Privacy Policy
Last updated: September 2026
1. Overview
This Privacy Policy describes how ASA TECH YAZILIM TICARET LIMITED ŞİRKETİ ("we", "us", "our"), operating under the trading name ASA Speech Pro, collects, uses and protects personal data when you create an account, subscribe to the service, use our desktop applications, use our browser extensions, or visit this website. Our browser extensions are separate products with their own functionality and are described individually below.
2. Payment provider
Card payments for subscriptions and one-time purchases are processed by iyzico, a licensed electronic payment institution. We do not store full payment card numbers or CVC/CVV codes on our systems; iyzico processes and secures your card information directly. Where you use the optional card-storage function for renewals, we store only the card identifiers/tokens issued to us by iyzico together with limited card metadata required to operate the service; these tokens cannot be used to reconstruct your card number. Our AI providers (used for speech recognition, translation and OCR) may change over time as we evaluate performance and cost, so this policy refers to them generically as "third-party AI providers" rather than naming a specific one.
3. Account information
When you create an account we process your name, email address and the date your account was created, in order to provide and secure access to the service. Authentication credentials are handled through our authentication infrastructure; ASA does not store your plain-text password, and your password is not visible to us.
4. Subscription information
When you subscribe to a plan we process the plan you selected, the status of your subscription, its renewal date, and any changes to it. This information is required to grant and manage access to paid features.
5. Billing information
We retain billing metadata such as invoice number, plan or product purchased, net amount, tax amount, gross amount, currency, tax status, tax country and payment status in order to issue invoices and comply with tax and accounting law. Full card numbers and CVC/CVV codes are never stored on our systems.
5a. Billing and tax data we process
Depending on the transaction, we process: customer type (individual or business), billing country, billing address (street, postal code, city), customer name, company name where applicable, telephone number, tax or VAT identification information where applicable, and the country derived from the IP address used at checkout ("IP country"). For this tax-evidence purpose we store only the two-letter country code — we do not keep your full IP address in the invoice record. Purposes: performance of the contract, billing and invoicing, determination of the applicable tax jurisdiction, tax compliance, payment processing, and account and security purposes.
5b. How the applicable tax is determined
Our own servers determine the applicable tax country and tax case, calculate the net amount, calculate the applicable tax and calculate the gross amount payable. iyzico then processes the resulting payable gross amount as our payment provider. iyzico is our payment provider, not our tax engine, and does not determine or calculate your tax. The tax country is derived primarily from your billing country, supported where available by the country associated with the payment, with the IP country used only as an additional, weaker indication for tax compliance purposes. A deviation of the IP country alone does not by itself determine the tax outcome.
5c. Legal bases, recipients and retention for billing data
Legal bases: performance of the contract with you (Art. 6(1)(b) GDPR; corresponding grounds under KVKK Art. 5), compliance with our legal obligations under tax, accounting and consumer protection law (Art. 6(1)(c) GDPR), and our legitimate interests in preventing fraud and abuse (Art. 6(1)(f) GDPR). Recipient categories: our payment provider iyzico (payment execution and fraud prevention), our cloud hosting and database provider (technical operation), our email delivery provider (transactional messages such as invoices and account notices), and our accountants and the competent tax authorities where we are legally required to report. Retention: invoices and the underlying billing and tax records are retained for the statutory retention periods applicable in Türkiye and, where relevant, in your country; other billing metadata is kept for as long as your account exists and afterwards only as long as needed for legal claims and statutory retention. We do not sell your data and do not use it for advertising.
5d. Your rights and complaints
Subject to applicable law you may request access to, correction of, a copy of, restriction of, or deletion of your personal data, and object to certain processing; statutory retention obligations may prevent deletion of invoice records before the retention period ends. You may also lodge a complaint with a competent supervisory authority — in the EU/EEA with the data protection authority of your place of residence, and in Türkiye with the Personal Data Protection Authority (KVKK / KVKK Kurumu). Requests can be sent to info@asapeechpro.com.
