KVKK Privacy Notice

1. Data controller

Your personal data is processed by [COMPANY LEGAL NAME] ("Company", "Roasive") as data controller.

• Legal name: [COMPANY LEGAL NAME]
• Address: [REGISTERED ADDRESS]
• MERSIS No: [MERSIS NO] · Trade Registry No: [TRADE REGISTRY NO]
• Tax office / ID: [TAX OFFICE] / [TAX ID]
• KEP (registered e-mail): [KEP ADDRESS] · E-mail: [CONTACT E-MAIL] · Phone: [PHONE]
• Website: [WEBSITE]
• VERBIS registration no (if registration is required): [VERBIS REGISTRATION NO]

2. Categories of personal data

• Identity and contact: name, e-mail, phone number (if added as a notification channel), company/store name.
• Customer transactions and account: registration, session data, plan, credit movements, orders and invoices, support requests.
• Finance: billing address, tax details, transaction references returned by the payment provider. Card numbers are never stored on our servers.
• Connected account data: OAuth access/refresh tokens for your Meta, Google and TikTok ad accounts, account IDs, campaigns, ad sets, ads and spend/performance metrics; products, catalog, orders and revenue from store integrations (Shopify, Trendyol, ikas, Ticimax, IdeaSoft); Google Analytics and Search Console metrics.
• User content: uploaded images and videos, product URLs, messages to the AI assistant, workflows, agent rules and reports.
• Security: IP address (only for security and consent records, hashed where possible), browser/device data, error and access logs, admin audit logs.
• Marketing: only with your explicit consent, commercial message preferences and marketing cookie data.

For personal data of your own end customers inside connected stores and ad accounts, the Company acts as a data processor on your instructions under the Data Processing Agreement.

3. Purposes

• Concluding and performing the membership agreement; account creation, authentication and session management.
• Connecting and reporting on your ad accounts and, with your approval, applying changes (budget, status, name, campaign creation).
• Syncing store data, profit/revenue analytics, catalog and audience operations.
• Providing AI features (chat assistant, AI agents, workflow generation, SEO suggestions, image/video generation).
• Delivering notifications through the channels you choose (e-mail, Slack, Telegram, WhatsApp).
• Selling subscriptions and credits, payment, invoicing and accounting.
• Information security, abuse and fraud prevention, service continuity and troubleshooting.
• Complying with legal retention, notification and disclosure obligations.
• Handling requests and complaints, customer support.
• With your explicit consent: analytics/marketing cookies and commercial electronic messages.

4. Legal bases

• KVKK Art. 5/2-(c): necessary for the conclusion or performance of a contract.
• KVKK Art. 5/2-(ç): compliance with legal obligations (tax, commercial and e-commerce law, Law No. 5651).
• KVKK Art. 5/2-(e): establishment, exercise or protection of a right.
• KVKK Art. 5/2-(f): legitimate interests, provided your fundamental rights are not harmed.
• KVKK Art. 5/1: explicit consent (analytics and marketing cookies, commercial messages and other cases required by law).

5. Transfers

Your data may be transferred, limited to the purposes above, to:

• Hosting and infrastructure: Supabase (database, authentication, storage; region: [DATA HOSTING REGION]), [APPLICATION HOSTING PROVIDER] (application hosting), Upstash (scheduled jobs).
• AI providers: OpenAI (text generation and analysis), Runway, Pollo AI and Stability AI (image/video generation), only the content needed when you use the related feature.
• Payment institutions: Stripe, iyzico and PayTR (depending on the method you choose); Paraşüt for e-invoicing/accounting.
• Communication: Resend (transactional e-mail), Slack, Telegram and WhatsApp (only if you connect them).
• Platforms you connect: Meta, Google, TikTok and store platforms, on your instructions and under their API terms.
• Competent authorities and courts (where legally required), legal and financial advisers.

Cross-border transfers: some providers host data outside Türkiye (e.g. USA, EU). Transfers are made under KVKK Art. 9, relying on an adequacy decision where available, otherwise on appropriate safeguards such as the standard contracts published by the Board, and only in incidental cases on your explicit consent. Standard contracts are notified to the Board within five business days of signature.

6. Collection method

Data is collected through registration and payment forms, in-app actions, via APIs from accounts you authorise with OAuth, cookies and similar technologies, support requests and e-mail, by fully or partly automated means.

7. Retention

• Account data: for the duration of membership and the general statute of limitations thereafter (max. 10 years).
• Invoices and accounting records: 10 years under Turkish tax and commercial law.
• Access and traffic logs: for the period required by law (1–2 years under Law No. 5651).
• OAuth tokens: deleted immediately when you disconnect an integration or delete your account.
• Consent records: for the duration of membership and the limitation period thereafter, as evidence.

Expired data is deleted, destroyed or anonymised in periodic disposal cycles under the applicable regulation.

8. Your rights (KVKK Art. 11)

• Learn whether your data is processed and request information about it,
• Learn the purpose of processing and whether it is used accordingly,
• Know the third parties to whom it is transferred in Türkiye or abroad,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction under KVKK Art. 7,
• Request notification of correction/deletion to recipients,
• Object to a result against you arising exclusively from automated analysis,
• Claim compensation for damages caused by unlawful processing.

9. How to apply

You can download a machine-readable (JSON) copy of your account data at any time with "Download my data" under Dashboard → Account → Privacy & data, and request deletion of your account in the same place. On deletion, invoice and payment records that must be kept by law are anonymized and detached from your identity; all other data is deleted.

You may submit requests in writing to [REGISTERED ADDRESS], via KEP to [KEP ADDRESS] with a secure e-signature, or from your registered e-mail address to [CONTACT E-MAIL]. Requests are answered free of charge within thirty days; where the process involves an extra cost, the Board tariff may apply.

This English text is provided for convenience; in case of conflict the Turkish version prevails.