Privacy Policy

Effective 30 October 2026Applies to thinkpeak.ai and Thinkpeak services

1. Who we are

Thinkpeak AI (“Thinkpeak”, “we”, “us”) builds AI agents, agentic workflows and AI dashboards for businesses, and sells WordPress plugins and automation templates on thinkpeak.ai.

Thinkpeak AI is a sister company of Digipeak, a digital marketing agency. Each company has its own website and its own privacy policy. This policy explains how Thinkpeak handles personal data; Digipeak’s policy is at digipeak.org/privacy-policy.

Thinkpeak is the data controller for personal data collected through thinkpeak.ai. We operate from Istanbul, Türkiye. You can reach us at info@thinkpeak.ai.

2. The data we collect

Information you give us

• Inquiry form: your name, email address, company, website, phone or WhatsApp number, how you heard about us, how you prefer to be contacted, the services you are interested in, a description of the task or workflow, the tools your team uses, timeline, budget range, team size, and the page you sent the form from.
• Conversations: what you share with us by email, phone, WhatsApp or in meetings.
• Purchases: your name, email address, billing details and order details. Card payments are handled by our payment provider, iyzico; we do not see or store full card numbers.
• Project data: information you give us access to while we build or run something for you (see section 6).

Information collected automatically

• Technical data such as IP address, browser and device type, pages viewed, the page that referred you and an approximate location derived from your IP address.
• Cookies and similar technologies, as described in our Cookie Policy. Analytics cookies are only set if you accept them.

Information from others

• Payment confirmations from our payment provider.
• Data from tools you connect to a project, such as your CRM or inbox, only as far as the project needs it.
• Publicly available business information, for example your company website, when we prepare for a call you booked.

3. How we use it and why we are allowed to

• To answer your inquiry and prepare a proposal. Basis: steps you asked for before a contract, and our legitimate interest in replying to business inquiries.
• To deliver projects, products, licences and support. Basis: performance of our contract with you.
• To take payments, issue invoices and keep accounting records. Basis: contract and legal obligations.
• To keep the site and our systems secure. For example, the inquiry form uses a hidden spam trap and limits each connection to five requests per hour using a scrambled (hashed) version of the IP address that is deleted after one hour, and the login page is protected against brute-force attempts. Basis: legitimate interest.
• To understand how the site is used and improve it. Basis: your consent, given through the cookie banner.
• To send service messages about an inquiry, order or project. We do not add you to a newsletter unless you ask to join one.

If you are in Türkiye, these purposes rely on the corresponding conditions in Article 5 of the Personal Data Protection Law No. 6698 (KVKK): performance of a contract, legal obligation, legitimate interest and, for analytics cookies, explicit consent.

4. Cookies and analytics

The cookie banner lets you accept or reject non-essential cookies, and you can change your choice later. We use Google Analytics 4 (through the MonsterInsights and Google Site Kit plugins) to measure visits when you consent. WooCommerce sets cookies needed for the cart and checkout. The full list, with durations, is in our Cookie Policy.

5. Who we share data with

We share personal data only when it is needed for the purposes above:

• Service providers that run our website and email (hosting, email delivery, security and backups).
• Google, for analytics, if you have consented.
• iyzico, to process payments.
• Tools and AI providers used in a project, such as n8n, Make, OpenAI, Anthropic or Google, only as agreed with the client for that project.
• Digipeak, our sister company, only when a project you asked for involves both companies, and only for that project.
• Professional advisers (for example accountants and lawyers) and public authorities when the law requires it.

We do not sell personal data and we do not share it for cross-site advertising.

6. Client project data and AI processing

When we build or run AI agents, workflows or dashboards for a client, we work with the client’s business data, which can include personal data about the client’s customers or staff. In that role we act on the client’s instructions as a data processor, and the client is the data controller. The project agreement sets out what we may do with that data; a data processing agreement is available on request.

We only send project data to the AI providers and tools agreed for that project, and we do not use client data to train AI models.

7. International transfers

Some of our providers store or process data outside Türkiye, the European Economic Area or the United Kingdom, for example in the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses, adequacy decisions or the transfer mechanisms set out in Article 9 of the KVKK.

8. How long we keep data

• Inquiries that do not lead to a project: as long as needed to reply and follow up, then deleted.
• Client, order and invoice records: for as long as tax and accounting laws require.
• Analytics data: according to the retention period set in Google Analytics.
• Security data such as rate-limit records: for a short period; the inquiry form’s records are deleted after one hour.

9. How we protect data

The site is served over HTTPS with security headers, access to inquiries and orders is limited to the people who need it, the login page is protected against brute-force attacks, and we keep backups. No system is perfectly secure, so please do not send passwords or other secrets through the inquiry form.

10. Your rights

Depending on where you live, you can ask us to:

• tell you whether we process your data and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, or restrict how we use it;
• send your data to you or another company in a portable format;
• stop using your data for a purpose based on legitimate interest, or withdraw your consent at any time;
• tell you which third parties received your data and, under the KVKK, notify them of corrections or deletions;
• object to a result produced only by automated processing that affects you negatively.

Email info@thinkpeak.ai to make a request. We may ask you to confirm your identity, and we reply within 30 days. You can also complain to a data protection authority: in Türkiye the Personal Data Protection Authority (KVKK), in the UK the Information Commissioner’s Office, and in the EU the authority in your country.

11. Children

Our website and services are for businesses and are not directed at children under 16. We do not knowingly collect their data; if you think a child has sent us personal data, contact us and we will delete it.

12. Other websites

Our pages link to other websites, including Digipeak and the tools we write about. Their privacy practices are their own.

13. Changes to this policy

We update this policy when our services or the law change. The effective date at the top shows the latest version; for significant changes we will also tell clients directly.

14. Contact

Thinkpeak AI, Istanbul, Türkiye. Email: info@thinkpeak.ai. Thinkpeak AI is a sister company of Digipeak, a digital marketing agency. See also our Terms of Use, Cookie Policy and Refund Policy.

YouTube API Services (Translation Automation)
Thinkpeak AI operates “Translation Automation”, a private internal tool that uses YouTube API Services. It connects only to YouTube channels that we own or manage, and only after the channel owner signs in with Google and gives permission.
By using Translation Automation you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms
Google’s Privacy Policy applies to the data YouTube API Services handle: https://policies.google.com/privacy
What we access: channel and video details, YouTube Analytics and Reporting data (such as views, watch time and audience retention), caption tracks, and the ability to update our own videos (publish schedule, tags, titles, descriptions, translations and subtitles). We also read public video information (titles, view counts, publish dates) from YouTube search to research topics.
How we use it: only to measure the performance of our own channels, to manage our own videos, and to choose topics for our own original videos. We do not use this data for advertising or profiling, and we do not access anyone else’s channel.
Storage and sharing: data is stored privately on our own computer and a private team dashboard. It is not sold, rented or shared with third parties. Access tokens are kept private and never published. We do not use cookies or similar technologies on users’ devices through this tool.
Deletion: public video information from other channels is refreshed or deleted within 30 days. You can revoke the tool’s access at any time from Google’s security settings page: https://myaccount.google.com/permissions. When access is revoked, we delete the stored token and that channel’s stored data within 7 days. To request deletion at any time, email info@thinkpeak.ai.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Contact: info@thinkpeak.ai