Privacy Policy

1. Scope

This Privacy Policy explains how [Company legal name] ("Poki", "we") collects, uses, shares and protects personal data in the Poki mobile app (iOS and Android), the website at hellopoki.com and the web panel, together with related services (the "Service").

Poki is an AI-powered social media and advertising assistant for small and medium-sized businesses: it learns your brand, builds a content calendar, generates images, videos and captions, publishes to Instagram and Facebook on your behalf when you authorise it, and manages your Meta and Google Ads campaigns within the rules you set.

By using the Service you acknowledge that you have read this policy. Our detailed disclosure under the Turkish Personal Data Protection Law No. 6698 (KVKK) is published separately; for users in the European Economic Area or the United Kingdom, the GDPR / UK GDPR apply to the extent applicable.

2. Data controller

Data controller: [Company legal name], [Address]. MERSİS no: [MERSİS number]. E-mail: [Privacy / data-protection e-mail]. General support: [email protected].

[Name and e-mail of the data protection officer / contact person, if any]

3. Data we collect

We process the following categories of data to provide the Service. Data not provided by you directly is collected automatically while you use the Service, or from the platforms you connect, within the permissions you grant.

• Account data: name, e-mail address, optional phone number, password (stored only as an irreversible hash), language and theme preferences, notification settings.
• Workspace and brand data: business name, industry, logo, brand colours and fonts, target audience, products and services, campaign and special-day preferences, the strategy you choose.
• Content you upload: product photos, videos, reference images, written or spoken instructions, voice samples you choose for voice-over.
• Generated content: images, videos, captions, voice-overs, content plans and reports Poki creates for you, together with their draft, approval and publishing records.
• Connected accounts: access tokens you grant for your Instagram and Facebook pages, Meta ad accounts and Google Ads accounts (stored encrypted); public profile information of those accounts, post and ad performance metrics; if you enable the DM assistant, incoming messages and the replies given.
• Payment and subscription data: plan, credit balance, credit transactions, invoice and transaction records. Card details are never stored by Poki; payments are processed by Stripe (web), Apple App Store and Google Play.
• Usage and device data: app version, operating system, device model, IP address, session times, screens and features used, push notification token.
• Error logs: when the app crashes or an error occurs, stack traces, device and version information and your user ID collected through Sentry.
• Support correspondence: requests and attachments you send us by e-mail or from within the app.

We do not ask for special categories of personal data (health, religion, political opinion, etc.); please do not include such data in the content you upload.

4. Purposes

• Creating your account, verifying your identity and providing the Service.
• Analysing your brand, building a content calendar and strategy, generating content with AI.
• Publishing, scheduling and measuring content on the social media accounts you authorise.
• Managing and reporting on campaigns in your ad accounts within the budget and rules you set.
• Running subscriptions, credits and payments; issuing invoices; meeting statutory accounting obligations.
• Sending service notifications (generation finished, approval pending, post published, credits running low, etc.).
• Detecting errors and security incidents, keeping the Service stable and secure, preventing abuse.
• Improving the product: understanding which features are used and improving recommendations.
• Answering your support requests and complying with legal obligations.

To improve our recommendations and strategies we may use anonymised, aggregated, sector-level performance data that contains no personal data and no brand identifiers (for example, "Reels in the food sector get more engagement in the evening"). Such data cannot be linked to any individual or business.

5. Legal bases

Your personal data is processed on the following legal bases listed in Articles 5 and 6 of the KVKK:

• Performance of a contract (KVKK art. 5/2-c; GDPR art. 6/1-b): account, brand data, generated content, connected accounts, subscription.
• Compliance with a legal obligation (KVKK art. 5/2-ç; GDPR art. 6/1-c): invoice and accounting records, access logs, requests from competent authorities.
• Legitimate interests (KVKK art. 5/2-f; GDPR art. 6/1-f): security, error monitoring, abuse prevention, aggregated statistics for product development.
• Explicit consent (KVKK art. 5/1; GDPR art. 6/1-a): to the extent required for AI generation and platform integrations that involve transfers abroad, marketing messages and other consent-based processing. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

6. AI providers and content generation

To generate content, your instructions, brand information and uploaded images are sent to providers such as OpenAI and Google (Gemini) for text and image generation, Higgsfield for video generation and ElevenLabs for voice-over. Only the data needed for that generation is sent; your password, payment details and access tokens are never shared with these providers.

We contract with these providers as data processors and, where the provider offers it, apply the options that prevent your data from being used to train the provider's own models. Providers' retention periods (for example short-term retention for abuse monitoring) are governed by their own policies.

AI outputs may be inaccurate, incomplete or inappropriate. We recommend reviewing content before publishing; in autopilot mode, publishing follows the settings and approval preferences you define.

