Privacy Policy

1. Data controller

Your personal data is processed by [Company Legal Name] ([Address], MERSIS: [MERSIS number]) as data controller. Users in Türkiye can find additional detail in the KVKK Notice.

2. Data we collect

Depending on how you use the Service, we process:

• Account data: name, email, password hash (plain passwords are never stored), language, theme and time zone preferences, two-factor authentication data
• Billing data: billing name, tax/national ID number, billing address, payment records (card details are held by the payment provider, not by us)
• Project data: project details, team members, posts, media files, plans, reference sources and brand voice settings
• Connected social account data: account name, profile image, encrypted access tokens, post and account metrics, comments on your accounts (including commenters' public names)
• Usage and security data: session records, IP address, browser information, activity and audit logs
• Communication data: information you share in sales and support requests, your notification channels (Telegram, browser push)

3. Why we use it

• To create your account, verify your identity and provide the Service
• To schedule and publish your posts on connected accounts, and to fetch metrics and comments
• To generate content, image and reply suggestions with Qivo when you ask
• To run subscriptions, credits and billing
• To keep the Service secure, prevent abuse and meet legal obligations
• To send product news and offers if you have opted in

4. AI processing

When you use Qivo, the content relevant to your request (e.g. topic, brand voice, selected reference summaries) is sent to AI model providers. Your name, email and billing details are not sent. We prefer provider configurations in which data is not used for model training.

5. Who we share it with (sub-processors)

We share data only as needed to provide the Service with:

• Hosting and storage: [Server provider], Cloudflare (R2 object storage, EU region)
• Payments: iyzico (card payments), banks (wire transfer)
• AI: OpenRouter and the model providers it routes to, fal.ai (image generation)
• Social platforms you connect: Meta (Instagram, Facebook, Threads), Pinterest, TikTok, Google (YouTube) and LinkedIn — only on your instruction
• Notifications: email delivery provider, Telegram (if connected), browser push services

6. International transfers

Some of these providers operate servers outside Türkiye (in the EU and the US). Transfers are made in line with KVKK Article 9 and applicable law, using appropriate safeguards such as standard contracts or explicit consent.

7. Retention

• Account data: while your account is open; personal fields are anonymized when the account is deleted
• Project data: until the project is deleted; deleted at the end of the 90-day read-only period after a subscription ends
• Invoices and payment records: for the statutory period under tax and commercial law (generally 10 years)
• Comments deleted on the platform: marked as deleted, text anonymized after 90 days
• Security and audit logs: for the periods required by law

8. Your rights

You have the right to access, correct and delete your data, to object to processing and to receive a copy of your data. Under Profile > Security you can download your data as JSON and delete your account. For other requests, write to [data protection email address].

9. Security

Access tokens and secrets are stored encrypted, media is served through short-lived signed links, and administrative actions require two-factor authentication and are audit-logged. No system is risk-free; in the event of a breach we will notify as required by law.

10. Changes

We may update this policy. We will inform you of material changes by email or in-app notification.