Introduction
At Infumar, we are committed to protecting your personal information and your right to privacy. This privacy policy explains how we process the information we collect through our website infumar.com, our mobile application, and all related services.
This policy is here to inform you about how your personal data is processed. Where an operation requires your explicit consent, it is asked for separately; not giving such consent does not prevent you from using our services.
Data Collection
Personal Information You Provide
When you register on our platform and use our services, we collect the following information:
- First name, last name, and username
- Email address
- Phone number
- Billing and shipping address
- Payment information: your card details are entered on PayTR's payment page and are not stored by us; your IBAN so that you can be paid
- Turkish ID number or tax number and tax office, for invoicing and payouts
- Social media account information and usernames
- Content you share (photos, videos, text)
Automatically Collected Information
Some information is automatically collected when you use our services:
- IP address
- Device type, model, and operating system
- Browser type and version
- In the mobile app: your device's notification token, app version and operating system, so we can send you notifications. The camera and photo library are accessed only when you upload a photo or video, with your permission; they are never read in the background.
- Platform usage data and interaction information
- For advertiser accounts: creator profiles opened, filtered searches made, and clicks on creators' social accounts or custom links. These records are kept for platform security and to check compliance with its terms, and are deleted after 180 days.
- Advertising and measurement data: if you allowed it in the cookie notice, the pages you visit, actions such as signing up, ad click identifiers (fbclid, gclid) and browser/cookie identifiers.
- First-visit source: the source details of the link that first brought you to the site (UTM parameters, ad click identifier, referring site and first page opened) are kept in your browser and, if you sign up, linked to your account. We use this to measure which promotional channel works; we do not share it with advertising partners.
How We Use Your Data
We use the personal data we collect for the following purposes:
- Account creation and authentication
- Providing and improving our services
- Processing payments
- Communicating with you and providing support
- Security and fraud prevention
- Analyzing platform performance
- Campaign, product and offer announcements: to individual users only if they gave consent to commercial electronic messages; to merchant and trade users to the extent permitted by Law No. 6563. You can opt out at any time via the link in each message or through the Message Management System (İYS).
- Fulfilling legal obligations
Data Sharing
We only share your personal data with third parties when necessary to provide our services:
Service Providers
- Cloud infrastructure, hosting and storage (Vercel, Railway, Supabase, Cloudflare)
- Payment processor (PayTR)
- Communication services (email via Resend, SMS via Netgsm, mobile notifications via Expo)
- Error monitoring (Sentry): processes errors and, with text masked and media blocked, a small share of sessions
- AI services (Anthropic, OpenAI, Google): only the relevant text, for features such as brief and creative drafts and category suggestions
- Advertising and measurement partners (only if you allowed cookies): Meta Platforms Ireland Ltd. (Facebook, Instagram) and Google Ireland Ltd. (Google Ads, Google Analytics).
We do not sell your personal data. Data is passed to our advertising and measurement partners only to the extent you allowed in your cookie preferences, to measure the results of our ads and to show our ads to people who may be interested. You can withdraw your permission at any time via the "Cookie Preferences" link at the bottom of the page.
Measuring Our Advertising
We promote infumar with ads on Meta (Facebook, Instagram) and Google. If you allow it in the cookie notice, the Meta Pixel and the Google tag on our site send actions such as page views and sign-ups to these companies. Events sent to Meta may travel, besides your browser, through Meta's server-side relay (Conversions API Gateway); that path carries only the events you allowed and contains no email address or phone number.
With this data we measure how many people our ads reach and how many sign-ups they bring. We also build visitor groups on Meta and Google to show ads again to people who visited our site, or not to show ads at all to people who already signed up. Meta and Google may also process this data for their own purposes under their own privacy policies.
