AjansifyKVKK Privacy Notice (Turkey)
This notice is issued by Ajansify as data controller under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It informs people who use the Ajansify service, open an account, make a payment, are invited to a team, visit our websites or write to us.
1. Data controller
| Item | Details |
|---|---|
| Company | Ajansify |
| MERSIS number | 1234567890765432 |
| Trade registry number | 2573 |
| Address | Adres Adres Adres Adres Adres Adres |
| Registered e-mail (KEP) | ajans,[email protected] |
| Phone | +902125055555 |
| KVKK applications | [email protected] |
| Website | https://ajansify.app |
2. Scope of this notice
- We are the data controller for your account, subscription, payment, security, communication, marketing and cookie data. This notice describes that processing.
- The content our customers upload to or create in Ajansify may contain other people's data, such as people in photos and videos, Google reviewers or the customer's own customers. For that data the customer is the controller and we act as a data processor, only on the customer's instructions. The customer is responsible for informing those people. See the Data Processing Agreement.
- General information for users outside Türkiye is in the Privacy Policy.
3. Categories of personal data processed
| Category | Data |
|---|---|
| Identity and contact | Name, surname, e-mail, phone, job title, company name, sector, language, country, time zone |
| Account security | Password (as a hash), session information, verification codes, device identifier, IP address, browser information, sign-in times, records of suspicious activity |
| Billing and payment | Billing profile (individuals: name and, where required, Turkish national ID number; companies: legal name, tax office and tax number), address, orders, invoices, payment status, card reference and masked card number |
| Brand and content data | Brand information, uploaded files (photos, videos, documents, audio, fonts), images that show people, generated content, revision and approval history, taste profile |
| Connected account data | Access keys for publishing tools, cloud storage and Google (encrypted), social account names, performance metrics, Google reviews (reviewer name, review text), files selected in cloud storage |
| Usage and transaction data | Features used, credit movements, job records, AI prompt and output logs, error logs |
| Communications and marketing | Support and contact messages, notification delivery records (including content), records of commercial message approvals and refusals (time, source) |
| Team | Invited e-mail addresses, roles, permissions; invitation and reward codes |
| Cookies and local storage | Session, language, preference and device identifier records (Cookie Policy) |
| Face and voice data | Only if you give explicit consent: your own face images and voice recordings |
Special categories of personal data. We do not knowingly process special categories of data under article 6 KVKK (health, religion, biometric data and so on), and we ask you not to upload such data. Your own face and voice data is not used to identify or authenticate you; it is processed only with your explicit consent and only to produce content.
4. Purposes and legal grounds
The "Legal ground" column refers to article 5 KVKK: (2-a) expressly provided for by law, (2-c) necessary for the conclusion or performance of a contract, (2-ç) necessary to comply with a legal obligation, (2-e) necessary to establish, exercise or protect a right, (2-f) legitimate interest, (1) explicit consent.
| Purpose | Data categories | Legal ground |
|---|---|---|
| Registration and account creation, sign-in, team management | Identity and contact, account security, team | art. 5/2-c |
| Providing the service: brand profile, website scan, AI content generation, editor, storage, publishing, cloud storage, Google Reviews, taste profile | Brand and content, connected account, usage | art. 5/2-c |
| Subscription, payment, credits and invoicing | Identity and contact, billing and payment, usage | art. 5/2-c; for tax and commercial law, art. 5/2-a and 2-ç |
| Service and transactional messages (invoice, security, job ready, trial ending, service changes) | Identity and contact, usage, communication records | art. 5/2-c |
| Answering support requests | Identity and contact, communications, usage | art. 5/2-c; art. 5/2-f |
| Information security, preventing fraud and trial abuse, sign-up security checks | Account security, usage, cookies and local storage | art. 5/2-f |
| Strictly necessary cookies and local storage | Cookies and local storage | art. 5/2-c; art. 5/2-f |
| Keeping traffic and access logs under Law No. 5651 | IP address, time, request data | art. 5/2-a; art. 5/2-ç |
| Tax, accounting and consumer law records; responding to authorities | Billing and payment, usage and transactions | art. 5/2-a; art. 5/2-ç |
| Records of legal acceptances and statements (which text, which version, when, IP); protecting rights in disputes | Account security, communications and marketing, other relevant data | art. 5/2-ç; art. 5/2-e |
| Aggregate or anonymous usage statistics to improve the service | Usage | art. 5/2-f |
| Sending commercial electronic messages (e-mail, SMS; in-app for those who approved) and keeping approval records | Identity and contact, marketing records | Your approval under article 6 of Law No. 6563 together with art. 5/2-a; art. 5/2-ç for records |
| Invitation and reward programmes, when offered | Identity and contact, invitation and reward codes | art. 5/2-c |
| Analysis and profiling for campaigns, announcements and personalised offers | Identity, contact, usage and preferences | Explicit consent (art. 5/1), only Purpose 1 of the Explicit Consent Form |
| Creating talking videos, avatars/mascots and voice-overs with your own face and voice | Face images, voice recordings | Explicit consent (art. 5/1), only Purpose 2 of the Explicit Consent Form |
| Optional cookies (functional, analytics, marketing), if used | Cookies and local storage | Explicit consent (art. 5/1), through the cookie preferences panel |
We do not ask for explicit consent for processing that relies on another legal ground. Explicit consent is requested only for the optional purposes above, in a separate text.
