Privacy Policy

1. Data we collect

Account data: name, email, phone, company and billing details.

Usage data: session logs, IP address, browser info, in-Platform activity.

Connection data: operational data pulled, only within the scopes you authorize, from third-party accounts you connect — ad account and campaign performance (Meta Ads, Google Ads, TikTok Ads), profile, post and comment data (Instagram, TikTok), the content of direct messages received by and sent from your Instagram account together with the sender's platform id and username (Instagram), store, product and order data (Shopify, Trendyol), search performance and page speed data (Google Search Console, PageSpeed, Google Analytics 4).

Communication data: messages you write in the in-Platform chat and attachments you upload.

Brand assets: logos, product imagery and other content you upload for creative production.

2. Purposes

Delivering the service (ad management, content production and publishing, e-commerce sync, reporting), improving it, securing accounts, billing, meeting legal obligations, and — with your consent — marketing communication.

Data obtained from third-party platforms is used only to provide the corresponding Platform feature to you; it is never used for other purposes, sold, or transferred to third parties for advertising.

Data received from Google APIs is used in compliance with the Google API Services User Data Policy, including its Limited Use requirements.

3. Third-party integrations

You connect your accounts through official OAuth flows; your passwords are never transmitted to us. Access tokens are stored encrypted with AES-256.

Connectable services: Meta (Instagram, Meta ad accounts), Google (Analytics/GA4, Search Console, Google Ads), TikTok (organic account and ads account), Shopify and Trendyol.

You can disconnect at any time from the Platform or from the relevant platform’s security/app settings; on disconnection the access tokens are deleted.

4. Sub-processors and service providers

Hosting: infrastructure we manage ourselves on Hetzner Online GmbH (Germany) servers. Images are stored in file storage on servers we operate.

AI model providers: text and image generation run through OpenRouter. Requests to these providers never carry your brand identity, and API terms that exclude use of your data for model training apply.

Other services: Kulak.io for competitor and sector intelligence, and Resend for notification emails.

Data processing agreements and contractual safeguards apply to all sub-processors. We may disclose data to authorities where legally required.

5. Isolation and security

Each brand's data is isolated with database-level row-level security (RLS); no customer can access another customer's data under any circumstances.

Transport is TLS-encrypted; access tokens are encrypted with AES-256-GCM. Access is limited by role-based authorization and audit logs.

Sector-insight sharing only uses data that passed an anonymization gate (PII stripping + generalization + k-anonymity); no insight can be traced back to its source.

6. Retention and deletion

Data is kept for the duration of your membership and statutory retention periods, then deleted or anonymized.

Instagram direct messages are kept so we can reply to them and show the conversation history in your panel; message content is deleted when you disconnect Instagram or request deletion. Message content is never used to train AI models and is never sold to third parties.

Send account closure or data deletion requests to [email protected], or follow the steps on our Data Deletion Instructions page; requests are completed within 30 days.

7. International transfers

Because AI providers and some connected platforms are located abroad, data may be transferred internationally with safeguards compliant with KVKK art. 9 (standard contractual measures, explicit consent, or mechanisms approved by the Turkish DPA).

8. Your rights

You may access, correct, delete, object to processing, and port your data. Write to [email protected]; requests are answered free of charge within 30 days.