Draft, pending owner approval. Last updated 14 November 2026.
Privacy
This notice explains what personal data the Datarithms website collects today, why, on what legal basis, who receives it, where it is stored and for how long. Datarithms is operated by Pyramid Works LLC, a company in the United States ("we", "us"). It covers the website, the early-access form and invited accounts. It does not cover the Datarithms product, which is not available yet.
If you are in Türkiye, the separate KVKK notice (Aydınlatma Metni) gives the information required by Turkish law for the early-access form.
Who is responsible
| Controller | Pyramid Works LLC, a company in the United States |
| Privacy requests | privacy@datarithms.io |
| Representative in Türkiye / EU / UK | None appointed. |
What we collect
- Early-access requests. Your work email, your company name, the monthly ad spend range you chose, and whether you are a company or an agency.
- Accounts. Accounts are created by invitation only. For each account we store the email address, a one-way hash of the password (never the password itself), the account role, when the account was created and when it last signed in.
- Password setup links. A one-way hash of each single-use link, when it expires and whether it was used.
- Security records. Sign-in attempts (email, time, success or failure) and early-access form submissions (time only). With these we store a keyed one-way hash of your IP address, never the IP address itself.
- Server logs. The server and its reverse proxy may keep basic technical logs (time, requested page, response status and IP address) to run and secure the service. [Which logs are switched on is to be confirmed by the owner.]
We do not ask for sensitive data (such as health, religion or biometric data) and do not knowingly collect data from children. The site is meant for businesses and is not directed at anyone under 16.
Why we use it and our legal basis
| Purpose | Data | Legal basis (EU/UK GDPR) | Legal basis (KVKK Art. 5) |
|---|---|---|---|
| Reply to your early-access request and decide who to onboard | Early-access request | Steps you asked for before a contract (Art. 6(1)(b)); our legitimate interest in choosing early users (Art. 6(1)(f)) | Directly related to setting up a contract (5/2-c); legitimate interest (5/2-f) |
| Let invited users sign in and keep accounts working | Account, password setup links, session cookie | Contract (Art. 6(1)(b)) | Directly related to a contract (5/2-c) |
| Protect the site against abuse: sign-in lockout, form rate limit, incident review | Security records, server logs | Legitimate interest in keeping the service secure (Art. 6(1)(f)) | Legal obligation to keep data secure, Art. 12 (5/2-ç); legitimate interest (5/2-f) |
| Answer privacy requests and defend legal claims | Your request and our reply | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) | Legal obligation (5/2-ç); establishing, using or protecting a right (5/2-e) |
We do not rely on your consent for any of this, and we do not ask for it. We make no automated decisions about you. We do not sell personal data and do not share it for advertising.
Cookies
The site uses no analytics, no advertising cookies and no third-party pixels. It uses only cookies that are strictly necessary for sign-in, so it does not ask for cookie consent:
- a session cookie that keeps you signed in for up to 8 hours; it is set only when you sign in;
- two helper cookies set by the sign-in form: one protects the form against forged requests, one remembers the page to return to. Both are removed when you close the browser.
Visitors who do not sign in get no session cookie.
Who receives it
| Recipient | What it does | Country |
|---|---|---|
| Hivelocity (hosting) | Provides the rented server that runs the site and the database, and stores the data on our behalf. We manage the server with Coolify, self-hosted software on that server; Coolify is not a separate recipient. | United States |
| Cloudflare (domain) | Provides DNS for datarithms.io. [If Cloudflare's proxy is switched on, site traffic and IP addresses pass through Cloudflare; to be confirmed by the owner.] | United States |
| Cloudflare (email forwarding) | Cloudflare Email Routing receives the emails you send to privacy@datarithms.io and forwards them to our team's mailbox, acting as our processor. | United States |
| Public authorities and courts | Only where the law requires it. | The relevant country |
We use no other third parties for the data described here.
Where the data is stored
All data described here is stored on one server in the United States. If you are outside the US, your data leaves your country when you send it to us.
