Privacy Policy

This policy explains how Optimal Technologies LLC ("Optimal"), the company behind FeedManager ("FeedManager", "we"), processes personal data when you use FeedManager at panel.feedmanager.org, api.feedmanager.org and feed.feedmanager.org (the "Service"), and what rights you have.

1. Who is responsible

For the personal data described in this policy, the data controller (veri sorumlusu) is:

Optimal Technologies LLC, 30 N Gould St, STE R, Sheridan, Wyoming 82801, United States (registration no. 2026-002109285) Privacy and data protection contact: [email protected]

Customer Data is different. Product data, files, third-party credentials and analytics data that our customers put into the Service are processed by us on behalf of the customer, who is the controller; our Data Processing Agreement with them governs that processing. If your personal data appears in a customer's product data, please contact that customer.

2. Personal data we process

We do not intentionally collect special categories of personal data, and the Service is not intended for anyone under 18.

Data from Google (Google Analytics, Merchant Center)

If you connect Google with Sign in with Google, you choose on the connection what FeedManager may read, and Google asks you to allow only that, together with your Google account's email address (openid email):

• Google Analytics 4: read-only access (analytics.readonly).
• Google Merchant Center: Google's Merchant API permission (content). Google describes it as managing your product listings because the API has no read-only permission. FeedManager only reads with it, unless you switch on "Instant price and stock updates" for a feed (see "What we write" below).

• Google Search Console: read-only access (webmasters.readonly).

• What we access: the email address of the Google account you sign in with (shown on the connection so your team knows whose access it is); for Google Analytics, the names and IDs of the accounts and properties that Google account can see (so you can pick one) and — for the property you choose — per-product report figures: item views, list clicks, add-to-carts, purchases and item revenue; for Merchant Center, the names and IDs of the Merchant Center accounts that Google account can open (so you can pick one) and — for the account you choose — each product's ID and status (approved, limited, pending, disapproved), the item issues Google reports for it (issue code, attribute, destinations and countries) and the account-level issues Google reports for the account; for Search Console, the addresses of the properties that Google account can open (so you can pick one) and — for the property you choose — per page of your site: clicks, impressions and average position in Google Search, and the search queries that led to the page with the same figures. Google reports these in aggregate and leaves rare queries out; they identify no person.

• What we write: nothing in Google Analytics or Search Console. In Merchant Center, nothing unless you switch on "Instant price and stock updates" for a feed. We then add one supplemental data source to your Merchant Center account, put it first in the default rule of the data source that reads that feed (everything already in the rule stays), and write the price, sale price and availability of that feed's products into it when they change. Each value is removed again once Google has read a feed file that holds it. Switching the updates off, deleting the feed or closing your Account removes the data source and our entry in the rule. We create, change or delete nothing else in Merchant Center.
• How we use it: only to show product performance and Merchant Center statuses in your Account, to alert you when they change, to let you use the figures in your feeds and rules, and — only if you switch on scheduled reports — to put totals of these figures, the Merchant Center counts and the names of your best-performing products into the reports we email to the addresses you entered for them. We do not use Google user data for advertising, do not sell it, do not transfer it to others except as needed to provide the Service, for security or to comply with the law, and do not use it to train artificial intelligence models. People at FeedManager do not read it unless you ask for support, or where needed for security or to comply with the law.
• AI features: when you ask an AI feature to plan custom labels or to explain your catalog health report, aggregated report figures (for example view counts and percentiles across your products, never data about individual people) are sent to the AI model provider that answers the request (section 4), only to produce that answer. When you run AI title optimisation and a product has Search Console figures, that product's most clicked search queries (up to five) are sent with the product's data to the provider, only to write that title. The provider may not use any of this to train its models.
• Storage and protection: the access and refresh tokens are stored encrypted (AES-256-GCM) and are never shown to anyone; the report figures and statuses are stored with your products in your Account, and a daily summary of the Merchant Center counts and issues is kept for 13 months.
• Deletion: click Disconnect on the connection, or remove FeedManager at myaccount.google.com/permissions; we then revoke the access at Google and delete the tokens. Report figures and statuses are deleted with the products, the source that read them or the Account (section 6).

