Privacy Policy

Introduction

This policy explains which personal data is processed when you use the SAI Statistics desktop app and the saistatistics.com website, for which purposes and on which legal bases, to whom it is disclosed, and what your rights are. It serves as the information notice under Article 13 of the EU General Data Protection Regulation (GDPR) and Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

Data controller

SAİ Bilişim Anonim Şirketi (SAI Bilisim Anonim Sirketi) — Address: Değirmiçem Mahallesi 16051 Nolu Sokak, Milenyum İş Merkezi No: 19/37, 27090 Şehitkamil/Gaziantep, Türkiye — Trade registry (MERSIS) no.: 0739131314400001 — Email: [email protected]

Your analysis data stays on your device

Statistical data you import (CSV, SAV, XLSX, DTA, etc.) is processed only on your own computer. The analysis engine (R) and the data layer (DuckDB) run entirely locally — your data is not sent to our servers.

Your conversations with the AI assistant are stored inside the .sdf data file you save (only on your computer). If you share an .sdf file with someone, you also share the chat history it contains.

When you create an account

If you choose to use AI features with a 'SAI account', we store your email address, a secure hash of your password (we never store your plaintext password), your email verification status, and, if you sign in with Google, your Google account identifier. Account verification and password reset emails are sent via Google Workspace.

We do not send marketing, advertising or newsletter emails. Your account only receives email verification, password reset and security or transactional notices (purchase receipts and invoices are sent by our payment provider).

When you use AI features

Your raw data rows are never sent to the AI. The AI receives metadata (such as variable names/labels) and your analysis result tables; for some analyses these tables can include individual observation values (e.g. lists of extreme values).

We do not permanently store the content of your AI chats on our servers; we only store technical metrics such as the model used, token counts, and cost. Your request is forwarded, depending on the model you choose, via OpenRouter (openrouter.ai) to the relevant model provider (e.g. Anthropic, OpenAI, Google, DeepSeek); those providers’ own privacy policies apply.

Automated decision-making

The AI assistant produces comments and suggestions about your statistical results; they are informational, and it is up to you to evaluate and use them. We do not make decisions about you that are based solely on automated processing and produce legal effects or similarly significantly affect you, and we do not profile you.

Payments

Credit pack purchases are processed by Link, LLC f/k/a Lemon Squeezy LLC ("Lemon Squeezy"), acting as the Merchant of Record. Your card details never reach us. For payment you are redirected to a checkout page operated by Lemon Squeezy; you share your payment details directly with Lemon Squeezy. We only store the order number, the amount of credit purchased, and the email address linked to your account.

For purchases made in Turkish lira (TRY) by buyers in Türkiye, the seller is SAI Bilişim A.Ş.: payment is collected through the licensed payment institution PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. ("PayTR"), your card details never reach us, and SAI issues your invoice. Refund requests for these purchases are assessed by SAI, and approved refunds are issued through PayTR to your original payment method. The Distance Sales Agreement (saistatistics.com/distance-sales) and the Pre-Information Form (saistatistics.com/pre-information) apply to these purchases.

App downloads

When you download the app from saistatistics.com, our download statistics record the platform, version, country (via Cloudflare), and your operating system and browser information (user-agent). This record does not include your IP address, is never linked to an account, and is used only for aggregate statistics.

The app's connections to our server

The SAI Statistics app connects to our server (api.saistatistics.com) at startup to check for and download updates. If you use a SAI account, it also connects for sign-in, credit balance, the model list, and AI requests. Your analysis data is not sent over these connections.

Bug reports and support

Help ▸ Report a Bug opens a ready-made draft in your email client, addressed to [email protected]. The draft includes the app version, the operating system and its version, the Electron version, and the R status and version; your analysis data is not included. You can read and change the email before sending it, and the app never sends anything on its own. The email and the information in it are used only to answer your request and resolve the problem.

Server logs

For every connection to our servers, your IP address, the time, the requested address, and browser/app information are written to technical logs for security and abuse prevention; they are kept for at most 14 days and then deleted automatically.

Cookies and local storage

Our website does not use cookies and has no tracking, analytics, or advertising tools. Your browser's localStorage only holds your language preference and, if you're signed in, your session tokens and email address — these stay in your browser. Fonts are served from our own server. Our site is delivered via Cloudflare (infrastructure/security).

Purposes and legal bases

Account creation, sign-in, email verification, providing the AI service and credits, and adding purchased credits to your account: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Keeping purchase and usage records: performance of a contract and compliance with our legal obligations (GDPR Art. 6(1)(b), (c); KVKK Art. 5(2)(c), (ç)).

Server logs, rate limiting and abuse prevention; update checks; aggregate download statistics: our legitimate interest in securing and improving the service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

We do not carry out any processing based on consent.

Recipients

To provide the service, your personal data is shared, limited to the relevant purpose, with the following service providers:

Hetzner Online GmbH (Germany) — server hosting. Cloudflare, Inc. (USA) — website and API infrastructure, security. Google LLC (USA) — email delivery (Google Workspace) and Google sign-in. Link, LLC f/k/a Lemon Squeezy LLC (United States) — merchant and payment processing. PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (Türkiye) — payment processing. OpenRouter, Inc. (USA) and the provider of the model you choose (e.g. USA, China) — processing of AI requests.

Your data is not sold and is not shared for advertising. It may be disclosed to competent authorities where required by law.

Mergers and company transfers

If our company is involved in a merger, acquisition, sale or a similar corporate transaction, your personal data may be shared with the parties involved and transferred to the acquirer to the extent the transaction requires. Any such change will be announced on this page.

International transfers

Because the servers of the service providers above are located outside Turkey and, in some cases, outside the EU/EEA (USA and, depending on the AI model you choose, other countries), your data is transferred internationally. These transfers are based on the safeguards provided in Chapter V of the GDPR and Article 9 of the KVKK (adequacy decisions, standard contractual clauses, or transfers necessary for the performance of a contract).

Retention

Your account, usage and purchase records are kept until you delete your account. When you delete your account, these records are permanently deleted from our systems; payment records are retained by Lemon Squeezy under its own policy. Server logs are kept for at most 14 days; aggregate download statistics are kept indefinitely (they cannot be linked to a person).

Deleting your account

You can delete your account in the app under Preferences ▸ AI ▸ SAI Account using "Delete account", or by writing to [email protected]. Deletion cannot be undone and forfeits any unused credits in your account; if you want a refund, request it before deleting your account (see Refund Policy).

Your rights under the GDPR

You have the right to access, rectify and erase your data, to restrict its processing, to data portability, and to object to processing based on legitimate interest. You can send requests to [email protected]. You also have the right to lodge a complaint with the data protection supervisory authority of the EU member state where you live or work.

Your rights under Turkish law (KVKK)

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request rectification and erasure and to have these notified to such third parties; to object to an outcome against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing. Requests are answered free of charge within 30 days; you may lodge a complaint with the Turkish Personal Data Protection Board if your request is rejected or not answered in time.

Children's privacy

SAI Statistics is not directed at children; we do not knowingly collect data from users under 18.

Security

Your password is stored hashed, session tokens are short-lived and stored only as hashes in our database, and your SAI account session on your computer is encrypted with your operating system's encryption facility. Communication with our servers is encrypted via HTTPS/TLS.

Changes to this policy

This policy may be updated; you will be notified on this page of any material changes.

Contact

For questions: [email protected] — SAI Bilişim A.Ş., Değirmiçem Mahallesi 16051 Nolu Sokak, Milenyum İş Merkezi No: 19/37, 27090 Şehitkamil/Gaziantep, Türkiye