You send the data directly to us, a company in the US. The European Data Protection Board (Guidelines 05/2021) and the Turkish Personal Data Protection Authority (guide on transfers abroad, January 2025) both say that a controller abroad collecting data directly from you in this way is not a transfer by an exporter in your country. The data is then stored in the US on a server we rent from our hosting provider. [Whether a transfer tool such as standard contractual clauses is needed for the hosting provider under GDPR Chapter V or KVKK Article 9 is under legal review; to be confirmed by the owner.] We do not ask for your consent to storage in the US, and we do not rely on an adequacy decision for the US. We apply the same protections described on this page and on the Data handling page wherever you are.
How long we keep it
| Data | How long we keep it | Why this long |
|---|---|---|
| Early-access request (work email, company, monthly ad spend range, company or agency) | Deleted automatically 365 days (about 12 months) after we receive it, or earlier if you ask. | So we can reply to you while early access runs. |
| IP address hash on an early-access request | Removed from the request automatically after 30 days. | Only needed for short-term abuse review. |
| Form submission records (IP address hash, time) | Deleted automatically after 7 days. | The hourly submission limit needs one hour; the rest is for abuse review. |
| Sign-in attempt records (email, IP address hash, time, success or failure) | Deleted automatically after 30 days. | The lockout looks back 15 minutes; the rest is for reviewing security incidents. |
| Password setup links (stored only as a hash) | Stop working after 24 hours; deleted automatically 7 days after that. | A short time to explain why a used or expired link no longer works. |
| Account (email, password hash, role, created and last sign-in time) | While the account exists; deleted within 30 days after you ask or after the account is closed. | Needed for the account to work. |
| Session cookie | 8 hours in your browser; removed when you sign out. | Keeps you signed in. |
| Server logs (time, requested page, response status, IP address) | [up to 30 days; server setting to be confirmed by the owner] | To run the service and investigate attacks. |
| Privacy requests and our replies | 3 years after the request is closed. | To show that we answered on time. |
[If database backups are kept: deleted data leaves the backups within the backup retention period, to be confirmed by the owner.]
Your rights
Everyone. Whatever the law where you live, you can ask us to show you, correct or delete the personal data we hold about you. We do not charge for this.
EU, EEA and UK. You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest (GDPR Articles 15 to 21).
Türkiye (KVKK Article 11). You have the right:
- to learn whether your personal data is processed,
- if it is, to request information about it,
- to learn the purpose of processing and whether the data is used for that purpose,
- to know the third parties in Türkiye or abroad to whom it is transferred,
- to ask for correction if it is incomplete or wrong,
- to ask for deletion or destruction under the conditions of KVKK Article 7,
- to ask that correction, deletion or destruction be notified to third parties who received the data,
- to object to a result against you that comes only from automated analysis of your data,
- to claim compensation if you suffer damage because of unlawful processing.
United States. Depending on your state, privacy law may give you rights to know, access, correct and delete personal data and to opt out of its sale or use for targeted advertising. We do not sell personal data or use it for targeted advertising. We answer such requests whether or not a state law applies to us, and we do not treat you differently for using them.
How to make a request
Write to privacy@datarithms.io, if possible from the email address you used with us, and say what you would like. We may ask for information to confirm who you are before we act. We answer within 30 days. Under the GDPR we may extend this by up to two further months for complex requests, and we will tell you if we do.
If you are in Türkiye, the KVKK notice also lists the formal ways to apply under Turkish law (KVKK Article 13).
Complaints
Please write to us first so we can fix the problem. You can also complain to a regulator:
- Türkiye: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), kvkk.gov.tr, after applying to us: within 30 days of our answer, and in any case within 60 days of your application (KVKK Article 14).
- EU and EEA: the data protection authority of the country where you live or work, or where the problem happened (list of authorities).
- UK: the Information Commissioner's Office (ico.org.uk).
- United States: the attorney general or privacy agency of your state.
The product, later
When the Datarithms product is available to you, it will read data from your ad accounts and your payment or sales tools only after you authorise each connection. Access will be read-only. That data is used only to produce your reports and plans, is never sold, and is deleted on your request. We will update this notice before any of that starts.
Changes
If we change this notice, we update the date at the top. Material changes will be announced on this site.