Signing in with Google. If you sign up or sign in to FeedManager with Continue with Google, Google tells us your Google account's name, email address and account ID (openid email profile). We use them only to sign you in: the ID links your Google account to your FeedManager login, the address is matched with your login's address (a login with the same address is linked on your first Google sign-in, and you get an email about it), and the name pre-fills the sign-up form. We keep the ID and the address with your user; we get no access to any other Google data and store no Google tokens. You can disconnect it on your profile or remove FeedManager at myaccount.google.com/permissions; deleting your user deletes the link.

FeedManager's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Why we process it and on what legal basis

We do not use your personal data for advertising, do not sell it, and do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who receives it

• Other members of your Accounts see your name, email, role and your actions in the Account's activity log.
• Our staff (administrators and operators) access data only as needed for support and operations; this access is logged.
• Service providers acting on our instructions:
• Hetzner Online GmbH — server hosting in Germany;
• Cloudflare, Inc. (USA) — DNS, network protection, content delivery for feed files and, if enabled, the Turnstile CAPTCHA;
• Amazon Web Services EMEA SARL (Amazon SES) — sending service emails from Ireland;
• Stripe — payment processing, subscriptions and invoices for paid plans. For fraud prevention and its own legal obligations Stripe acts as an independent controller under its own privacy policy;
• AI model providers — Anthropic, PBC (USA), OpenAI OpCo, LLC (USA) and Google Ireland Limited (Ireland; Google LLC, USA) — only when an Account uses FeedManager's AI features: the provider of the model that answers a request receives the product data and product images of that request, and the text an Account writes for it (for example a rule described in plain language). Account managers see the provider next to each model and can block any of them. Under their API terms the providers may not use this data to train their models; they keep it only for a limited period to detect abuse. When an Account uses its own API key with a provider, that provider is engaged by the Account under its own agreement.
• Professional advisers (lawyers, accountants, auditors) under confidentiality obligations.
• Authorities and courts, where the law requires it.
• A successor if our business is merged or sold, subject to this policy.

5. International transfers

Some providers (for example Cloudflare and the AI model providers) process data outside Türkiye and the European Economic Area, including in the United States. For such transfers we rely on the safeguards the law provides: for GDPR, the European Commission's Standard Contractual Clauses or an adequacy decision; for KVKK, the standard contracts published by the Personal Data Protection Board (notified to the Board as required by Art. 9) or another basis under Art. 9.

6. How long we keep it

7. How we protect it

Connections are encrypted with TLS; passwords are stored as argon2id hashes; stored third-party credentials and two-factor secrets are encrypted with AES-256-GCM; one-time tokens and API keys are stored only as hashes; each customer's data is isolated from others; staff accounts require two-factor authentication; access is logged; backups are encrypted. See Annex II of the Data Processing Agreement for details.

8. Your rights

Depending on the law that applies to you, you have the right to:

• access your personal data and receive information about its processing;
• rectification of inaccurate or incomplete data;
• erasure, and to have third parties we shared it with informed of corrections or erasure;
• restriction of processing and to object to processing based on legitimate interests;
• data portability — receive your data in a machine-readable format;
• under KVKK Art. 11 in particular: learn whether your data is processed, the purpose and whether it is used accordingly, the third parties it is transferred to in Türkiye or abroad, object to a result against you arising exclusively from automated analysis, and claim compensation for damage from unlawful processing;
• complain to a supervisory authority: in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); in the EU/EEA, the authority of your country of residence.

How to exercise them:

• In the Service: Profile → Export my data (your personal data as JSON) and Profile → Delete my user. Account managers can export all Account data and close the Account from its settings.
• By email to [email protected] from the address registered in the Service, or in writing to our address above.

We answer within 30 days, free of charge, unless the request requires significant cost, in which case a fee may be charged as permitted by law. We may ask you to confirm your identity.

9. Cookies and local storage

We use only cookies and browser storage that are necessary for the Service to work or that remember your choices. We do not use analytics or advertising cookies.

10. Changes to this policy

We may update this policy. We will announce material changes in the Service and, where appropriate, by email. The version and effective date are shown at the top; previous versions are available on request.

11. Contact

Questions about this policy or your personal data: [email protected] · 30 N Gould St, STE R, Sheridan, Wyoming 82801, United States

Questions about this document: [email protected]. Optimal Technologies LLC, 30 N Gould St, STE R, 82801 Sheridan, Wyoming, United States.