Privacy Policy

1In one sentence

This isn't a policy choice so much as the architecture itself: the software runs on your computer, production happens there, and the files stay there. Data we never receive is data we cannot lose, leak or be compelled to hand over.

2Data controller

Emre Şahin SEYREL (şahıs işletmesi) — Aydoğdu Mahallesi, Akasya Sokak No: 48/2, Süleymanpaşa / TEKİRDAĞ (Vergi No: 7670756805). Contact: hukuk@otonommedyam.com.

This policy is written to meet our information obligations under both the EU General Data Protection Regulation (GDPR) and Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

3What the website collects

The free trial form

Only your email address. It is used to send you your key, to return the existing key if the same address applies again, and to stop the 7-day trial from being abused. We do not add you to a marketing list and we don't email you outside of necessary product notices.

To stop repeated requests from one source, the IP address of the request is held briefly in memory; it is not written to the database.

Cookies and analytics

This site uses no cookies. No analytics tool, no advertising pixel, no third-party tracker. Even the fonts are served from our own server, so opening this page sends no request to Google. That's why you see no cookie banner — there is nothing to consent to.

4The complete list of what the software sends

The software verifies your licence once a day. These are the fields in that request — the complete list:

The installation ID is not a hardware fingerprint. It is a random number generated at install time; it has nothing to do with your serial number, MAC address or disk ID. That is deliberate: we don't want to lock someone out of their own software for changing their RAM, and we don't want to collect data we don't need.

Your licence key sits in the database as the identifier of your subscription; it is never written to the server's event logs. In the panel and in the software's own logs only the last four characters appear.

5What never reaches us

All of this stays on your disk and is never sent to us under any circumstances:

• Scripts, titles, descriptions, and the videos and images you produce
• Your voice recordings and cloned voice models
• Your API keys — language model, narration, imagery, all of them
• Your YouTube credentials and authorisation tokens
• Your channel configurations, topic lists and publishing schedule
• Your panel password

If you want to send us a fault report, you decide what to attach; the software does not send crash or log reports on its own.

6Payment details

Payments are taken by Paddle.com Market Ltd, which is the merchant of record. We never see your card number, never store it, and it never touches our server.

Paddle passes us only the minimum needed to manage the subscription: email address, subscription and customer ID, plan, and the end date of the paid period. Paddle's own privacy policy applies in addition to this one.

7Services the software talks to on your behalf

While running, the software connects to outside services — but with your keys and directly. That traffic does not pass through our servers; we are not an intermediary:

• Wikipedia / Wikimedia Commons — topic text and images. No key needed, no identity sent.
• Your language model provider (for example Groq, OpenAI) — script generation. Your topic and prompt text go there.
• Your narration service (Edge TTS, ElevenLabs) — your text goes there. If you chose XTTS, narration happens entirely on your own computer and nothing is sent anywhere.
• YouTube Data API — only if you authorised a channel, and only to upload to that channel.

Each of these has its own privacy policy, and how they handle your data is their responsibility. You choose which providers to use.

8Voice recordings

A recording you upload for voice cloning takes one of two paths, depending on the engine you chose:

• XTTS — the recording never leaves your computer. The model runs there too.
• ElevenLabs — the recording is uploaded to ElevenLabs with your own API key and a voice model is created there. That is a transaction between you and ElevenLabs; deletion and retention follow their policy. No copy reaches us.

Whose voice you are allowed to clone is a separate question: Voice Cloning Consent.

9Retention periods

10Your rights

Under GDPR Articles 15-22 and KVKK Article 11 you have the right to learn whether we process data about you, to request a copy, to have it corrected or erased, to object to processing, and to receive your data in a portable format.

Send your request to hukuk@otonommedyam.com and we will answer within 30 days at the latest. In practice the set of data you can ask us to erase is very small — because we collect very little. Invoice and licence records that we are legally required to keep cannot be deleted before the end of that period.

If you are not satisfied with the outcome, you may complain to the data protection authority of your EU member state, or to the Turkish Personal Data Protection Authority (KVKK).

11Security

All communication with the licence server is encrypted (HTTPS) and the server's reply is cryptographically signed; the software accepts no response without verifying that signature. This makes it impossible for someone in the middle to send you a forged «your licence has been revoked» reply.

Licence keys are not written to server logs. Because no customer secret (API key, password, token) exists on our servers at all, none of those would be at risk in the event of a breach.

12Changes

If we update this policy we change the date at the top of the page. A material change that widens the set of data we collect will also be announced by email — the central claim of this policy is «we collect very little», so if that claim changes it should not change quietly.