so your data leaves your country. For transfers from the EU, EEA and UK we rely on the EU-US Data Privacy Framework where a provider is certified, and on the European Commission’s Standard Contractual Clauses (and the UK addendum) in our agreements with providers otherwise; our own processing in Türkiye is necessary to perform our contract with you. For transfers from Türkiye we rely on the mechanisms in Article 9 of the Personal Data Protection Law (KVKK) - see our KVKK notice. You can ask us for details of the safeguards in place.

Your rights

You can view, export (TXT, Markdown, PDF) and delete your summaries from your library, change your details and cookie choice, and delete your whole account, from Settings, without asking us. For anything else - access to a copy of your data, correction, deletion, restriction, portability, objection to processing based on our legitimate interests, or withdrawing a consent - email info@samuraize.ai. We answer within one month (30 days under KVKK). We may need to verify that you are the account holder. You also have the right to complain to a supervisory authority: in the EU, your national data-protection authority; in the UK, the ICO; in Türkiye, the Kişisel Verileri Koruma Kurulu. Residents of US states with privacy laws may have similar rights; we honour them on request even where those laws do not apply to a business of our size.

Security

Data is encrypted in transit and at rest with our providers, passwords are hashed, access is limited to the people who run the service, and moderation actions are recorded. No system is perfectly secure; if a breach affects your data we will tell you and the relevant authority as the law requires.

Children

Samuraize is not directed at children under 13 and we do not knowingly collect their data; if we learn an account belongs to a child under 13 we delete it. Between 13 and the age at which your country lets you consent to data processing yourself (up to 16 in the EU, 18 in Türkiye for some purposes), analytics that depend on consent stay off unless a parent or guardian agrees, and the service itself runs on the contract basis described above.

Changes

When this policy changes in a way that matters we email signed-in members before the change and update the date above; for minor changes we update the date and mention it in the app. Earlier versions are available on request.

Contact

[LEGAL NAME - person or company], [STREET ADDRESS], [CITY], [POSTCODE], Türkiye. Email info@samuraize.ai.