Privacy Policy and KVKK Notice

1. Data controller

The owner and operator of this application (“Webdesiz” or “we”) is Birim Ajans Yazılım Limited Şirketi. Our company acts as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”). Contact: gizlilik@webdesiz.com.

2. Personal data we process

2.1 Data collected at sign-up

• Full name, email address, password (bcrypt hash; the raw value is never stored)
• Business name, tax number and tax office (for invoicing, optional)
• Phone number (optional, for notifications)

2.2 Data processed during the Meta integration

After you use the Connect with Facebook flow or the manual access token method, we receive and process the following data from Meta:

• Your Meta user ID, ad account IDs, account name, currency
• Ad access token (stored encrypted with AES-256-GCM)
• Campaign, ad set and ad IDs, names and statuses
• Ad performance metrics: impressions, clicks, conversions, spend, ROAS, CPM, CPC
• Form responses (only from forms you explicitly authorized)

2.3 Data collected automatically

• Sign-in time, IP address, browser information (security audit log)
• Application usage statistics (anonymous)
• Meta pixel, to measure Webdesiz’s own ads: which event happened (page view, completed registration, payment), the page address with its query part and IDs removed, the _fbp/_fbc cookie values, and the amount and currency for a payment. Details in section 9 below.

2.4 Content you give the ad assistant

• The messages you write to the ad assistant and the assistant’s actual replies
• The ad drafts you create and record IDs of the images in your account

3. Purposes of processing

• Providing the service: running the ads management panel, producing reports
• AI-assisted ad copy and image generation (anonymous prompts are sent to OpenAI)
• Serving your ad assistant history securely in your account and across your devices
• Running automation rules (defined by the user)
• Billing and subscription management (through Stripe)
• Measuring the results of Webdesiz’s own Facebook and Instagram ads (Meta pixel)
• Security, fraud prevention, error tracking
• Compliance with legal obligations (KVKK, tax legislation)

4. Legal basis of processing

• Establishment and performance of a contract (KVKK art. 5/2-c)
• Fulfilment of legal obligations (KVKK art. 5/2-ç)
• Legitimate interest (KVKK art. 5/2-f), security, product improvement
• Explicit consent (KVKK art. 5/1), marketing communication, AI text and image generation

5. Data transfers: third parties

To provide the service, data is transferred in the following processes:

• Meta Platforms, Inc. (Facebook/Instagram), to access ad accounts, only within the scopes you authorized
• OpenAI, Inc., for AI text and image generation (prompts are anonymous and contain no personal data)
• Stripe, Inc., subscription and billing (card details are stored at Stripe and are not passed to us)
• Resend, sending transactional emails (sign-up confirmation, password reset)
• DigitalOcean / Cloudflare, hosting and content delivery
• Google Ireland Limited, Google Analytics 4 for visitor measurement; details on the Cookie Policy page
• Meta Platforms Ireland Limited, Meta pixel for measuring Webdesiz’s own ads; what is sent is described in section 9 and on the Cookie Policy page

Measurement data sent to Google and Meta is transferred abroad: these companies may process it on servers in Ireland and in other countries, including the USA.

Your data is never sold under any circumstances. The only advertising-related sharing is the limited Meta pixel data described in section 9; your email address, name and phone number are not sent to Meta.

6. Retention period

• As long as the account is active
• After account deletion: completely destroyed within 30 days (except where a legal retention obligation applies)
• Audit logs: 2 years (the period required by KVKK security requirements)
• Ad assistant conversations: until the account is active or until you delete the conversation from the panel
• Invoices and financial records: 10 years (the period required by tax legislation)

7. Your rights under KVKK Article 11

You have the following rights and can exercise them through the application or by email:

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether your data is used in line with that purpose
• To request correction of incomplete or incorrect data, Settings → Profile
• To request deletion or destruction of your data, Data Deletion Request
• To download your data in a machine-readable format, Settings → Security → Download my data
• To request restriction of processing
• To object to decisions made by automated systems, for example automation rules
• To claim compensation if you suffer damage due to unlawful processing of your data

8. Security measures

• All connections are established over HTTPS / TLS 1.2+
• The database is encrypted at rest; AES-256-GCM is used for Meta access tokens
• bcrypt is used for passwords (cost factor 12)
• JWT refresh token rotation and reuse detection
• Regular security audits and dependency updates
• Access control: role-based authorization (RBAC)

9. Use of cookies

We use strictly necessary cookies: sign-in, CSRF protection and preference settings. In addition, to see visitor counts and which pages are read we use Google Analytics 4, which leaves _ga cookies in your browser.

To see whether our own Facebook and Instagram ads work we use a Meta pixel. We do not load Meta’s ready-made script (fbevents.js); your browser sends only the following to facebook.com/tr: the event name (page view, completed registration, payment), the page address with its query part and IDs removed, the page you came from shortened the same way (only the site name if you came from another site), the time, a random event number, the _fbp cookie and, if you arrived by clicking a Meta ad, the _fbc cookie. For a payment the amount and currency are added. Your email address, name, phone number, the page title and your account or invoice numbers are not sent. By the nature of the request your browser also sends your IP address and Meta’s own (facebook.com) cookies. On pages whose address carries a secret value, such as password reset, the pixel does not run at all; on the panel pages after sign-in no page view is sent, only the payment event when a payment is completed. Meta may use this data to measure the results of our ads and to show our ads.

What each cookie does, how long it stays and how to switch it off is listed item by item on the Cookie Policy page.

10. Contact

To exercise your rights under KVKK or for privacy questions: gizlilik@webdesiz.com