1. Data Controller
Data controller: infumar · iletisim@infumar.com. This notice is prepared under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
2. Which Data We Process, Why, and on What Legal Basis
| Data category | Purpose | Legal basis (KVKK Art. 5) |
|---|---|---|
| Identity and contact (name, surname, username, email, phone, address) | Membership, account management, running collaborations, product shipping, support | Formation and performance of a contract (Art. 5/2-c) |
| Financial (IBAN, invoice details, payment and balance records; Turkish ID number for content creators and for anyone requesting a personal invoice, tax number for companies) | Payments, earnings, invoicing, expense vouchers and withholding, sub-merchant registration with the payment institution | Performance of a contract (c); legal obligation (ç): Tax Procedure Law, Income Tax Law, Commercial Code |
| Social media data (account, followers, post statistics, audience breakdown, public post captions) | Account verification, presentation to advertisers, suggested pricing and reporting | Performance of a contract (c) |
| Content (uploaded images, videos, text, briefs and messages) | Running campaigns, resolving disputes | Performance of a contract (c); establishing, exercising or protecting a right (e) |
| Transaction security (IP address, device and browser details, notification token and app version in the mobile app, session and transaction logs, affiliate click records, error and session recordings with text masked) | Account and payment security, preventing fake clicks and fraud, fixing errors | Legal obligation (ç); legitimate interest (f) |
| First-visit source (UTM parameters, ad click identifier, referring site, first page opened) and partner referral code | Measuring promotional channels, determining the share of the partner who referred you | Legitimate interest (f); performance of a contract (c) |
| Marketing and statistics cookie data (page views, sign-up event, cookie and click identifiers) | Ad measurement, building visitor groups | Explicit consent (cookie notice) |
| Encrypted (hashed) email address and phone number | Building advertising audiences on Meta and Google, excluding registered users from ads | Explicit consent (separate consent) |
| Commercial electronic message preference | Sending campaigns and announcements | Consent (Law No. 6563, Art. 6) |
3. Who We Share Personal Data With
- Infrastructure, hosting and storage: Vercel Inc., Railway Corp., Supabase Inc., Cloudflare Inc.
- Payments: PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş.
- Email, SMS and notifications: Resend Inc., Netgsm İletişim ve Bilgi Teknolojileri A.Ş., Expo (650 Industries Inc.)
- Error monitoring: Functional Software Inc. (Sentry)
- AI features (such as brief and creative drafts, category suggestions): Anthropic PBC, OpenAI LLC, Google LLC; only the relevant text
- Advertising and measurement (only with your explicit consent): Meta Platforms Ireland Ltd., Google Ireland Ltd.
- Other users you collaborate with (advertiser and content creator), as far as the collaboration requires
- Competent public authorities and courts on request; our legal and financial advisers
4. International Transfers
Some of the infrastructure, communication, error-monitoring, AI and advertising providers above have servers outside Türkiye, mainly in the European Union and the United States. These transfers are made under KVKK Article 9 by signing the standard contracts announced by the Personal Data Protection Board and notifying the Board. Transfers for advertising also rely on your explicit consent.
5. How We Collect Data
Your personal data is collected through sign-up and profile forms, the mobile app, the social media accounts you connect (official APIs) and public profile pages, the e-commerce stores you connect, cookies and similar technologies, and email and support channels; by automated and partly automated means.
6. Retention Periods
- Account and profile data: for as long as your account is open. Deleted immediately when you delete your account.
- Payment, earnings, invoice and balance records: even after account deletion, for the periods set by tax and commercial law (5 years under the Tax Procedure Law, 10 years under the Commercial Code).
- Transaction security and affiliate click records: for as long as the payment and earnings records they support.
- Advertiser activity records (profiles opened, filtered searches, external link clicks): 180 days.
- Notifications: 30 days once read, 180 days if unread.
- Sale matching attempts from connected stores: 30 days if matched, 180 days if not.
- Collaboration content files: deleted when the content usage right ends.
- Cookies: for the periods in the Cookie Policy.
- Records of explicit consent and commercial message consent (when given and withdrawn, and the version of the text agreed to): for as long as your account is open.
When a retention period ends, the data is deleted, destroyed or anonymised.
7. Your Rights (KVKK Art. 11)
Under Article 11 of the KVKK you have the right to:
- Learn whether your personal data is processed
- Request information if it has been processed
- Learn the purpose of processing and whether it is used accordingly
- Know the third parties in Türkiye or abroad to whom your data is transferred
- Request correction of incomplete or inaccurate data
- Request deletion or destruction of your data under the conditions of the KVKK
- Request that correction, deletion or destruction be notified to the third parties your data was transferred to
- Object to an outcome against you arising solely from automated analysis of your data
- Claim compensation for damage caused by unlawful processing
8. How to Apply
You can send your requests, with information that verifies your identity, from the email address registered in our system to the address below, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests are concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee in the Board's tariff may be charged.
Email: iletisim@infumar.com