Privacy Policy

1. Data we collect

Account data (name, e-mail address; authentication is handled by Clerk), business and brand profile information, the public content of the website you ask us to analyse, the content you generate and edit, data of the social media accounts you connect, payment records and technical records (IP address, browser, error logs).

Your card details are never stored on our systems; payments are processed by iyzico.

2. How we use TikTok data

When you connect a TikTok account, using the scopes TikTok grants (user.info.basic, video.publish, video.upload) we access only: your account identifier (open_id), display name and avatar, the account information required for posting settings (creator_info) and the status of the posts you create.

We use this data only to show which account a post will be published to, to publish content you explicitly approve and to report the publishing result back to you. We do not read your followers' data, your messages or your other content; we do not sell TikTok data, use it for advertising or use it to train AI models.

Access tokens are stored encrypted (AES-256-GCM) and deleted when you disconnect. You can also revoke access in the TikTok app under Settings and privacy > Security > Manage app permissions.

3. How we use Instagram data

When you connect an Instagram professional account via Instagram Login, using the instagram_business_basic, instagram_business_content_publish and instagram_business_manage_insights permissions we access: your account id, username, profile picture, account type, performance metrics of the posts you publish and your publishing limits.

We use this data only to publish the posts (single images or carousels) you approve, to track their publishing status and to show you post performance in the analytics screen. We do not sell Instagram data or share it with third parties for advertising.

When you remove our app in your Instagram settings, Meta notifies us and the access tokens of your account are deleted automatically; you can follow the status of the deletion request with the confirmation code you receive.

4. Purposes

Providing the service and managing your account; generating content suited to your sector; publishing content on schedule; taking payments and invoicing; keeping the service secure and preventing abuse; meeting legal obligations; sending you service-related notifications.

5. Service providers and international transfers

We work with the following providers: Convex (database and file storage), Vercel (web hosting), Railway (image/video processing), Cloudflare R2 (public media), Clerk (authentication), Anthropic and OpenAI (text generation), fal.ai (image/video generation), ElevenLabs (voice-over), Resend (e-mail), Axiom (error logs) and iyzico (payments). Some of them are located abroad, so data may be transferred abroad in accordance with Article 9 of the KVKK. [HUKUKÇU TEYİDİ GEREKLİ]

6. Retention

We keep your data while your account is open. Social media access tokens are deleted when you disconnect, other data when your account is deleted; records subject to statutory retention (e.g. invoices) are kept for the required period.

7. Security

Data is protected in transit with TLS; access tokens are stored encrypted and never written to logs. Access to our systems is limited to authorised people.

8. Your rights and deletion requests

You have the right to access, correct and delete your data and to object to its processing. To request deletion, follow the steps on the Data Deletion page or write to gizlilik@vitrinify.app. Your rights under the KVKK are also described in the KVKK Notice.

9. Children

The service is intended for businesses; it is not intended for people under 18.

10. Changes

We may update this policy and announce material changes by e-mail or in-app notice.