Privacy policy

Last updated 10 November 2026

This policy describes how INT-TECH processes personal data when you use the AEGIS Events console (console.int-tech.solutions) and connect an AI app to the AEGIS Events MCP connector (mcp.int-tech.solutions). The policy for the int-tech.solutions website is separate. For Turkish data subjects the KVKK notice adds the information required by Law No. 6698.

Who we are (controller)

Legal name: INT TECH Yazılım ve Danışmanlık Ltd. Şti.
Brand: INT-TECH (int-tech.solutions)
MERSİS no.: 0465155157400001
Tax office / number: İvedik Vergi Dairesi / 4651551574
Address: İvedik OSB Mah., 2224. Cad. No:1/116, Yenimahalle/Ankara, Türkiye
Email: info@int-tech.solutions
Phone: +49 152 57066194
KEP: int.techyazilim@hs01.kep.tr

Privacy contact: info@int-tech.solutions, subject “Privacy Request”.

What we collect and why

Account data: email address, name if given, password hash (if you use a password), Google account identifier (if you sign in with Google), workspace and member records. Purpose: create and secure your account. Basis: contract.
Billing data: plan, billing period, invoice details you give us (name, address, tax number for invoices), payment status and reference returned by iyzico. We do not receive or store card numbers; they are entered on iyzico's page. Purpose: charge, invoice and meet accounting law. Basis: contract and legal obligation.
Keys and connections: a hash of each API key secret (never the key), key names, OAuth connections and tokens issued to apps you connect. Purpose: authenticate and revoke access. Basis: contract.
Usage data: which key or connection was used, tool name, time, result size, latency, and a hash of the arguments. We do not store the text of your questions. Purpose: enforce quotas, bill, keep the service reliable, investigate abuse. Basis: contract and legitimate interests.
Technical data: IP address and browser details in server logs and for rate limiting sign-in attempts. Purpose: security. Basis: legitimate interests.
Visit measurement on console.int-tech.solutions: page address, time, referring page, browser and device type, language, screen size, and a coarse location derived from the IP address. Purpose: understand how the console is used. Basis: legitimate interests while measurement is cookieless; your consent once you accept analytics cookies. Details are under Cookies.
Support messages you send us. Basis: contract and legitimate interests.

We do not use your data to train models, do not sell it, and do not use it for advertising.

Who receives it (processors and recipients)

Microsoft Azure (hosting and database, North Europe region).
iyzico (payment institution; processes card payments and returns payment status). iyzico acts as an independent controller for payment data under its own policy.
Google (sign-in with Google, if you choose it; and Google Analytics on the console, as described under Cookies).
Microsoft Azure Communication Services (sends verification, receipt and notice emails).
The AI app you connect (Claude, ChatGPT or other): receives event text you ask it to retrieve; its own terms apply.
Accountants, advisers and authorities where the law requires.

Where a processor is outside Türkiye or the EEA, transfers rely on the safeguards the law allows. [Transfer mechanism to be confirmed.]

How long we keep it

OAuth access tokens: 1 hour. Refresh tokens and connections: up to 90 days, or until you disconnect the app or revoke the key.
Account and workspace data: while the account exists, and for up to 12 months after deletion for dispute handling. [Period to be confirmed.]
Invoices and billing records: as long as Turkish tax and commercial law require (generally 10 years).
Usage rows: kept for quota and abuse review, deleted or aggregated within 24 months.
Sign-in rate-limit counters: expire within 15 minutes.
Google Analytics event data for the console: 2 months. Analytics cookies, if you accept them, last up to 2 years unless you delete them sooner.

Your rights

You can ask for access, correction, deletion, restriction, objection and a copy of the personal data we hold about you, and you can withdraw consent where we rely on it. Write to info@int-tech.solutions. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or your local supervisory authority.

Cookies

The console sets one httpOnly session cookie (aegis_portal_session) to keep you signed in. It is strictly necessary, lasts for the browser session, and is not used for tracking or advertising.

On console.int-tech.solutions the console also loads Google Analytics 4 (Google Ireland Limited and Google LLC). This is a separate Google Analytics property from the one on www.int-tech.solutions. The tag is not loaded on other hostnames. Advertising storage, ads personalisation and Google signals stay off. We do not use this for advertising or remarketing.

Until you accept, and if you reject, measurement stays cookieless. No analytics cookie is set, and a later visit is not linked to this one. Google still receives a limited ping for that page: the page address, the time of the visit, the referring page, browser and device type, language, screen size, and a coarse location derived from your IP address. Google Analytics 4 does not log or store your full IP address.

If you accept, Google also sets analytics cookies, including _ga and a _ga_ cookie, on this host. They let us tell a new visit from a returning browser. Your choice is stored in localStorage under aegis-console-analytics-consent so the question is not shown on every page. That entry is not a cookie and is not sent to us as form data. You can change it at any time with Cookies in the footer, or delete it in your browser. Withdrawing consent stops later analytics cookies; you can also delete the cookies yourself.

Legal basis for the cookieless ping: legitimate interests in understanding how the console is used (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)). Legal basis for analytics cookies: your consent (GDPR Art. 6(1)(a), KVKK Art. 5(1)).

Security

Traffic uses HTTPS. API key secrets and passwords are stored only as hashes; connection tokens are sealed. Access to production data is limited to staff who operate the service.

Changes

We publish changes at this address and tell account holders by email when a change is material.