Privacy Policy

Effective date: 31 October 2026

This English translation is provided for convenience. In case of any discrepancy, the Turkish version prevails. Read the Turkish version

At İndoles Yazılım Anonim Şirketi ("Aduardo", "we") we take the protection of your personal data seriously. This policy explains which data we process in the AI-powered brand management and social media automation platform (the "Service") at aduardomind.com, what we use it for, with whom we share it, how long we keep it, and what your rights are.

1. Data controller

• Name: İndoles Yazılım Anonim Şirketi
• Address: Kara Hasan Sokak No: 7A, Beşiktaş, Istanbul, Türkiye
• MERSIS number: 0478104423800001
• Contact: destek@aduardomind.com

2. Which data we process

2.1 Data you give us

• First name, last name and e-mail address; your username if you entered one; your Google account ID if you sign in with Google.
• Your password (only in one-way hashed form).
• Company/brand name, industry and brand information (brand DNA, briefs).
• If you add them to your profile: organisation, job title and phone number.
• Billing details (when payments are enabled): invoice name, address, city, country and an identity number (the Turkish ID number for Türkiye, a passport number for other countries). The identity number is stored encrypted. When you save a card, your last validated IP address is also kept on this record; it is passed to the payment provider on renewal payments and overwritten each time.
• Saved card (when payments are enabled): we never store the full card number. We store the card keys issued by the payment provider (encrypted), the last four digits, the expiry month and year, the card family and type, and the card alias.
• Your logo, font files you upload, and images you upload to the library. For a font upload we also record who uploaded it, when, and the version of the text they confirmed.
• When ad film is enabled: a reference video you upload (kept for 30 days).
• What you type into the demo request form. Our team opens your account from your demo request; the request record is linked to your account.
• Messages you write to the assistant (web or WhatsApp/Telegram) and photos, audio or video you send it.
• The phone number or Telegram chat ID of people who write to your brand's WhatsApp or Telegram bot. It is stored in the conversation record. Messages are deleted after 90 days; the ID is deleted with the conversation record once the conversation has been closed for 90 days, or when the account is deleted (see section 11).
• When the central WhatsApp number is enabled: for people who pair it with their account, their WhatsApp user ID (BSUID) in clear and their phone number encrypted and as a one-way digest; for WhatsApp group members, their display name, masked number, WhatsApp user ID (BSUID) and a one-way digest of the number, plus an encrypted copy of the number when WhatsApp gives no user ID.
• Ad order data (if your brand sends order data from its shop): order number, date, amount, currency, city, campaign source (UTM) and an irreversible digest of the customer ID. For your brand's own customers we process this data on the brand's behalf; the brand is the controller.

2.2 Data from accounts you connect. When you connect your Meta (Facebook, Instagram, ad account, WhatsApp), Google (Google Ads, Analytics, Search Console, Business Profile), LinkedIn or Telegram accounts, the following is processed:

• Access tokens. Stored encrypted.
• Page/account name, ID and profile information.
• Post and page performance metrics (likes, comments, reach, impressions, clicks, etc.).
• Ad account data: campaign and ad names, targeting, spend and result metrics.
• Google search query data (if you connect Search Console).
• Instagram post captions.

When you connect your Pinterest account, the same kinds of data (account and board names, access token, pin metrics) are processed.

2.3 Data collected automatically

• IP address, browser type and device information; a record of sign-in attempts. Kept for 12 months.
• Technical event records we keep in our own database to monitor how the system runs (which operation ran when, user and brand ID). These records do not depend on analytics consent and are deleted after 13 months.
• E-mail delivery records. Kept for 13 months.
• Error monitoring records (Sentry). Needed to run the Service; we rely on legitimate interest. Only your user ID is sent to Sentry, not your e-mail address.
• Product analytics (PostHog, EU servers). Runs from both the browser and the server only if you give permission; without it, no person-linked event is sent to PostHog.
• Database backups: daily backups and a 7-day point-in-time recovery log. Backups are kept for 7 days.
• Cookies and browser storage: see the Cookie Policy.

