Glossary
CRM, privacy and AI terms
41 terms you meet when running customers, invoices, consent and AI in one place.
- Açık rıza (explicit consent)
- Under KVKK, consent given freely, for a specific matter and on an informed basis. Needed when no other legal ground applies — for example most marketing messages and non-essential cookies. More →
- Agent autonomy
- How far an AI agent may go on its own: propose and wait for confirmation, act at once, or send the action for approval. In Pexpy it is set per action. More →
- AI agent
- An AI that carries out tasks inside business systems — updating records, booking meetings — rather than only answering questions. More →
- API key
- A secret that lets another system read or write a workspace’s data through the public API, limited to what the key allows.
- Audit log
- A record of who did what and when, kept so that changes can be checked later. In Pexpy it cannot be edited.
- Aydınlatma metni (privacy notice)
- The notice KVKK requires at the time data is collected: who the controller is, why the data is processed, the legal ground, who receives it and the person’s rights.
- Consent Management Platform (CMP)
- Software that shows a cookie banner, records each visitor’s choice and makes sure tags run only for the categories allowed. More →
- CRM
- Customer relationship management: one place for contacts, companies, deals and every interaction with them. More →
- Customer portal
- A signed-in area where customers see their invoices, quotes, orders and tickets, and pay or reply without e-mailing.
- Data controller
- The organisation that decides why and how personal data is processed, and answers for it.
- Data processor
- An organisation that processes personal data on a controller’s behalf and instructions — a SaaS provider, for example.
- Data processing agreement (DPA)
- The contract between a controller and a processor that sets the rules for the processing (GDPR Art. 28).
- Data subject access request (DSAR)
- A person’s request to see, copy, correct or delete the personal data an organisation holds about them. More →
- Deal stage
- Where a sales opportunity stands — lead, qualified, proposal, negotiation, won or lost.
- DPIA
- Data protection impact assessment: an assessment of the risks of a new processing activity before it starts, required by GDPR for high-risk processing.
- Dunning
- The sequence of reminders sent for an unpaid invoice. More →
- Field-level security
- Access rules that hide or lock single fields — a deal value, a phone number — for some roles.
- Global Privacy Control (GPC)
- A browser signal by which a visitor opts out of the sale or sharing of their data. Several US states require sites to honour it. More →
- Google Consent Mode v2
- The way a site tells Google tags what the visitor allowed (ad_storage, analytics_storage, ad_user_data, ad_personalization). Required by Google for ad measurement in the EEA. More →
- Grounded AI
- An AI that answers from a business’s own data and documents and cites them, instead of from general knowledge alone.
- Guardrail
- A limit an automation or AI agent cannot pass: a kill switch, a daily cap, a value ceiling.
- İYS (İleti Yönetim Sistemi)
- Türkiye’s message management system: commercial e-mails, SMS and calls may go only to recipients whose approval is recorded there.
- Lead
- A person or company that has shown interest but is not yet qualified as a sales opportunity.
- Legitimate interest
- A legal ground for processing when the organisation’s interest is not overridden by the person’s rights — it requires a balancing test and cannot be used for everything.
- MCP (Model Context Protocol)
- An open protocol through which AI tools such as Claude or Cursor connect to other systems. Pexpy offers an MCP server.
- Multi-tenant workspace
- Separate workspaces on one platform, each with its own data, users and settings — one per client for an agency. More →
- Opt-in / opt-out
- Opt-in: nothing happens until the person agrees (EU, UK, Türkiye for cookies and marketing). Opt-out: allowed until the person objects (most US state laws).
- Personal data breach
- A security incident that leads to personal data being lost, disclosed or changed without authorisation. GDPR and KVKK both expect notification within 72 hours. More →
- Pipeline
- The set of open deals arranged by stage, with their values — a view of the sales still to close.
- Pseudonymisation
- Replacing identifying details so that data can no longer be tied to a person without extra information kept apart.
- Record of processing activities (RoPA)
- The written inventory of what personal data an organisation processes, why, for whom and for how long (GDPR Art. 30; KVKK’s inventory for VERBİS).
- Retention period
- How long a category of data is kept before it is deleted or anonymised.
- Role-based access control
- Giving people access according to their role, so each sees and changes only what their job needs.
- Server-side tagging
- Sending analytics and ad events through your own server instead of from the browser — it still has to respect the visitor’s consent.
- Standard contractual clauses
- Contract terms approved by a regulator that allow personal data to be transferred to another country. KVKK has its own since 2024. More →
- Tag manager
- A tool (such as Google Tag Manager) that loads analytics and ad tags on a site without changing its code each time.
- Two-factor authentication
- Signing in with a second proof — a code from an app — on top of the password.
- VERBİS
- Türkiye’s data controllers’ registry. Controllers above the thresholds set by the Board must register their processing there. More →
- Webhook
- A message one system sends another the moment something happens — an invoice paid, a deal won.
- White-label
- Showing a product under your own brand — your logo, colours and domain — instead of the vendor’s. More →
See it on your own data
A trial workspace comes with every module, the copilot and the website assistant.