Privacy Policy and KVKK Notice

1. Data controller

The owner and operator of this application (“Webdesiz” or “we”) is Birim Ajans Yazılım Limited Şirketi. Our company acts as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”). Contact: gizlilik@webdesiz.com.

2. Personal data we process

2.1 Data collected at sign-up

• Full name, email address, password (bcrypt hash; the raw value is never stored)
• Business name, tax number and tax office (for invoicing, optional)
• Phone number (optional, for notifications)

2.2 Data processed during the Meta integration

After you use the Connect with Facebook flow or the manual access token method, we receive and process the following data from Meta:

• Your Meta user ID, ad account IDs, account name, currency
• Ad access token (stored encrypted with AES-256-GCM)
• Campaign, ad set and ad IDs, names and statuses
• Ad performance metrics: impressions, clicks, conversions, spend, ROAS, CPM, CPC
• Form responses (only from forms you explicitly authorized)

2.3 Data collected automatically

• Sign-in time, IP address, browser information (security audit log)
• Application usage statistics (anonymous)

2.4 Content you give the ad assistant

• The messages you write to the ad assistant and the assistant’s actual replies
• The ad drafts you create and record IDs of the images in your account

3. Purposes of processing

• Providing the service: running the ads management panel, producing reports
• AI-assisted ad copy and image generation (anonymous prompts are sent to OpenAI)
• Serving your ad assistant history securely in your account and across your devices
• Running automation rules (defined by the user)
• Billing and subscription management (through Stripe)
• Security, fraud prevention, error tracking
• Compliance with legal obligations (KVKK, tax legislation)

4. Legal basis of processing

• Establishment and performance of a contract (KVKK art. 5/2-c)
• Fulfilment of legal obligations (KVKK art. 5/2-ç)
• Legitimate interest (KVKK art. 5/2-f), security, product improvement
• Explicit consent (KVKK art. 5/1), marketing communication, AI text and image generation

5. Data transfers: third parties

To provide the service, data is transferred in the following processes:

• Meta Platforms, Inc. (Facebook/Instagram), to access ad accounts, only within the scopes you authorized
• OpenAI, Inc., for AI text and image generation (prompts are anonymous and contain no personal data)
• Stripe, Inc., subscription and billing (card details are stored at Stripe and are not passed to us)
• Resend, sending transactional emails (sign-up confirmation, password reset)
• DigitalOcean / Cloudflare, hosting and content delivery
• Google Ireland Limited, Google Analytics 4 for visitor measurement; details on the Cookie Policy page

Your data is never sold or shared for advertising purposes under any circumstances.

6. Retention period

• As long as the account is active
• After account deletion: completely destroyed within 30 days (except where a legal retention obligation applies)
• Audit logs: 2 years (the period required by KVKK security requirements)
• Ad assistant conversations: until the account is active or until you delete the conversation from the panel
• Invoices and financial records: 10 years (the period required by tax legislation)

7. Your rights under KVKK Article 11

You have the following rights and can exercise them through the application or by email:

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether your data is used in line with that purpose
• To request correction of incomplete or incorrect data, Settings → Profile
• To request deletion or destruction of your data, Data Deletion Request
• To download your data in a machine-readable format, Settings → Security → Download my data
• To request restriction of processing
• To object to decisions made by automated systems, for example automation rules
• To claim compensation if you suffer damage due to unlawful processing of your data

8. Security measures

• All connections are established over HTTPS / TLS 1.2+
• The database is encrypted at rest; AES-256-GCM is used for Meta access tokens
• bcrypt is used for passwords (cost factor 12)
• JWT refresh token rotation and reuse detection
• Regular security audits and dependency updates
• Access control: role-based authorization (RBAC)

9. Use of cookies

We use strictly necessary cookies: sign-in, CSRF protection and preference settings. In addition, to see visitor counts and which pages are read we use Google Analytics 4, which leaves _ga cookies in your browser. We do not use advertising tracking pixels. What each cookie does, how long it stays and how to switch it off is listed item by item on the Cookie Policy page.

10. Contact

To exercise your rights under KVKK or for privacy questions: gizlilik@webdesiz.com