6. Login information
For each sign-in we may process the timestamp, IP address, user agent, and outcome of the attempt in order to protect your account against unauthorized access and to investigate suspicious activity.
7. Device information
The desktop application may transmit non-identifying device information such as operating system, application version, locale and hardware class. This is used to deliver the correct build, ensure compatibility and diagnose issues.
8. Usage analytics
We collect aggregated, non-identifying usage statistics such as feature usage counts and monthly consumption of included allowances. This is used to operate the service, enforce plan limits and improve the product.
9. Cookies
This website uses a small number of cookies for authentication, security and analytics. See our Cookie Policy for details and management options.
10. Crash reports
If the desktop application encounters an unexpected error, it may send an automatic crash report containing a stack trace, application version and non-identifying environment information so that we can diagnose and fix the issue.
11. API requests
Each request to our backend is logged with a timestamp, endpoint, response status, latency, and account identifier where applicable. These logs are used to operate the service, prevent abuse and troubleshoot problems.
12. Speech, translation and OCR data
Audio submitted to the speech-to-text feature, text submitted to the translation feature, and images submitted to the OCR feature are processed only to provide the requested result. We do not retain your source audio, source text, source images or generated output any longer than is strictly necessary to deliver the result and, where applicable, to safeguard the service against abuse.
13. Confidentiality of your content
Audio, text and images you submit to the speech-to-text, translation and OCR features are treated as confidential. This content is processed solely to provide the requested result, is not disclosed to any third party except the third-party AI providers strictly required to deliver the feature, and is accessed by our personnel only where necessary for security, abuse prevention or troubleshooting.
14. No training on customer content
We do not use your account content, speech, translations, OCR input or generated output to train, fine-tune or improve our own AI models. Where we rely on third-party AI providers to deliver features, we work only with providers that contractually agree not to use your content to train their models.
15. Third-party AI providers
For features where we ourselves send data to a contracted service provider — in particular the speech-to-text, translation and OCR features of our desktop products — we transmit the necessary input to third-party AI providers. These providers act as processors on our behalf under written agreements and are not permitted to use your content to train their own models. This does not apply to speech recognition that is supplied by your own browser or operating platform: in that case the processing of microphone audio by the browser/platform provider is governed by that provider's applicable terms and privacy practices, we neither control nor make representations about that processing, and ASA TECH does not receive or store the raw microphone recording on its own backend.
16. Third-party payment providers
Payment execution and payment fraud prevention are handled by our payment provider iyzico, acting as an independent controller and/or processor for those purposes. The determination of the applicable tax country, the calculation of the tax and the issuing of invoices are carried out by ASA on its own systems, as described in sections 5a to 5c; iyzico receives the resulting payable gross amount.
17. Data retention
Account, subscription and billing records are retained for as long as your account is active and afterwards for the period required by applicable tax, accounting and consumer protection law. Operational logs are retained for a shorter period sufficient for security and troubleshooting purposes.
18. Your rights
Subject to applicable law, including the EU General Data Protection Regulation (GDPR) and Turkish Law No. 6698 on the Protection of Personal Data (KVKK), you have the right to access, correct, export, restrict processing of, and delete your personal data, and to object to certain processing. You may exercise these rights by contacting info@asapeechpro.com.
19. International transfers
Where personal data is transferred outside your jurisdiction, we rely on appropriate legal safeguards such as standard contractual clauses with our processors.
