Privacy Policy

This Privacy Policy explains how Ajansify collects, uses, shares and protects personal data when you visit our websites, create an account or use our service. It applies to everyone, wherever they are. Section 19 adds information for specific countries and regions. If you are in Türkiye, please also read our KVKK Privacy Notice.

1. Who we are

Ajansify is a subscription web service that helps brand owners create social media content with artificial intelligence (AI). The service is available at https://ajansify.app. Our promotional website is ajansify.ai.

The service is provided by Ajansify, a company established in Türkiye ("Ajansify", "we", "us").

We have no company or other establishment outside Türkiye. Section 19.2 explains how to reach us from the EU and the UK.

2. Our role: controller and processor

• Controller. We decide how and why personal data is processed for your account, sign-in and security, subscription, payments and invoicing, our communications with you, marketing, cookies, and the operation of our websites and service. This policy covers that processing.
• Processor. The content you upload or create in Ajansify may include personal data of other people, such as your customers, people in your photos and videos, reviewers on your Google Business Profile or your team members. We process this customer content only on your behalf and on your instructions. For that data you (or your organisation) are the controller, and our Data Processing Agreement applies. If your data appears in a business's content and you have a question, please contact that business. We will help them respond.

3. The personal data we process

Sensitive data. We do not knowingly process special categories of personal data, such as health data, religious beliefs or biometric data used to identify a person. Please do not upload such data; see our AI & Acceptable Use Policy. If you use your own face or voice in talking-video, avatar or voice-over features, we process it only for that purpose and only with your explicit consent. We ask for it the first time you use such a feature, and you can withdraw it at any time in the app under Settings → Privacy. We never use faces or voices to identify anyone.

Required data. To create an account and start a subscription we need your name, e-mail address, password, payment card and billing information. Without them we cannot provide the service. Other information is optional unless a feature you choose needs it.

4. Where we get personal data

• From you: when you register, complete your brand profile, upload files, use the editor, contact support or reply to our messages.
• Automatically: from server logs, the device identifier, your IP address, browser information and local storage (see the Cookie Policy).
• From services you connect: publishing tools (social account names, publishing results, performance metrics), cloud storage (the files you select) and Google Business Profile (reviewer names and reviews).
• From public sources: when you ask us to scan your brand's website, we read its publicly available content. Audience research and trend features use AI web search over public sources.
• From others: the payment institution (payment status, card reference, masked card number), the account owner who invites you to a team, or the person whose invitation link you used.

5. Why we use personal data and our legal bases

• If you are in the EU/EEA or the UK and a legal obligation arises only under Turkish law, we rely on our legitimate interest in complying with the laws that apply to us.
• Our legitimate interests are: keeping accounts and the service secure, preventing fraud and misuse of free trials, understanding in aggregate how the service is used so we can improve it, and protecting our legal rights. You can object (section 12).
• We never rely on legitimate interest for marketing. Marketing always requires your consent.

6. AI processing

Ajansify uses AI models from third-party providers to create the content you request. The current providers are listed on our Service Providers & Sub-processors page.

• What we send. Depending on the feature: your prompts and choices, your brand information (for example products, prices, target audience and tone of voice), the files and images you choose to use, public content from your website, text to be voiced, and earlier drafts when you ask for a revision. Your own face and voice are sent only if you use those features.
• No training. We do not use your content to train our own AI models. We use the providers' business (API) services, and we do not allow providers to use your data to train their general models.
• Provider retention. Under their own terms, providers may keep inputs and outputs for a limited time, for example to detect abuse.
• Logs. We keep the prompts and outputs of AI jobs in our server logs for up to 1 year, to fix errors and prevent misuse. Only authorised staff can access them.
• Taste profile. We learn your preferences for each brand from your approvals, rejections and revisions, so that future suggestions suit you better. It is used only for your account.
• Accuracy. AI output can be wrong, can resemble existing content, or can infringe other people's rights. Always check content before you publish it; you are responsible for what you publish. Our AI & Acceptable Use Policy sets out the rules, including when AI content must be labelled.

