Privacy Policy

What data we collect on Roasive, why, how we protect it and with whom we share it. Version 1.0, effective 2026-10-13.

Version: 1.0 · Effective date:

1. Scope

This policy applies to the Roasive services provided by [COMPANY LEGAL NAME] at [WEBSITE] and in the application. See the KVKK Privacy Notice for statutory information and the Cookie Policy for cookies.

2. Data we collect

  • Account data: e-mail, name, password (only as a one-way hash at the authentication provider), basic profile data from social sign-in (Google/GitHub).
  • Connection data: OAuth tokens from ad and store platforms, stored server-side and never exposed to the browser or other users.
  • Platform data: campaigns, ads, spend, conversions, products, catalog and orders.
  • Content: uploaded media, AI-generated images/videos and text, chat history, workflows.
  • Usage and security data: sessions, error logs, IP address, browser information.
  • Payment data: provider transaction reference and billing details. We do not store card data.

3. How we use data

  • To provide the service, generate reports and suggestions, and apply ad changes with your approval.
  • To run AI features. To the extent provider agreements allow, your data is not used to train providers' general models; this text is updated as provider terms change.
  • For billing, support and security.
  • To produce aggregated, anonymised statistics to improve the product.

We do not sell your data. Changes to your ad accounts are never applied without passing the in-app approval flow.

4. AI and automation

AI agents and workflows may suggest budget, creative and performance actions. Suggestions are informational; you remain responsible for final decisions and platform policy compliance. Automated rules only run within the limits and approval settings you define.

5. Sharing and sub-processors

Main providers: Supabase (database, auth, storage; [DATA HOSTING REGION]), [APPLICATION HOSTING PROVIDER] (hosting), OpenAI, Runway, Pollo AI, Stability AI (AI), Stripe, iyzico, PayTR (payments), Paraşüt (e-invoicing), Resend (e-mail), Upstash (scheduled jobs), Slack/Telegram/WhatsApp (only if connected). Some are located abroad; transfers rely on safeguards under KVKK Art. 9.

6. Security

  • TLS in transit; row-level security (RLS) isolating each user's data in the database.
  • Tokens and secrets are kept server-side in columns not readable by clients.
  • Admin actions use role-based authorisation and audit logging.
  • Rate limits and approval flows for paid and sensitive operations.

No system is perfectly secure; data breaches are notified to data subjects and the Board as required by KVKK.

7. Retention and deletion

When you delete your account or disconnect an integration, the related tokens are deleted immediately; other data is deleted or anonymised once statutory retention periods expire.

8. Children

The service is not directed to persons under 18 and we do not knowingly collect their data.

9. Changes and contact

We may update this policy and will announce material changes in the app or by e-mail. Contact: [CONTACT E-MAIL] · [PHONE] · [REGISTERED ADDRESS].

This English text is provided for convenience; in case of conflict the Turkish version prevails.