2.4 Data generated by AI and held in our memory

• Brand DNA analysis, generated text and visuals, campaign suggestions, content calendar.
• Vector embeddings (for brand memory).
• Short notes on your best ads (the ad's theme tags, the ad set/audience segment name or the ad name, and the results). These are processed only for your own brand by Anthropic, Google Vertex AI and OpenAI.
• Sample records of generated content: content we generate and the request text that produced it are kept as samples to monitor and improve content quality. Samples of the brands you own are deleted when your account is deleted.
• Social proof (the rating and review count added to images): our server opens the product page address you give; the product name, rating, review count, source address and the confirming user are stored; no data about the people who wrote the reviews is taken. A product image you upload is deleted from storage after one day.

3. What we use data for

1. Creating accounts, authentication, session management.
2. Planning, generating and publishing your content; brand analysis, campaign and ad suggestions.
3. Usage tracking, subscriptions and billing.
4. Reports and analytics.
5. Support and communication.
6. Security, abuse prevention, error monitoring.
7. Legal obligations.
8. Shared sector insights and, in future, developing our own AI models (section 5).

4. Legal grounds

• Performance of a contract: processing necessary to provide the Service.
• Legitimate interest: service security, error monitoring, preventing fraud and trial abuse, and, in future, developing our own AI and algorithms with anonymised datasets (KVKK Art. 5/2-f).
• Explicit consent: analytics (PostHog) and non-essential cookies.
• Legal obligation: tax, accounting and EU political-advertising declaration obligations.

5. We process your data for three different uses

1. Your own brand's features. Your data is used to produce content, suggestions and reports for your brand.
2. Shared sector insights (the shared pool). When the shared pool is enabled, we derive de-identified sector insights from the data of many brands and offer them to other brands as suggestions.
3. Model development with anonymised datasets (in future). We plan to develop our own AI and algorithms with anonymised datasets; this purpose is announced by this policy. Today no model development is done with customer data. Data can enter this use only once the system built for it is switched on and 30 days after the notice to existing users.

Sources of uses 2 and 3. Both are built from the brand's DNA, the content information we hold in our memory, and the ad results associated with that content (including Meta ad results). The shared pool also takes the organic performance metrics (reach, interactions) of your content on Facebook and Instagram and the ratings you give your campaigns; these do not enter model development. Raw data received from Meta is not fed directly into model training.

How Meta ad results are processed. Meta ad results are processed linked to your brand's content. The ad name or the ad set/audience segment name and aggregated metrics (click-through rate, return on ad spend, number of conversions) can appear in the same brand's memory lines. Those lines are not shown to any other brand; they can reach other brands only through the shared pool, as structured fields and metric ranges that pass the rules below.

Never included. Data from Google does not enter either use. Meta message and comment text, and WhatsApp and Telegram bot chats and media, do not enter either use. Pinterest and payment data do not enter either use.

Rules of the pool. The pool is built only from structured fields (sector, channel, objective, format, theme tags, metric ranges) and contains no free text such as ad names, titles, descriptions or captions. A sector group's insight is written only with the contribution of at least 5 different brands, and no brand can contribute disproportionately to a group. Every record stores which brands contributed to it; when a brand leaves, it is removed from the records.

One switch. The brand owner (OWNER) can take the brand out of both uses (2 and 3) together with the "Ortak öğrenme ve model geliştirme" switch under Ayarlar → Proje & Veri → Veri ve öğrenme (Settings → Project & Data → Data and learning). It is on by default. If you turn it off, the brand's data takes part in neither use, and the brand also stops using the sector insights in the shared pool.

Data-use table (plain words). "Yes" means the use may be made of that data; "No" means it is not. The "Shared pool" column applies only when the shared pool is enabled, and the "Model development" column only once the system built for it is switched on and 30 days after the notice; until then no data in these two columns is used.