7. Recipients of your data

Your data is shared only to the extent necessary to provide the Service, with the following categories of recipients. We do not sell personal data and do not share it with advertising networks for marketing purposes.

• AI providers: OpenAI, L.L.C. (USA); Google LLC — Gemini (USA); Higgsfield (USA); ElevenLabs Inc. (USA).
• Social media and advertising platforms: Meta Platforms, Inc. / Meta Platforms Ireland Ltd. (Instagram, Facebook, Meta ads); Google LLC (Google Ads). These platforms are accessed only for the operations you authorise; their own privacy policies also apply.
• Payments and app stores: Stripe, Inc. (web payments); Apple Inc. (App Store); Google LLC (Google Play). Card details are processed by these companies.
• Error monitoring: Functional Software, Inc. (Sentry).
• Hosting and infrastructure: [Hosting provider and server region]; object storage for uploaded and generated media: [Storage provider and region].
• E-mail and notifications: [E-mail provider]; Apple Push Notification service and Firebase Cloud Messaging (push notifications).
• Public authorities: where required by law.
• Legal, accounting and audit advisers: to the extent necessary to meet our legal obligations.

Some of these providers are located outside Türkiye (mainly in the USA and the EU). Transfers abroad are made under Article 9 of the KVKK on the basis of your explicit consent or of the safeguards set by the Turkish Personal Data Protection Board (adequacy decision, standard contract, undertaking). For transfers subject to the GDPR we rely on the European Commission's Standard Contractual Clauses and, where available, adequacy decisions.

8. Retention

• Account, brand and content data: for as long as your account is open. When you delete your account, your personal data is deleted or anonymised within 30 days; removal from backups is completed within a further 14 days at most.
• Connected-account access tokens: deleted immediately when you remove the connection or revoke the permission on the platform side.
• Invoice, payment and accounting records: 10 years, as required by the Turkish Tax Procedure Law and Commercial Code.
• Access and transaction logs: for the period required by Law No. 5651 and related legislation ([period]); longer only while needed for a security investigation.
• Error logs (Sentry): 90 days.
• Support correspondence: 2 years after the request is closed.
• Anonymised aggregated statistics: indefinitely (not personal data).

9. Your rights

Under Article 11 of the KVKK and, where applicable, Articles 15–22 of the GDPR, you have the right to:

• Learn whether your personal data is processed and request information about it.
• Learn the purpose of processing and whether the data is used in line with it.
• Know the third parties to whom your data is transferred, in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request erasure or destruction of your data under the conditions set by law.
• Request that corrections, erasure and destruction be notified to third parties who received the data.
• Object to a result that is to your detriment and produced exclusively by automated analysis.
• Claim compensation for damage caused by unlawful processing.
• Under the GDPR additionally: data portability, restriction of processing, withdrawal of consent and lodging a complaint with a supervisory authority.

You can send requests from your registered e-mail address to [Privacy / data-protection e-mail], or in writing to [Address]. Requests are answered free of charge within 30 days at the latest; if the operation involves an additional cost, the fee set by the Board may apply. You can also delete your account and all your data from within the app; the steps are on the Data Deletion Instructions page.

10. Cookies (website and web panel)

The hellopoki.com website and web panel use strictly necessary cookies only:

• poki_at and poki_rt: secure (HttpOnly) session cookies that keep you signed in to the web panel.
• poki_locale: remembers the language you chose on the marketing site.

The marketing site uses no third-party advertising or tracking cookies. [If an analytics tool is added later, its name, purpose and duration will be listed here and cookie consent obtained where required.] You can delete or block cookies in your browser settings; if session cookies are blocked, you cannot sign in to the web panel.

The mobile app does not use cookies; session data is kept in the device's secure storage.

11. Children

Poki is intended for businesses and may not be used by anyone under 18. If we learn that we have collected data from a person under 18, we delete it immediately. Please let us know if you suspect this has happened.

12. Security

Your data is encrypted in transit with TLS. Access tokens for social media and ad accounts are stored encrypted in the database; passwords are kept only as irreversible hashes. Access is limited to a small number of staff who need it for their role and is logged. Card data is never stored on our systems.

No system is completely secure. If we detect a breach affecting your personal data, we will inform you and the competent authorities within the time and in the manner required by the KVKK and, where applicable, the GDPR.

13. Changes

We may update this policy from time to time. We announce material changes by in-app notification or e-mail; the current version is always published on this page with the date shown at the top. Continuing to use the Service after a change means you accept the updated policy.

14. Contact

Privacy questions and requests: [Privacy / data-protection e-mail]. General support: [email protected]. Postal address: [Company legal name], [Address].