7. Cloud storage, Google and other connected services

You can connect Google Drive, Dropbox, Microsoft OneDrive and Box to Ajansify.

• Reading. We read only the files you select, so you can use them in Ajansify. We do not keep copies of your selected files.
• Writing. Only when you press the save button, we save a file you created in Ajansify to an "Ajansify" folder in your own cloud storage. The temporary copy on our server is deleted when the job finishes. Nothing is uploaded automatically.
• Permissions we request:
  • Google Drive: only drive.file (files you select and files Ajansify creates).
  • Dropbox: files.metadata.read, files.metadata.write, files.content.read, files.content.write and the required account_info.read.
  • OneDrive: Files.ReadWrite and offline_access.
  • Box: root_readwrite.
• What we do not do. We do not request permission to permanently delete files, share files or change account settings. We never delete files in your cloud storage.
• What we store. Access keys are stored encrypted. For each file we save, we keep the cloud file ID, name, size and a SHA-256 hash, so we do not create duplicate copies.
• Limits on use. We do not use this data for advertising or to train AI models, and we do not sell it. We pass it on only when needed for a feature you use (for example, a selected image you use in an AI job goes to the AI provider doing that job), for security, or when the law requires. Our staff do not read it unless you allow it, it is needed for security, or the law requires it.
• Google Business Profile. If you connect it, we read the reviews of the locations you choose (reviewer name and review text) so you can create posts from them.
• Disconnecting. You can remove a connection at any time in Settings → Cloud storage, or in your account with the provider.

Ajansify's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Publishing tools. If you connect a publishing tool (such as Metricool, Buffer, Postiz, Zernio, Upload-Post, bundle.social or Publer), we send it the content you choose to publish and receive your social account names, publishing results and performance metrics. Access keys are stored encrypted.

You choose which services to connect. Their own terms and privacy policies also apply.

8. Who we share personal data with

• Service providers (sub-processors): hosting and file storage (Contabo, Germany), network and security (Cloudflare), AI providers, e-mail, SMS and push notification providers, and the payment institution (İyzico). They act only on our instructions, under contract and confidentiality obligations. See the full list on Service Providers & Sub-processors.
• Services you connect: publishing tools, cloud storage and Google Business Profile receive data on your instructions.
• Your team: members of your account see brands and content according to the roles and permissions the account owner gives them.
• People with a public link: some files and pages, such as shared file links and QR menu pages, can be opened by anyone who has the link.
• Authorities and registries: courts, public authorities and, for marketing approvals in Türkiye, the Commercial Electronic Message Management System (İYS), where the law requires it.
• Professional advisers: lawyers, accountants and auditors, under confidentiality.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, personal data may pass to the new owner, who must respect this policy. We will inform you.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

9. International transfers

Our servers and file storage are in Germany (EU), with Contabo. We are established in Türkiye, and some providers are in the United States or operate globally. Your data may therefore be processed outside your country.

• From Türkiye: transfers abroad are based on standard contracts under article 9 of the Personal Data Protection Law No. 6698 (KVKK), notified to the Personal Data Protection Authority.
• From the EU/EEA and the UK: transfers to US providers rely on the EU-US Data Privacy Framework (and its UK Extension) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum where needed). Transfers to us in Türkiye rely on Standard Contractual Clauses.
• Other countries: we use the safeguards required by local law; see section 19.

You can ask for information about these safeguards at [email protected].

10. How long we keep personal data

When a period ends, we delete or anonymise the data. We may keep data longer if a legal dispute or an official request requires it.

11. How we protect personal data

• Encryption in transit (HTTPS/TLS) for our websites and API.
• Passwords stored only as hashes; access keys for connected services stored encrypted.
• Role- and brand-based permissions inside accounts; staff access on a least-privilege basis.
• Logging and monitoring of security events; regular backups.
• Network protection, bot checks and rate limits through Cloudflare; sign-up checks against abuse.
• Card details are entered with the payment institution and never stored by us.
• Contracts with confidentiality and security obligations for all providers.