5. How we collect personal data
We collect your personal data electronically, by automated or partly automated means:
- the sign-up form and payment step;
- the customer panel (brand profile, uploads, editor, settings, support);
- integrations: publishing tools, cloud storage, Google Business Profile and the payment institution you use;
- cookies and the browser's local storage;
- automated records such as server and application logs;
- e-mail and support correspondence;
- your brand's public website, when you ask us to scan it.
Data collected in these ways is processed on the legal grounds given for each purpose in section 4.
6. Transfers of personal data
Your personal data may be transferred to the recipient groups below, in line with articles 8 and 9 KVKK and limited to the purposes and legal grounds in section 4.
6.1 Recipients in Türkiye
| Recipient group | Purpose of transfer |
|---|---|
| Authorised public bodies (courts, law enforcement, tax administration, the Personal Data Protection Authority and others) | Legal obligations and official requests |
| Payment institution (İyzico) | Taking payments, storing cards, cancellations and refunds |
| SMS providers (Netgsm, İleti Merkezi) | Service SMS and, if you approved, campaign SMS |
| Commercial Electronic Message Management System (İYS) | Recording commercial message approvals and refusals under Law No. 6563 |
| Lawyers, accountants and auditors | Legal and financial obligations, protection of rights |
6.2 Recipients abroad
| Recipient group | Purpose of transfer | Country |
|---|---|---|
| Servers and object storage (Contabo GmbH) | Hosting, file storage, backups | Germany (EU) |
| Network and security (Cloudflare, Inc.) | DNS, content delivery, security, bot check at sign-up (Turnstile) | United States and global |
| AI providers (OpenAI and Microsoft Azure OpenAI, Anthropic, Google, xAI, fal.ai, OpenRouter, ElevenLabs) | Generating text, images, video and audio | United States |
| Notification providers (e-mail delivery provider, Twilio, OneSignal, Google Firebase Cloud Messaging) | Sending e-mail, backup SMS and push notifications | United States; e-mail provider [[doğrulanacak: e-posta sağlayıcısı ve ülkesi]] |
| Google LLC (Google Fonts, Google sign-in and connections) | Loading fonts, connections and authentication | United States |
| Cloud storage and publishing services you connect (Google Drive, Dropbox, OneDrive, Box; Metricool, Buffer, Postiz, Zernio, Upload-Post, bundle.social, Publer, Hootsuite; Google Business Profile) | Reading and saving files, publishing, performance metrics and reading reviews on your instructions | The provider's country (United States, Spain, Canada and others) |
Transfers abroad are made under the standard contracts announced by the Personal Data Protection Board, in accordance with article 9(4) KVKK. After signature, the contracts are notified to the Personal Data Protection Authority within the statutory period. The current list of providers is on Service Providers & Sub-processors.
7. Retention periods
We keep personal data for as long as the purpose requires and the law provides. The main periods are:
- account data: while the account is open; after closure, customer content can be exported for 30 days and is then deleted (from backups within 90 days at the latest);
- invoices, orders and contract records: 10 years (Turkish Commercial Code art. 82, Tax Procedure Law);
- records of legal acceptances: term of the contract plus 10 years;
- commercial message approval records: 3 years after the approval ends;
- consumer transaction records and notification delivery records: 3 years;
- traffic, access and security logs: 2 years;
- AI prompt and output logs: up to 1 year;
- cookie choice: 12 months.
When a period ends, the data is deleted, destroyed or anonymised.
8. Your rights under article 11 KVKK
By applying to the data controller, you may:
- learn whether your personal data is processed;
- request information about it if it has been processed;
- learn the purpose of processing and whether it is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom it has been transferred;
- request correction if it is incomplete or inaccurate;
- request deletion or destruction under the conditions in article 7 KVKK;
- request that the actions in items 5 and 6 are notified to third parties to whom the data was transferred;
- object to a result against you that arises from analysis of your data exclusively by automated systems;
- claim compensation if you suffer damage because of unlawful processing.
9. How to apply
Under the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can apply in one of these ways:
- In writing: with a wet-signed letter to Adres Adres Adres Adres Adres Adres;
- By KEP: to ajans,[email protected];
- With a secure electronic signature or mobile signature: to [email protected];
- From the e-mail address registered in our system: from the e-mail address registered to your Ajansify account to [email protected].
Your application must include: your name, surname and, for written applications, your signature; your Turkish ID number if you are a Turkish citizen, or your nationality and passport number or ID number if you are a foreign national; your residential or business address for notifications; your e-mail address and phone number, if any; the subject of your request; and any relevant documents.
We may ask for more information to verify your identity. We conclude your application as soon as possible according to its nature and within 30 days at the latest, free of charge. We reply in writing or electronically.
10. Complaint to the Board
If your application is rejected, you find our reply insufficient, or we do not reply in time, you can complain to the Personal Data Protection Board within 30 days of learning of our reply, and in any case within 60 days of your application (article 14 KVKK).
11. Explicit consent and commercial message approval
- The two optional purposes that rely on explicit consent (marketing and personalisation; face and voice data) are described in the separate KVKK Explicit Consent Form. Consent is not a condition of the service.
- Approval for campaign messages is requested with the separate Marketing Communications Consent text.
12. Information note
This notice is for information only under article 10 KVKK; it does not ask for your approval or acceptance. The "I have read and understood" statement you give at sign-up only confirms that you have read this notice; it is not explicit consent or acceptance of a contract. We may update this notice; the current version is always on this page.