Privacy Policy

1In one sentence

This isn't a policy choice so much as the architecture itself: the software runs on your computer, production happens there, and the files stay there. Data we never receive is data we cannot lose, leak or be compelled to hand over.

2Data controller

Emre Şahin SEYREL (şahıs işletmesi) — Aydoğdu Mahallesi, Akasya Sokak No: 48/2, Süleymanpaşa / TEKİRDAĞ (Vergi No: 7670756805). Contact: hukuk@otonommedyam.com.

This policy is written to meet our information obligations under both the EU General Data Protection Regulation (GDPR) and Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

3What the website collects

The free month and purchases

We collect nothing from you directly on this website: both the free month and a purchase are completed on our payment provider's own pages. From there we receive only your email address along with your subscription and customer identifiers, used to send you your licence key and to resend it if you lose it. We do not add you to a marketing list and we don't email you outside of necessary product notices.

To stop repeated requests from one source, the IP address of the request is held briefly in memory; it is not written to the database.

Cookies and analytics

This site uses no cookies. No analytics tool, no advertising pixel, no third-party tracker. Even the fonts are served from our own server, so opening this page sends no request to Google. That's why you see no cookie banner — there is nothing to consent to.

4The complete list of what the software sends

The software verifies your licence once a day. These are the fields in that request — the complete list:

The installation ID is not a hardware fingerprint. It is a random number generated at install time; it has nothing to do with your serial number, MAC address or disk ID. That is deliberate: we don't want to lock someone out of their own software for changing their RAM, and we don't want to collect data we don't need.

Your licence key sits in the database as the identifier of your subscription; it is never written to the server's event logs. In the panel and in the software's own logs only the last four characters appear.

The four flags in the table are nothing but yes or no: we do not send how many channels you have, how many videos you made, their topics, your channel names, which provider or which language you chose. The question we want answered is “where do people give up during setup” — and that does not even need a number.

5What never reaches us

All of this stays on your disk and is never sent to us under any circumstances:

• Scripts, titles, descriptions, and the videos and images you produce
• Your voice recordings and cloned voice models
• Your API keys — language model, narration, imagery, all of them
• Your YouTube credentials and authorisation tokens
• Your channel configurations, topic lists and publishing schedule
• Your panel password

If you want to send us a fault report, you decide what to attach; the software does not send crash or log reports on its own.

6Payment details

Payments are taken by Polar Software, Inc., which is the merchant of record. We never see your card number, never store it, and it never touches our server.

Polar passes us only the minimum needed to manage the subscription: email address, subscription and customer ID, plan, and the end date of the paid period. Polar's own privacy policy applies in addition to this one.

7Services the software talks to on your behalf

While running, the software connects to outside services — but with your keys and directly. That traffic does not pass through our servers; we are not an intermediary:

• Wikipedia / Wikimedia Commons — topic text and images. No key needed, no identity sent.
• Your language model provider (for example Groq, OpenAI) — script generation. Your topic and prompt text go there.
• Your narration service (Edge TTS, ElevenLabs) — your text goes there. If you chose XTTS, narration happens entirely on your own computer and nothing is sent anywhere.
• YouTube Data API — only if you authorised a channel, and only to upload to that channel.

Each of these has its own privacy policy, and how they handle your data is their responsibility. You choose which providers to use.

8Retention periods

9Your rights

Under GDPR Articles 15-22 and KVKK Article 11 you have the right to learn whether we process data about you, to request a copy, to have it corrected or erased, to object to processing, and to receive your data in a portable format.

Send your request to hukuk@otonommedyam.com and we will answer within 30 days at the latest. In practice the set of data you can ask us to erase is very small — because we collect very little. Invoice and licence records that we are legally required to keep cannot be deleted before the end of that period.

If you are not satisfied with the outcome, you may complain to the data protection authority of your EU member state, or to the Turkish Personal Data Protection Authority (KVKK).

10Security

All communication with the licence server is encrypted (HTTPS) and the server's reply is cryptographically signed; the software accepts no response without verifying that signature. This makes it impossible for someone in the middle to send you a forged «your licence has been revoked» reply.

Licence keys are not written to server logs. Because no customer secret (API key, password, token) exists on our servers at all, none of those would be at risk in the event of a breach.

11Changes

If we update this policy we change the date at the top of the page. A material change that widens the set of data we collect will also be announced by email — the central claim of this policy is «we collect very little», so if that claim changes it should not change quietly.