No system is completely secure. Keep your password safe and tell us at [email protected] if you suspect unauthorised access. If a personal data breach occurs, we will inform you and the authorities as the law requires.

12. Your rights

Depending on where you live, you may have the right to:

• know whether we process your personal data and get a copy;
• have inaccurate or incomplete data corrected;
• have your data deleted, or its processing restricted;
• object to processing based on legitimate interest, and object at any time to direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• not be subject to solely automated decisions that significantly affect you;
• complain to a data protection authority.

Some rights have limits. For example, we must keep invoices for the period required by law.

13. How to exercise your rights

• Write to [email protected], preferably from the e-mail address registered to your account. In Türkiye you can also apply by KEP (ajans,[email protected]) or in writing to Adres Adres Adres Adres Adres Adres.
• You can do many things yourself in the app: edit your profile and brand data, delete content, export your content and disconnect services.
• To close your account, write to [email protected] or [email protected].
• We may ask you to confirm your identity. An authorised agent may act for you where the law allows it.
• We answer free of charge within 30 days. Where the GDPR applies, we may extend this by two months for complex requests and will tell you why.
• If we refuse a request, we explain why and how you can complain or appeal.
• Requests about customer content are forwarded to the business that controls it.

14. Marketing communications

• We ask for marketing consent only when you sign up, with a single box for e-mail and SMS that is not pre-ticked. Consent is voluntary and not a condition of the service. See Marketing Communications Consent.
• Without your consent we send no marketing messages. In-app campaign notices are shown only to users who consented.
• You can withdraw at any time, free of charge, with the unsubscribe link or instructions in every message, or by writing to [email protected]. We act on your request within 3 business days.
• Service messages, such as invoices, security alerts, "your content is ready" and trial reminders, are part of the service and are sent without marketing consent. They contain no advertising.
• Web push notifications appear only if you allow them in your browser, and you can turn them off there.

15. Cookies and local storage

Today we use only strictly necessary cookies and local storage, for example to keep you signed in, remember your language and protect sign-up. Optional categories (functional, analytics, marketing) are used only after your consent. We honour the Global Privacy Control signal. You can change your choices at any time with the "Cookie preferences" link at the bottom of our pages. See our Cookie Policy.

16. Children

Ajansify is only for people aged 18 or over and is not directed at children. We do not knowingly collect personal data from anyone under 18, including children under 13. If we learn that we have, we delete it. Contact [email protected] if you believe a child has given us personal data.

17. Automated decision-making

We do not make decisions with legal or similarly significant effects on you based solely on automated processing. At sign-up, automated security checks (bot check, disposable e-mail check, device identifier, IP address and country check, rate limits, e-mail verification) can block or flag a sign-up to prevent fraud and free trial abuse. If this happens to you, contact [email protected] and a member of our team will review it.

18. Changes to this policy

We may update this policy when our service or the law changes. The effective date and version are shown at the top. We will tell you about material changes by e-mail or in the app before they take effect and, where the law requires it, ask for your confirmation.

19. Regional information

19.1 Türkiye

The Personal Data Protection Law No. 6698 (KVKK) applies. Our KVKK Privacy Notice sets out our processing, legal grounds, recipients and your rights under article 11, and how to apply to us. Two optional purposes rely on explicit consent and are described in the separate KVKK Explicit Consent Form. Commercial electronic messages are sent under Law No. 6563 only with your approval, which is registered in İYS. You can also complain to the Personal Data Protection Board within the legal time limits.

19.2 EU/EEA and United Kingdom

The GDPR and the UK GDPR apply because we offer our service to people in the EU/EEA and the UK. Our legal bases are in section 5 and international transfers in section 9.