When your account is deleted, the data of the brands you own and your contributions to the shared pool are deleted. Some records stay after the account is deleted because of a legal obligation, security or the rights of other people (for example financial records, the EU political-advertising declaration and the trial-abuse record); all of them, with their periods, are under "Records kept after the account is deleted" in section 11. Deleted data drops out of the database backups within 7 days at the latest. Apart from those kept records, your personal data is deleted; anonymous records that cannot be linked to you may remain.

6. With whom we share your data

We do not sell or rent your personal data; we do not sell, license or transfer training datasets or models to third parties; your data is shared only with providers that help us deliver the Service, and only to the extent necessary.

Data also goes elsewhere in two cases: (a) when you connect a platform (Meta, Google, LinkedIn, Telegram) and have content published or messages received there, data goes to that platform; (b) in the case of a court order or legal obligation, it is shared with the competent authorities. When you connect Pinterest and publish there, data also goes to Pinterest.

Processors and delivery channels. A processor is a provider that processes data on our behalf. A delivery channel is a platform you connect to receive or send messages; data goes there because you chose that channel. "Google data" means Google Ads, Analytics, Search Console and Business Profile data and the Google sign-in profile; "Meta data" means Page/Instagram insights, Instagram post captions, ad assets (including targeting), ad metrics and WhatsApp messages.

May providers use your data for their own purposes? For each provider we write only what its own contract text supports.

• Anthropic. Anthropic may not use your data for its own purposes, including training its models; it processes it only to provide its service to us and on our instructions. It may keep data for a time to combat harmful use or to meet a legal duty.
• OpenAI. OpenAI may not use your data to develop, improve or train its models; it uses it only to provide the service, comply with the law and prevent abuse. Abuse-monitoring logs are kept for up to 30 days.
• Cloudflare. Cloudflare processes personal data in the traffic to our app only to provide its service to us and may not use it for marketing or advertising.
• Sentry. Sentry processes your personal data only on our instructions and may not use data that identifies you to train its models without our permission.
• PostHog. PostHog does not let third parties use your data to train their models. PostHog processes your data only on our instructions; we have switched off the use of your data for PostHog's own product and model development.
• Veridyen. Veridyen processes your e-mails and personal data only on our instructions and only to deliver our e-mail; it may not use them for its own purposes. Veridyen relays outgoing e-mail through MailChannels, based in Canada, for deliverability and abuse prevention; during relay the sender and recipient addresses, headers and message content pass through servers abroad.
• fal.ai. fal.ai processes the images we send it to provide its service. Its terms allow it to use anonymised or aggregated data derived from that content for its own purposes, including improving its services and developing its AI models. Content sent and produced may be kept at fal.ai for up to 90 days; produced files stay on public CDN addresses for at least 7 days.
• Higgsfield. When the ad-film feature is enabled, Higgsfield, which produces our ad films, may use the images, videos and text we send it to train and improve its AI models under its standard terms. Content already used for training cannot be removed from models that have already been trained.
• ElevenLabs. When the ad-film feature is enabled, ElevenLabs, which voices our ad films, may use the voice-over text we send it to improve its services and train its models under its standard terms.
• Apify. Apify processes the personal data in the requests we send it as our processor, under its data processing addendum. Its terms let it use usage data derived from those requests, such as metrics and analyses, for its own purposes, including improving its services. Some of the research tools we run on Apify are published by independent developers. Their contract with us lets them process personal data only on our instructions and only to run the tool, and not for any other purpose.
• Telegram. Messages with your brand's Telegram bot pass through Telegram's servers; Telegram is an independent controller for them, under its own privacy policy. Our operator alerts also go through Telegram. Telegram is an independent service. In its own privacy policy, Telegram states that it does not use the contents of private chats for ad targeting or other commercial purposes.
• iyzico. When payments are enabled, they are handled by iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), which processes your payment data as an independent data controller under its own privacy policy.