20. ASA Speech Pro – Text Bridge browser extension
Our optional "ASA Speech Pro - Text Bridge" browser extension works only when the ASA Speech Pro desktop application is installed and running on your computer. It does not transmit any data to our servers or to any third party, and it does not permanently store page content. When you actively press Ctrl+Alt+C, the extension reads the text you have selected or hovered over on a webpage — including text in chat messages — and sends it exclusively to the ASA Speech Pro application on your own computer via a local connection (127.0.0.1). The Direct-Bridge feature inserts translated or transcribed text into the same webpage in the same way: the result is produced locally by the desktop app and written into the page without leaving your device. To determine which element on the page you are hovering over, the extension continuously tracks your mouse cursor position within the browser tab; this position data is used only in the moment you press Ctrl+Alt+C and is never transmitted anywhere, stored, or sent to our servers. Occasionally the extension reports only the hostname of the currently active website (for example "example.com") to the local app, never the full URL, never a browsing history and never timestamps. This is used so the app can remember on which sites automatic insertion works reliably. The extension performs no action without the desktop application installed and running.
21. ASA Speech Recognition browser extension — purpose
Our separate "ASA Speech Recognition" browser extension is an independent product with its own account entitlement, free trial and subscription. It is not the same product as the ASA Speech Pro – Text Bridge extension described above and does not require the ASA Speech Pro desktop application. Its purpose is to let you dictate text by voice and insert the recognized text into text fields and other editable areas on websites.
22. ASA Speech Recognition — microphone and speech recognition
Microphone access is used when you activate speech recognition in the extension. The extension is not designed to keep the microphone recording continuously while speech recognition is not active. Speech recognition itself is provided through speech-recognition functionality made available by your browser or platform. Depending on the browser or platform you use, the microphone audio required for speech recognition may be processed by the browser/platform provider or its underlying speech-recognition service; such processing is governed by that provider's applicable terms and privacy practices, which we do not control. ASA TECH does not store raw microphone recordings on its own licensing or backend infrastructure. ASA TECH does not use ASA Speech Recognition microphone recordings or dictated transcripts to train its own AI models.
23. ASA Speech Recognition — recognized text and website interaction
Recognized text is inserted into the webpage and editable element that you have chosen. To provide this dictate-anywhere functionality, the extension's content script accesses editable elements of the page you are working in, only to the extent necessary to place the recognized text where you asked for it. Our licensing and backend service does not receive or store dictated transcripts in order to validate your licence: licence, trial and device-session checks are carried out without transmitting your dictated text or page content to us. ASA TECH does not use this information for behavioural advertising, does not sell dictated text or webpage content, and does not create or sell browsing-history profiles through ASA Speech Recognition.
23a. ASA Speech Recognition — optional Smart Correction (grammar and punctuation)
Smart Correction ("Grammar & punctuation") is an optional feature that is switched off unless you enable it. When it is enabled, the dictated text, together with the text version already processed locally by the extension and the language you selected, may be transmitted over HTTPS to the ASA backend in order to provide the grammar and punctuation correction you requested. Where a contracted third-party AI provider is used for this correction, that provider may process the data solely to deliver this feature; it is not permitted to use it to train its own models. The text is never used for advertising, profiling, or the training of our own or any third party's models. This server-side transmission happens only for this optional correction feature. It is not part of the normal licence, trial or device-session check: those checks are performed without transmitting your dictated text. If Smart Correction is switched off, no text is sent to the backend or to any AI provider for this purpose, and if the correction cannot be delivered the extension simply uses the locally produced text.
23b. ASA Speech Recognition — processing that stays on your device
The following processing takes place locally in your browser and is not transmitted to ASA: (a) Mouse position: the extension follows the position of your mouse pointer inside the tab so that the recording/status indicator can be displayed near the cursor. These coordinates are not sent to ASA and are not stored permanently. (b) Site profiles: only if you explicitly enable "remember settings for this website", the hostname of that website is stored together with the corresponding insertion/typing settings in your browser's extension storage (chrome.storage). No full URL is stored and no general browsing history is created from it. (c) Internal ASA copy/paste: text you select for the extension's own copy/paste function may be stored temporarily in chrome.storage.session. It remains on your device and is discarded when the browser session ends. (d) "Learn from my corrections": if you enable this option, the extension observes only the input field concerned, for a short period after an ASA insertion. If a small word-level correction is detected, only the corresponding word pair is stored/processed — never the full page or chat content. The feature is inactive unless you enable it. (e) Undo/Repeat: text recently inserted by ASA may be held briefly in the memory of the page you are working in so that you can undo or repeat an insertion. This history is not transmitted to the backend.