We pass your email address or phone number to Meta or Google for advertising only if you separately gave your explicit consent for it, and only in encrypted (hashed) form. Advertising Audience Explicit Consent
International Transfers
The servers of the infrastructure providers that host and run our services (Vercel, Railway, Supabase, Cloudflare), of our communication, error-monitoring and AI providers (Resend, Expo, Sentry, Anthropic, OpenAI, Google) and of our advertising and measurement partners (Meta, Google) are located outside Türkiye, mainly in the European Union and the United States. These transfers are made under Article 9 of the KVKK, by signing the standard contracts announced by the Personal Data Protection Board and notifying the Board, or on the other grounds listed in the Law.
Customer Data of Connected Stores
When an advertiser connects an e-commerce store (Shopify, ikas, IdeaSoft, WooCommerce or its own software) to Infumar, we process limited order data about that store's customers solely to determine which creator's affiliate link a sale came from and to calculate that creator's commission. For this data the store is the data controller and Infumar processes it on the store's behalf.
Data we process
- Order number, date, total, currency and the products ordered
- The short code of the affiliate link the order came from; the IP address and browser details of the device that clicked the link (to filter out invalid and repeated clicks)
- We do not process or store the store customer's name, email address, phone number, or shipping or billing address.
The tracking code added to the store's pages keeps the link's short code in a first-party cookie for 30 days. If the store's consent tool reports that the customer has not given marketing consent, this cookie is not written.
Sales attributed to a creator are kept for the legally required retention periods, because they support the payment made and the invoice issued; records of orders that could not be attributed are deleted automatically after a set period. When a store uninstalls the Infumar app, our access keys to that store are deleted. This data is not used for any other purpose, not sold, and not shared with third parties other than the infrastructure providers needed to deliver the service.
Connected Social Media Accounts
Creators can connect their Instagram, TikTok or YouTube account to Infumar through the platform's own consent screen. Connecting is optional and your password never reaches Infumar. Only the read-only data you allow on the consent screen is taken:
- Instagram: account id, username, account type, follower and post counts; your followers' gender, age, country and city breakdown, and post and story statistics.
- TikTok: account id, username, follower, like and video counts; your public videos with their view, like, comment and share counts.
- YouTube: channel id, channel name, subscriber and video counts; your channel's viewer breakdown (age, gender, country) and video statistics.
This data is used to verify that the account is yours, to show your statistics and audience breakdown on your profile, to help advertisers decide on collaborations and to report your collaborations' results. Nothing is ever posted, changed or deleted on any platform on your behalf. The data is not sold and is not shared with third parties for advertising.
Infumar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Access tokens are stored encrypted. You can remove a connection at any time from your profile on Infumar or from the platform's own settings (Instagram: Settings → Website and apps; TikTok: Settings → Security → Permissions; Google: myaccount.google.com/permissions). When a connection is removed, its access tokens and the audience data taken from that account are deleted. You can also request deletion of your data at iletisim@infumar.com.
Data Retention
We keep your personal data only as long as needed for the purposes in this policy. When you delete your account, your account and profile data is deleted immediately; payment, earnings and invoice records are kept for the periods required by tax and commercial law. The periods for each category are listed in the KVKK Information Notice.
Data Security
We implement appropriate technical and organizational security measures to protect your personal data. However, please note that no data transmission over the internet or storage method is 100% secure. We do our best to protect your data, but we cannot guarantee absolute security.
Your Rights
You have the following rights regarding your personal data:
- Right to access and request a copy of your data
- Right to request correction of inaccurate or incomplete data
- Right to request deletion of your data
- Right to request restriction of data processing
- Right to receive your data in a portable format
- Right to object to data processing
- Right to withdraw your consent at any time
Cookies
Our website and application use cookies to improve your experience. You can manage or disable cookies through your browser settings.
For more information about cookies, see our Cookie Policy.
Children's Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from individuals under 18. If you become aware that we have collected personal data from someone under 18, please contact us.
Policy Updates
We may update this privacy policy from time to time. When changes are made, we will post the updated policy on this page and update the 'Last updated' date. For significant changes, we may notify you by email.
Contact
If you have questions about our privacy policy or the processing of your personal data, you can contact us:
Email: iletisim@infumar.com