Card details (when payments are enabled). We never store your full card number. The card is entered on the payment provider's payment page; we store only the card keys the provider gives us (encrypted), the last four digits, the expiry month and year, the card family and type, and the card alias.

Use for advertising: we do not use data we receive from Google to show ads, and we do not sell it. Our Service contains no third-party advertising-network software (SDK).

7. Google API data (Limited Use)

When you connect Google Ads, Analytics, Search Console or Business Profile, we use the data we receive from Google APIs only to provide the Ads and Reports screens and the AI suggestions for your own brand.

ADUARDO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Findings derived from Google data are delivered only to the same customer: in the app, by e-mail report, or through the customer's own Telegram/WhatsApp bot.

• Google API data is not used to train generalized AI models. No training-record writer reads ad data.
• Data derived from Google Ads does not enter the shared sector pool.
• Our team reads this data as a human only for security, legal compliance, with your consent (for example your support request) or for aggregated internal operations. Internal verification tests run only on internal/test brand accounts.
• In an EU political-advertising declaration, the approver's name and e-mail are kept for 7 years because of a legal obligation and are not deleted when the account is deleted.

8. Meta data

We are bound by the Meta Platform Terms and Developer Policies. Message and comment text from Meta and WhatsApp data do not enter the shared pool or model development. Meta ad results are processed linked to your brand's content; the ad name or the ad set/audience segment name and aggregated metrics can appear in the same brand's memory lines. They can reach another brand only through the shared pool, as structured fields and metric ranges that pass the rules in section 5.

9. How images and reports are stored

Generated and uploaded images, videos and report PDFs are stored in a storage area that anyone can read if they know a file's name; the file list cannot be read from outside. Most file names contain a random ID, but not all of them do (for example, Studio layer file names are made of the brand and job number). Anyone who knows a link can reach the content. Unless you share these links, we pass them on only in these cases: (a) when you have content published, the image or video link is sent to the platform you publish to, and the platform fetches the file from there; (b) when your brand's WhatsApp or Telegram bot sends an image, the image link is sent to WhatsApp or Telegram; (c) when you split an image into layers, remove its background or edit it with a written instruction in Studio, the image link (and, for a layer split, the links of the mask files uploaded to storage during the process) is sent to fal.ai, our image-processing provider.

10. Security

• Communication is protected with TLS.
• Passwords are hashed one-way; social media access tokens are stored encrypted (Fernet).
• The session refresh token is kept in an HttpOnly, SameSite=Strict cookie.
• Role-based access control and rate limiting are applied.