24. ASA Speech Recognition — account and authentication
ASA Speech Recognition requires an ASA account. The extension communicates over HTTPS with our authentication and backend infrastructure to sign you in, refresh authentication tokens, determine trial status, determine subscription and licence status, register and validate your device session, protect your account, and sign you out. The account information involved can include your email address, your account/user identifier, authentication and session tokens, and your licence or trial status. Password authentication is handled through our authentication provider; our current authentication provider is Supabase. Your password is used only to authenticate your sign-in request and is not retained by the extension after authentication. Google Sign-In is available as an optional alternative to email and password. It uses Google OAuth together with our authentication infrastructure (currently Supabase), and the extension performs this sign-in through the Chrome extension identity API chrome.identity.launchWebAuthFlow(). Only the account information required for sign-in and for your ASA account is processed, in particular your email address, your ASA/authentication user identifier and the authentication/session tokens generated from the sign-in. ASA Speech Recognition does not request access to Gmail, Google Drive, Google Contacts or any other content of your Google account. Google and our authentication provider receive only the data necessary to perform the login. If you already have an ASA account with the same Google-verified email address, Google Sign-In keeps you on the same user identifier together with your existing licence, trial and subscription.
25. ASA Speech Recognition — device-session protection
To prevent account sharing, ASA Speech Recognition permits one active extension device session per account. The extension generates and keeps a persistent, randomly generated installation identifier (install_id) which identifies the extension installation for licensing and security purposes. This identifier is randomly generated; it is not a hardware fingerprint, and we do not use a hardware fingerprint for this device-session system. The licence is not bound to an IP address. A separate random device-session token is issued for the active session, and our backend stores only a SHA-256 hash of that token, never the token itself. If another device is already active, a second device is not activated automatically; you can explicitly choose to use the new device instead, in which case the previously active device session is revoked immediately. There is no takeover waiting period.
26. ASA Speech Recognition — local extension storage
The extension may store locally in your browser's extension storage: the authentication and session information required to keep you signed in, the randomly generated install_id, the ASA Speech Recognition device-session token, and your extension preferences and settings. This information is used only to operate, authenticate and secure the extension and to manage licensing and device sessions.
26a. ASA Speech Recognition — retention of extension data
Retention of the data held by the extension follows its purpose: the access token is kept in session storage only, in line with the current implementation; the refresh token and the email address used to sign in are kept in the extension's local storage for as long as they are required to keep you signed in; the randomly generated install_id remains locally until the extension data is cleared or the extension is uninstalled; device-session data is kept for as long as it is required for the active device session; website profiles and your personal corrections are stored locally until you remove them or clear the extension data; and the internal ASA clipboard content exists only for the duration of the browser session.
27. ASA Speech Recognition — no sale of data and no advertising
ASA TECH does not sell data collected or processed by ASA Speech Recognition and does not use extension data for personalised, interest-based or retargeted advertising.
28. ASA Speech Recognition — limited use
Information obtained through the ASA Speech Recognition extension is used only to provide, secure and maintain the extension's user-facing speech dictation, authentication, licensing and device-session functionality, that is, only for the functions you expect from ASA Speech Recognition. We do not use or transfer extension user data for purposes unrelated to these functions. We do not use extension data for personalised advertising, we do not sell user data, and we do not transfer user data to data brokers. Human access to the related user data occurs only with your explicit consent for support you have requested, for security purposes and the prevention of fraud or abuse, or where required by law, in each case only where permitted by applicable law. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
29. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced in the application or by email before they take effect.
30. Contact
Questions about this Privacy Policy can be sent to info@asapeechpro.com.