Privacy policy and data protection notice

Last updated: 26 October 2026

1. Controller and scope

Eren Tokmak, a sole proprietor operating under the Quickesta brand, Pınar Mah. Balaban Dere Cad. No: 186 İç Kapı No: 1, Sarıyer, İstanbul, Türkiye. Tax office: Sarıyer. Telephone: +90 532 069 74 24. Privacy and deletion requests: erentokmakofficial@gmail.com.

This policy covers quickesta.com, the Quickesta platform and the Era product at getera.io / app.getera.io. Integration sections apply to connections you choose to use; not every connection is available in every product. Era is a product operated by Quickesta. The operator of Quickesta is Eren Tokmak, identified above.

2. Our roles

We are the controller for your own account, service security, subscriptions and support. When a business uploads its customers’, employees’ or contacts’ data to Era, that business is the controller and we process the data on its instructions. Contact your workspace administrator as well if your request concerns that business’s records.

3. Data we collect and its sources

Information you provide: name, email, phone, business and billing details; support requests; files, messages and records you create in a workspace.
Service use: sign-in and action records, IP address, browser/device information, error and security logs.
Connected apps: authorised account identifiers and credentials, plus the content needed for the tool or workflow you choose. Google and Meta data are explained below.
AI features: your prompts, responses and the workspace context required for your selected operation.

4. Purposes and legal bases

We process data to create accounts, authenticate users, store records, connect selected apps and perform requested operations on the basis of a contract; to keep legally required billing and other records on the basis of legal obligations; and for security, abuse prevention and support on the basis of legitimate interests balanced against your rights. Where required for optional processing we obtain consent. The bases are KVKK Article 5 and, where applicable, GDPR Article 6. OAuth authorisation determines the provider account and data to which you grant technical access.

5. Google user data

Google sign-in provides your name, email, profile picture and account identifier to identify you and create a session. Signing in with Google alone does not grant Gmail or Drive content access. Connecting a separate Google app allows the following processing only within your permissions and the feature you use:

Gmail: message headers, sender/recipient details, message bodies, attachments and labels to search/read email, prepare drafts, send messages and manage labels.
Drive, Docs and Sheets: file identifiers, names, metadata, document contents and spreadsheet cells to find, read, create, edit or share files as authorised.
Calendar, Contacts, Forms and Tasks: events and attendees, contacts, form definitions/responses and tasks for the calendar, contact, form or task operation you select.
Other selectable Google tools: Google Ads campaign/performance information, BigQuery table/query data, YouTube channel/video information and authorised Workspace administration/group/Vault data, only when you connect that tool and request the operation within your account’s permissions.

We store connection credentials on the server to make API requests on your behalf. Results, messages, generated documents and action history may be stored in your workspace. If an AI feature you select requires Google content, only the data necessary for that feature is sent to the model provider you select as part of your request. Google data is not used to train general-purpose models.

6. Google API Limited Use commitment

Era’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use this data only to provide or improve prominent user-facing features. We do not sell it or use it for advertising, retargeting, creditworthiness or training general-purpose AI/ML models.

Transfers are limited to providing/improving user-facing features with your consent, security and abuse investigations, legal obligations or a business transfer with your prior explicit consent. Human access is limited to your affirmative agreement to view specific data, security needs, legal requirements or appropriately aggregated internal operations permitted by applicable rules.

7. Facebook, Instagram and WhatsApp data

When you connect a Meta account or business channel, we may process the authorised user/account identifier, public profile name and picture, identifiers of pages/Instagram professional accounts/WhatsApp Business accounts and phone numbers you manage, and access credentials. Messaging features also process incoming/outgoing message content, attachments, sender/recipient identifiers, timestamps and delivery information. These data associate the account, display conversations in your business inbox, send responses that you or an authorised workflow request, and maintain the connection. A publishing/reporting tool you select may use authorised posts and performance data for that operation. We do not sell this data or use it to create independent advertising profiles.

Remove Facebook/Instagram access in your account’s Apps and websites or Business integrations settings. For WhatsApp, use your business account’s connection/integration settings. Removing permission does not automatically erase conversations already stored in Era. Follow our data deletion instructions to request erasure.

People you authorise in your workspace can access records according to their permissions. Hosting/storage, communication and selected integration or AI providers process data as needed to provide the service. An operation you select may send data to an email recipient or another app. Our subprocessors page identifies infrastructure and provider categories. Processing may take place outside Türkiye; applicable transfers require the conditions and safeguards under KVKK Article 9 and, where applicable, GDPR Chapter V.

9. Security

We apply technical and organisational measures including HTTPS, account/role permissions, business access boundaries and action logs. Access to credentials is restricted to authorised operations. No system can guarantee absolute security. Protecting your account and connected-app permissions is also important.

10. Retention and deletion

Account and workspace data are kept as needed to provide the service. Disconnecting in Era’s Apps section deletes the authorisation record we hold for that connection; where supported, we also attempt provider-side revocation. You can separately remove access in the provider’s settings. Disconnecting is different from deleting previously stored business records and outputs.

We aim to complete an identity-verified deletion request within 30 days. Records legally required or necessary for legal claims are retained only within the relevant scope and period, explained in our response. Backup copies are removed through the normal backup rotation; a deletion request is reapplied if a restore is necessary. See Data deletion.

11. Your rights and requests

Under KVKK Article 11, you can ask whether data is processed, obtain information about purposes and recipients, request correction or erasure and notification to recipients, object to adverse results from exclusively automated analysis, and seek compensation for unlawful processing. Where GDPR applies, rights also include access, portability, restriction, objection, withdrawal of consent and a complaint to the competent supervisory authority, subject to the applicable conditions.

Write from your account email to erentokmakofficial@gmail.com or to the postal address above. Request information is used only to verify identity and handle your request. Do not send passwords, access tokens or a complete identity document. We respond to KVKK requests within 30 days.

12. Cookies, children and updates

See our cookie policy for browser storage. The service is intended for businesses, not directed at children. We communicate material data-use changes in the service or through your registered contact channel and seek new permission when required.

External website resources

The Quickesta website may load fonts and images from providers such as Google Fonts, Google, Simple Icons or DiceBear. When your browser loads these resources it sends IP and browser/request information to the relevant provider.