Data Protection Notice
Last updated: August 2026
This Data Protection Notice explains the legal position of WhowSell LLC as data controller for the personal data processed within the crm.whowsell.com service, under the Turkish Personal Data Protection Law (KVKK) and the General Data Protection Regulation (GDPR). Our Privacy Policy describes what we do with your data in practice; this notice sets out the legal grounds we rely on, the rights you hold and the way you may exercise them.
1. Identity of the Data Controller
The controller of the personal data processed within the crm.whowsell.com service is WhowSell LLC, 1209 Mountain Road Pl NE #7495, Albuquerque, NM 87110, United States. As controller, WhowSell LLC determines the purposes and the means of processing for the panel and for the browser extension that works alongside it. Every request made under this notice can be addressed to support@whowsell.com.
This notice covers the processing we carry out in our own name. For the end buyer name and delivery address that you enter into the panel, you remain the controller and WhowSell acts only as a processor following your instructions. That division of roles is described in more detail in our Privacy Policy.
You may reach us in writing at the postal address above or electronically at support@whowsell.com. We handle data protection requests through written channels only, so that every application and every answer leaves a traceable record. Requests arriving through other channels are redirected to this address.
2. Categories of Personal Data Processed
We process identity and contact data consisting of your first name, last name, email address and phone number, together with billing and brand data such as the billing name or company name you enter, contact email address, phone, address, country and city, and the logo you upload if you hold an Enterprise plan and use your own domain. Subscription and transaction data covers your selected plan, subscription status, invoice records and payment method information.
Application data consists of the records you create in the panel: stores, order lines carrying order number, ASIN, date, quantity, revenue, cost, profit, status and marketplace, expense items, notes and file attachments. End buyer data is limited to the buyer name and the delivery address required for order automation. Card numbers, expiry dates and security codes are never stored on our servers; only the last four digits and the card brand reach us.
Technical data includes your IP address, session and sign-in records, device and browser information and your interface preferences. A device summary is derived irreversibly from browser and device characteristics during registration, and your identity cannot be reached from that value. We also process your support correspondence and the messages you send to the Atlas AI assistant.
3. How Personal Data Is Collected
Most of your personal data is collected directly from you by electronic means. The registration form is the primary source; if you prefer to continue with Google, your name and email address are received from your Google account for authentication purposes only. We buy no data from third parties and gather none from public sources.
A second group of data reaches us through your ordinary use of the panel: the records you enter, the files you upload, the support messages you write and the conversations you hold with Atlas AI. The browser extension carries order information from your Amazon seller pages into the same account, and it runs on Amazon domains only.
A third group is generated automatically by our systems. Cookies strictly necessary to maintain the session, server logs, IP address, browser and device information and the device summary produced during registration all fall into this group. We use no analytics or advertising cookies and carry no third-party tracking pixels.
4. Purposes of Processing
We process identity, contact and billing data to create your account, verify you at sign-in and deliver the core CRM features: store records, order tracking, expense entry and profit reporting. Interface preferences are processed so that the panel keeps the language and theme you chose.
Subscription and transaction data is processed to activate your plan, collect payments through Stripe, issue invoices and keep the accounting records required of us. Support and communication data is processed to answer your requests and to send transactional emails such as address verification, password reset and notifications.
Technical data, sign-in records and the device summary are processed to keep accounts secure, detect unauthorised access and prevent abuse and duplicate registration. Atlas AI data is processed solely to produce the answers you ask the assistant for. None of this data is processed for advertising, profiling or resale.
5. Legal Grounds for Processing
Creating your account, running your subscription and delivering the service rest on the ground that processing is directly related to the establishment and performance of a contract, under Article 5/2-c of the KVKK and Article 6/1-b of the GDPR. Data that is indispensable for a feature you request cannot be withheld without that feature becoming unavailable.
Invoice, payment and accounting records are retained on the ground of compliance with a legal obligation, under Article 5/2-ç of the KVKK and Article 6/1-c of the GDPR. These records are kept for the minimum period that tax legislation requires, including after the account has been closed.
