KVKK Disclosure Text (Turkish Personal Data Protection Law)

Effective date: 31 October 2026

This English translation is provided for convenience. In case of any discrepancy, the Turkish version prevails. Read the Turkish version

İndoles Yazılım Anonim Şirketi (the "Company"), as the data controller under Law No. 6698 on the Protection of Personal Data ("KVKK"), has prepared this disclosure under KVKK Art. 10 and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.

1. Data controller

• Name: İndoles Yazılım Anonim Şirketi
• Address: Kara Hasan Sokak No: 7A, Beşiktaş, Istanbul, Türkiye
• MERSIS number: 0478104423800001
• E-mail: destek@aduardomind.com
• Web: aduardomind.com

2. Personal data processed

3. Purposes of processing

• Membership and account management.
• Providing the Service: brand analysis, content generation, social media and ad management, reports, AI-assisted suggestions.
• Subscription, token management and billing.
• Running social media integrations; team management and access control.
• Information security, error monitoring, preventing abuse of the trial period.
• Fulfilling legal obligations.
• Responding to communication and support requests.
• With your permission, measuring how the product is used (analytics).
• When the shared pool is enabled, producing shared sector insights (de-identified, from the data of many brands).
• New purpose (in future): developing our own AI and algorithms with anonymised datasets.

4. Legal grounds

• Explicit consent (Art. 5/1): analytics (PostHog) and non-essential cookies.
• Performance of a contract (Art. 5/2-c): processing necessary to provide the Service.
• Legal obligation (Art. 5/2-ç): tax and commercial law (financial records), EU political-ad declaration.
• Legitimate interest (Art. 5/2-f): service security, error monitoring, preventing abuse of the trial period, shared sector insights, and, in future, developing our own AI and algorithms with anonymised datasets.

5. Transfer of personal data

5.1 Within Türkiye. Competent public bodies where legally required. When payments are enabled, your payment data is transferred to iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), which processes it as an independent data controller under its own privacy policy. Our transactional and report e-mails are sent through our processor Veridyen. Veridyen relays outgoing e-mail through MailChannels, based in Canada; this relay is a transfer abroad.

5.2 Abroad. The recipients below may process data outside Türkiye. The detailed columns (which Google and Meta data) are in the table in the Privacy Policy; this table carries the same names and kinds. The recipients in Türkiye (Veridyen, iyzico) are in 5.1.

When you connect a platform (Meta, Google, LinkedIn, Telegram) and have content published or messages received there, data also goes to that platform. When you connect Pinterest and publish there, data also goes to Pinterest.

Whether each provider may use your data for its own purposes is set out per provider in section 6 of the Privacy Policy.

Transfers are made within the framework of KVKK Art. 9; you can ask destek@aduardomind.com which safeguard we rely on for each provider.

We do not sell or rent your personal data; we do not sell, license or transfer training datasets or models to third parties; your data is shared only with providers that help us deliver the Service, and only to the extent necessary.

6. New purpose: model development

• What: in future, developing our own AI and algorithms with anonymised datasets. Today no model development is done with customer data. Data can enter this purpose only once the pipeline built for it is switched on and 30 days after the notice to existing users.
• Legal ground: KVKK Art. 5/2-f (legitimate interest).
• Sources of the data: the brand's DNA, the content information held in our memory, and the ad results associated with that content (including Meta ad results). Raw data received from Meta is not fed directly into model training. Not included: data from Google ; Meta message and comment text, WhatsApp and Telegram bot chats and media ; Pinterest and payment data.
• How to object: as the brand owner (OWNER) you turn off the "Ortak öğrenme ve model geliştirme" switch under Ayarlar → Proje & Veri → Veri ve öğrenme (Settings → Project & Data → Data and learning); it takes the brand out of both the shared pool and model development, and also stops the brand using the sector insights in the shared pool. If you are not the brand owner (an editor, a viewer, or a person whose data is in a brand), write to destek@aduardomind.com and we will record your objection.
• When your account is deleted, your personal data is deleted except for the records that section 7 lists as kept after deletion; anonymous records that cannot be linked to you may remain.

7. Retention periods

• Account data: for the life of the membership; deleted 7 days after the deletion request (cancelled if you sign in during that time). Drops out of backups within 7 days at the latest.
• Sign-in records: 12 months. Technical event and e-mail delivery records: 13 months.
• Assistant messages: 90 days. Assistant conversation record (including the number or chat ID of the person who writes to the bot): deleted once the conversation has been closed for 90 days, or when the account is deleted.
• Records kept after the account is deleted:
  • Financial records: if there is a successful or refunded payment, kept for 10 years with the link to you removed (amount, currency, date, plan, period, the payment provider's transaction and payment-form numbers and the status details bookkeeping needs) (Turkish Commercial Code No. 6102 and Tax Procedure Law No. 213).
  • Anonymised account record: if a kept record points to your account, the account row is kept with its personal fields removed and the account closed.
  • EU political-advertising declaration: the approver's name and e-mail, 7 years (legal obligation).
  • Trial-abuse record (one-way digest of the e-mail address): 730 days.
  • Brands you do not own: your membership and your templates, jobs and conversations in those brands are deleted; the social media and ad accounts you connected there are disconnected and the brand owner is told (you are not named); older connections for which we did not record who made them are excluded and stay with the brand. Files you uploaded to the brand stay with the brand and pass to its owner; your calendar comments stay with your short name (e.g. "Ayşe K."); the records in the brand's token ledger and the design and visual work you started stay with the brand, with the link to you removed. Your phone number in a WhatsApp group is deleted; your display name stays.
  • Deletion notice: the send record of the e-mail telling you that your account was deleted (including your e-mail address) is kept for 13 months.
  • Demo request, WhatsApp group record, and the audit and financial records of our team's administrator accounts: details in section 11 of the Privacy Policy.
• Access tokens: when you disconnect or delete your account, the stored access tokens are deleted on our side. Only the brand owner can disconnect; on disconnect the connection record and its past report data stay with the brand. We do not revoke the access permission at the platform today; to remove it, use the platform's own settings (Meta, Google, LinkedIn, Pinterest).
• Cookies and browser storage: Cookie Policy.
• Other periods and detail: Privacy Policy, section 11.

8. Data subject rights (KVKK Art. 11)

By applying you may request:

• (a) to learn whether your personal data is processed,
• (b) to request information if it has been processed,
• (c) to learn the purpose of processing and whether it is used accordingly,
• (ç) to know the third parties in Türkiye or abroad to whom it is transferred,
• (d) to request correction if it is incomplete or inaccurate,
• (e) to request deletion or destruction within the framework of KVKK Art. 7,
• (f) to request that the actions under (d) and (e) be notified to the third parties to whom the data was transferred,
• (g) to object to a result against you arising from analysis of the data exclusively by automated systems,
• (ğ) to request compensation for damage caused by unlawful processing.

9. How to apply

• E-mail: to destek@aduardomind.com with information identifying you and your request.
• In the app: Settings → Project & Data (Ayarlar → Proje & Veri) → "Veri talebi gönder" (send a data request) opens an e-mail to destek@aduardomind.com with a prepared subject.

Applications are concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request. If the action requires a separate cost, a fee may be charged at the tariff set by the Personal Data Protection Board.

10. Changes

This text may be updated in line with legal changes and changes to the Service; the current text is on this page. We notify existing users 30 days in advance, by e-mail and in the app, that the model-development purpose is being added.