• You have the rights in articles 15 to 22: access, rectification, erasure, restriction, portability, objection (including an absolute right to object to direct marketing), and protection from solely automated decisions with legal or similarly significant effects. You can withdraw consent at any time (article 7(3)).
• You can complain to the supervisory authority in the EU/EEA country where you live or work or where the alleged infringement took place. In the UK, this is the Information Commissioner's Office (ico.org.uk).
• Your statutory consumer rights are not affected by this policy.

Representative in the EU. We do not currently have a representative in the EU; you can contact us directly at [email protected].

Representative in the UK. We do not currently have a representative in the UK; you can contact us directly at [email protected].

19.3 United States

• We do not sell personal information and do not share it for cross-context behavioural advertising.
• We honour the Global Privacy Control (GPC) signal as a request to opt out of sale, sharing and targeted advertising for that browser.
• We do not use sensitive personal information to infer characteristics about you, and we do not use face images or voice recordings to identify anyone.
• Depending on your state (for example California, Virginia, Colorado, Connecticut or Texas), and where its law applies to us, you may have the right to access, correct, delete and obtain a portable copy of your personal information, and to opt out of sale, targeted advertising and profiling. We will not discriminate against you for using these rights.
• Write to [email protected]; an authorised agent may submit a request for you. If we decline, you can appeal by replying to our decision. If your appeal is denied, you can contact your state Attorney General.

19.4 Canada (including Québec)

• We handle personal information in line with PIPEDA and, for Québec residents, the Act respecting the protection of personal information in the private sector.
• The person in charge of the protection of personal information is our Privacy Officer, reachable at [email protected] or Adres Adres Adres Adres Adres Adres.
• You can access and correct your information and withdraw consent. In Québec you can also receive your data in a structured, commonly used technological format and, where the law's conditions are met, ask us to stop disseminating it or to de-index a link to it. Profiling for marketing is off unless you consent.
• Your information is processed outside Québec and Canada, in Germany (EU), Türkiye and the United States. Before such transfers we assess privacy risks and protect the information with written agreements. Authorities in those countries may be able to access it under their laws.
• You can complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d'accès à l'information.

19.5 Brazil

• The General Data Protection Law (LGPD) applies. We rely on the legal bases in its article 7, such as performance of a contract, legal obligation, legitimate interest, the regular exercise of rights and consent.
• Under article 18 you can ask for confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, portability, deletion of data processed with consent, information about who we share data with and about the consequences of not consenting, and you can withdraw consent.
• Our contact channel for data subjects is [email protected]. You can also complain to the National Data Protection Authority (ANPD).
• International transfers (section 9) are made under the mechanisms in article 33 of the LGPD [[doğrulanacak: ANPD standart sözleşme maddelerinin sağlayıcı sözleşmelerine eklendiği]].

19.6 Australia

• Where the Privacy Act 1988 and the Australian Privacy Principles apply to us, we handle personal information as described in this policy.
• We disclose personal information overseas, mainly to Germany (EU), Türkiye and the United States, and to providers that operate globally. We take reasonable steps, including contracts, so that recipients handle it in line with the Australian Privacy Principles.
• You can ask to access and correct your information. Using the service anonymously is not practicable, because we need to identify account holders.
• Contact us first at [email protected]; we aim to respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

19.7 United Arab Emirates and Saudi Arabia

• Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) or the Saudi Personal Data Protection Law applies, we ask for your consent where these laws require it, for example for marketing, the use of your own face and voice, and optional cookies. Otherwise we rely on the grounds they allow, such as performing our contract with you and complying with legal obligations.
• You can ask to access, obtain a copy of, correct and delete your personal data, and withdraw consent, as these laws provide.
• Your data is processed in Germany (EU), Türkiye and the United States, with the safeguards required by the cross-border transfer rules of these laws.
• You can complain to the competent authority: the UAE Data Office, or the Saudi Data and AI Authority (SDAIA).

20. Contact us

For any question about this policy or your personal data, write to [email protected]. You can also reach us by KEP at ajans,[email protected], by post at Adres Adres Adres Adres Adres Adres, or by phone at +902125055555. For questions about your account, write to [email protected].