Privacy Notice and Privacy Policy
Draft — this document is under legal review and may change. Lawyer approval pending.
Last updated: October 9, 2026
1. Data Controller
SociAgent ("SociAgent"), in its capacity as data controller, processes the data you provide on the sociagent.ai website, web application, and mobile applications ("Application") in compliance with the Personal Data Protection Law No. 6698 ("KVKK") and the European Union General Data Protection Regulation ("GDPR"). SociAgent is the data controller with respect to the personal data of users registered with the Application. With respect to personal data belonging to third parties that may be included in content uploaded by users to the Application or processed through the Application, SociAgent acts, to the extent permitted by applicable law, as a data processor (or sub-processor); this scope is governed by the Data Processing Addendum (DPA). Contact: [email protected]
2. Collected Data
The following data are processed for the purpose of performing the services. • Account data: name, e-mail address, password (solely as an irreversible hash), two-factor authentication settings, preferred language, and identity and e-mail information transmitted by Google or Apple if you sign in with Google or Apple. • Organization and workspace data: organization/workspace name, members and roles, invitations. • Brand and content data: brand information provided by the User or extracted from the website, uploaded images, videos, and documents, generated and scheduled content, approval records. • Channel data: access tokens for connected social media accounts (stored in encrypted form), page/account information, publication, performance, and, where used, advertising data. • Subscription data: plan, status, and billing-period information. Card and payment information are processed by Paddle; SociAgent does not access such information. • Technical data: IP address, browser/device information, session and device logs, device identifier for abuse prevention, push notification token, error logs. • Usage data: product analytics only if you have provided explicit consent. Important note: The Application is not designed for processing special categories of personal data such as health data. Users should not upload such data to the Application.
3. Purposes of Data Processing
Your data are processed for the following purposes: • creation of the account and provision of the services (content generation, planning, approval, publication, reporting), • ensuring account and platform security, and preventing abuse and fraud, • conducting subscription, billing, and customer support processes, • improving service quality and remedying errors, • fulfilling legal obligations, • product analytics solely with your explicit consent.
4. Method of Collection and Legal Basis for Data Processing
Your data are collected through the website, the Application, the channels you connect, and electronic communication channels by automated or partially automated means. Your data are processed pursuant to Article 5 of the KVKK and Article 6 of the GDPR on the following legal bases: • being directly related to the establishment or performance of a contract, • being necessary for the data controller to fulfill its legal obligations, • being necessary for the establishment, exercise, or protection of a right, • being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, • your explicit consent with respect to analytical cookies and product analytics are the legal bases relied upon for processing.
5. Data Sharing
Your data may be shared, solely to the extent necessary for the provision of the services, with the following categories of service providers. The current list is available on the Sub-processors page. • Hosting and database (EU region). • Object storage and CDN (Cloudflare). • AI models (Anthropic): content and brand information necessary for content generation and analysis. • Payments and billing (Paddle, Merchant of Record). • Social media platforms (Meta): solely for publication, reporting, and advertising operations to the channels you connect. • Transactional e-mail providers. • Error monitoring (Sentry) and — only with your consent — product analytics (PostHog, EU). Your data may be shared with competent public authorities where legally required. Your personal data are not sold and are not transferred to third parties for advertising purposes.
6. International Transfer
Some of our service providers (e.g. AI and payment services) may be located outside Turkey and the European Economic Area. Such transfers are carried out pursuant to Article 9 of the KVKK and Articles 44 et seq. of the GDPR through Standard Contractual Clauses or the relevant service provider's valid security certifications and contractual safeguards.
7. Data Security
Your data are protected by technical and administrative security measures in line with industry standards: • SSL/TLS encryption in transit; encrypted storage of channel access tokens, • database-level authorization and data isolation between organizations and workspaces, • two-factor authentication, session and device management, limitation of login attempts, • role-based access and approval steps, • regular security tests, audits, and backups.
8. Retention Period of Data
• Active account data are retained for as long as the account remains active. • When you delete your account, only organizations of which you are the sole member are deleted together with all their data; you are removed from the others. Deleted data are permanently deleted or anonymized within a reasonable period; deletion from backups may take as long as the backup cycle. • Uploaded original media files are automatically deleted according to the retention periods specified in the Application. • Data required by legal obligations (e.g. invoice and payment records) are retained for the period specified in the applicable legislation.
9. User Rights
Under Article 11 of the KVKK and the GDPR, you have the following rights: • to learn whether your data are processed and to request information, • to access your data and export the data (data portability), • to request correction or deletion of the data, • to object to data processing and to withdraw your consent at any time, • to lodge a complaint with the competent supervisory authority (the KVKK Authority or the relevant EU data protection authority). You may export your data and delete your account from Settings → Privacy. You may submit your other requests from your registered e-mail address to [email protected]. In order to verify your identity, requests coming from channels other than your registered e-mail address may not be processed.
10. Cookies
The following types of cookies are used in the Application: • Necessary cookies: used for session management, security, language preference, and storage of the cookie consent preference. • Analytics cookies: used solely for the purpose of improving the services if you approve the "Accept all" option. You may change your preference at any time via the "Cookie settings" link in the footer. For details, please see the Cookie Policy.
11. Changes to the Privacy Policy
SociAgent reserves the right to update this Privacy Policy depending on applicable legislation and changes that may occur in the services. Material changes may be notified via your registered e-mail address. You may always access the current Privacy Policy through the Application and website. Continued use of the Application following the notice means that the current Privacy Policy has been accepted.