Security measures, sign-in and access logs, the device summary used against abuse and duplicate accounts, and our work to improve the service rest on legitimate interests, under Article 5/2-f of the KVKK and Article 6/1-f of the GDPR, provided that your fundamental rights and freedoms are not harmed. Where a processing activity falls under none of these grounds, we ask for your explicit consent under Article 5/1 of the KVKK and Article 6/1-a of the GDPR, and you may withdraw that consent at any time.
6. Transfer of Personal Data and Transfers Abroad
Personal data is transferred to third parties only where a legal ground permitting the processing itself exists, in line with Article 8 of the KVKK. Our recipients form a limited set of service providers: our provider for the database, authentication and file storage, our application hosting provider, Stripe, Inc. for payments, a separate provider for transactional email, an external model provider for the Atlas AI assistant, and Google for sign-in where you choose it.
The servers holding the database are located in Frankfurt, Germany, inside the European Union, while the application itself is hosted in the Washington D.C. region of the United States. This split means that personal data crosses borders as part of ordinary operation, which amounts to a transfer abroad under Article 9 of the KVKK and a transfer to a third country under Chapter V of the GDPR.
These transfers are bounded by contractual safeguards. Our providers act as processors, may process data only on our instructions and for the purposes stated here, and are bound by their own confidentiality and security commitments. Your data is never sold, rented or transferred for marketing purposes, and it is disclosed to public authorities only where a lawful request requires it.
7. Retention and Destruction
Account and application data is retained for as long as your account remains active. Invoice and payment records are kept for the minimum period required by tax legislation, including after the account has been closed.
Message attachments are deleted automatically fourteen days after they are uploaded. When a subscription ends, your data is retained for at least thirty days so that you have time to export it.
At the end of the applicable period, personal data is deleted, destroyed or anonymised. Anonymised records can no longer be linked to you and may be kept for statistical purposes only. Retention periods are reviewed periodically, and data that is no longer needed is removed without waiting for a request.
8. Rights of the Data Subject
Under Article 11 of the KVKK you have the right to learn whether your personal data is being processed, to request information about it where it has been processed, to learn the purpose of processing and whether the data is used in accordance with that purpose, and to know the third parties in the country or abroad to whom it has been transferred. These requests can be answered from the records held in your account.
You may also request that incomplete or inaccurate data be corrected, request erasure or destruction within the conditions of Article 7 of the KVKK, and require that any such correction or erasure be notified to the third parties to whom the data was transferred. You may object to a result produced to your detriment through analysis carried out exclusively by automated systems, and claim compensation for damage suffered because of unlawful processing.
Under the GDPR you additionally hold the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21), together with the right to withdraw consent under Article 7(3). Most of these can be exercised directly from the panel, and for the remainder a message to support@whowsell.com is enough.
9. Automated Decision-Making and Atlas AI
Atlas AI is the assistant built into the panel, and its outputs are advisory only. It produces no decision based solely on automated processing that has legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR, and the final decision always rests with you.
The messages you write, the images you upload and your conversation history are transmitted to the model provider so that an answer can be generated, and are stored in your account so that you can return to earlier conversations. The model provider does not use data received through its API to train its general-purpose models, and WhowSell trains no model with your data.
The device summary produced during registration serves a single purpose: preventing abuse and duplicate accounts. It is compared against a list of blocked devices, cannot be traced back to your identity and is never used for profiling or advertising. If a registration is blocked, you may object by writing to support@whowsell.com, and the case is reviewed by a person.
10. How to Apply and the Right to Complain
Applications under Article 11 of the KVKK and requests under the GDPR are made by writing to support@whowsell.com. So that we can verify your identity, the message must be sent from the email address registered to the account, and it should state clearly which right you are exercising.
We answer applications within thirty days at the latest and free of charge. Where answering requires a separate cost, a fee within the tariff set by the Turkish Personal Data Protection Board may be charged. Where an application is refused, the reason is explained in the answer.
If you find the answer insufficient, or if no answer reaches you within thirty days, you may lodge a complaint with the Turkish Personal Data Protection Board, within thirty days of learning of the response and in any event within sixty days of the date of the application. If you are in the European Union, your right to complain to the competent supervisory authority in your country of residence, your place of work or the place of the alleged infringement is reserved under Article 77 of the GDPR.