11. Retention and deletion

• Account data: while your account is open. When you delete the account it is deleted after a 7-day waiting period; if you sign in during that period, the deletion is cancelled.
• Backups: Deleted data drops out of backups within 7 days at the latest. Database backups (daily backups and a 7-day point-in-time recovery log) are kept for 7 days.
• Content, campaign, memory, report and connection data: while the account is open; deleted with the account.
• Sample records of generated content: while the account is open; the records of the brands you own are deleted with the account.
• Billing details and saved card: deleted with the account; only the financial records below are kept.
• Sign-in records: 12 months. Technical event records and e-mail delivery records: 13 months. These are also deleted when the account is deleted.
• Read notifications: 90 days. Assistant messages: 90 days. Insight (performance) data: 400 days. Instagram story metrics are deleted together with the post.
• Assistant conversation record (including the phone number or Telegram chat ID of the person who writes to your brand's bot): deleted once the conversation has been closed for 90 days, or when the account is deleted. The record of a conversation that has not been closed stays even after its messages are deleted.
• Ad order data: 730 days; order events: 90 days.
• Assistant chat attachments (photo, audio, video): deleted when their retention period ends, where one is set.
• Brand memory: old entries are first moved to an archive and then removed from the working table; the archive is kept until the account is deleted.
• Records kept after the account is deleted. The following are not deleted when your account is deleted:
  • Financial records: if you have a successful or refunded payment, it is kept for 10 years, with the link to you removed, because of a legal obligation (Turkish Commercial Code, Tax Procedure Law). The record keeps the amount, currency, date, plan and billing period, the payment provider's transaction and payment-form numbers, and the status details bookkeeping needs; the card link, the provider's raw reply and the error text are deleted. Everything else is deleted.
  • Anonymised account record: if a kept record (for example a payment) points to your account, your account row is not deleted but anonymised: your name, phone, organisation and job title, Google link, two-step verification and consent details are deleted; your e-mail address and password are replaced with meaningless values and the account is closed.
  • EU political-advertising declaration: if you approved an EU political-advertising declaration in Google Ads, the approver's name and e-mail are kept for 7 years because of a legal obligation.
  • Trial-abuse record: to prevent repeated abuse of the trial, a one-way digest of your e-mail address is kept for 730 days (legitimate interest).
  • Demo request: what you type into the demo form stays as a sales record; you can ask for its deletion at destek@aduardomind.com.
  • WhatsApp group record: so that we can close the group on the WhatsApp side, it is kept for a while with the brand link removed.
  • Our team's administrator accounts: if the account belongs to one of our administrators, the security audit trail and the financial records they entered (provider invoices, refund records, exchange rates) stay; the account is anonymised as above.
  • Deletion notice: the send record of the e-mail telling you that your account was deleted (including your e-mail address) is kept for 13 months.
• Token/usage records: kept as the token ledger for the life of the account. In brands you do not own, the link to you is removed; the record stays in that brand's ledger.
• Brands you do not own: your membership and your templates, jobs and conversations in those brands are deleted; the social media and ad accounts you connected there are disconnected and the brand owner is told (you are not named); older connections for which we did not record who made them are excluded and stay with the brand. Files you uploaded to the brand stay with the brand and pass to its owner; your calendar comments stay with your short name (e.g. "Ayşe K."); the records in the brand's token ledger and the design and visual work you started stay with the brand, with the link to you removed. Your phone number in a WhatsApp group is deleted; your display name stays.
• Access tokens: when you disconnect or delete your account, the stored access tokens are deleted on our side. Only the brand owner can disconnect; on disconnect the connection record and its past report data stay with the brand. We do not revoke the access permission at the platform today; to remove it, use the platform's own settings (Meta, Google, LinkedIn, Pinterest).
• Files: during deletion your brand's images, videos and reports are removed from storage. Files whose address is kept in no record (for example cover images generated automatically for Pinterest video pins) and files whose record was already gone before deletion may not be found; those may remain.

The deletion steps are on the Data Deletion page.

12. Your rights and how to apply

Under KVKK Art. 11 you have the right to learn whether your data is processed, to request information, to learn the purpose and whether it is used accordingly, to know the third parties it is transferred to, to request correction, deletion or destruction, to ask that these actions be notified to third parties, to object to a result against you from exclusively automated analysis, and to request compensation for damage.

To apply: destek@aduardomind.com. Applications are answered within 30 days at the latest.

Objecting to the model-development purpose: if you are the brand owner, turn off the switch under Settings → Project & Data → Data and learning (Ayarlar → Proje & Veri → Veri ve öğrenme); if you are not (an editor, a viewer, or a person whose data is in a brand), write to destek@aduardomind.com and we will record your objection.

13. Transfers abroad

Our providers may process data on servers outside Türkiye (the table in section 6). Our e-mail provider Veridyen, based in Türkiye, also sends outgoing e-mail through a relay service in Canada. Transfers are made within the framework of KVKK Art. 9; you can ask destek@aduardomind.com which safeguard we rely on for each provider.

14. Children

The Service is not directed at people under 18; we do not knowingly collect data from people under 18.

15. Changes and notice

We notify material changes at your registered e-mail address; the current text is on this page. We notify existing users 30 days in advance, by e-mail and in the app, that the model-development purpose is being added; your existing data is not used for that purpose before the period ends.

16. Contact

destek@aduardomind.com — aduardomind.com