Privacy Policy

This policy covers all of the Art'st Studio services below. They have one data controller and one account (your Art'st Studio account).

The data controller is the sole proprietorship trading as Art'st Studio. The legal name, tax details and address are on the Seller information page (https://artststudio.com/en/legal/seller-information). Contact: iletisim@artststudio.com and https://artststudio.com/en/contact.

• artststudio.com: the main site, plans, free tools (background remover, QR code) and guide articles.
• Marka (marka.artststudio.com): brand name, slogan, colour and copy suggestions.
• Vitrin (vitrin.artststudio.com and the Android app): preparing social posts and publishing them on accounts you connect.
• Store / Mağaza (tezgah.artststudio.com): product records and writing products to stores you connect.
• Ads / Reklam (reklam.artststudio.com): preparing and reporting ad campaigns with your approval.
• SEO (seo.artststudio.com): reviewing a site's search visibility and suggesting fixes.
• Admin panel (admin.artststudio.com): for authorised Art'st Studio staff only.

Your account keeps your name, email address and a hash of your password (never the password itself). A phone number is optional; it is not verified and no SMS is sent. If you turn on two-step verification, its key is stored encrypted.

If you sign in with a social account shown on the sign-in screen (Google; others when set up and switched on; the buttons follow the current provider list), we receive only the name, email and profile photo the provider gives (for Google: openid, profile, email). Nothing else in those accounts is accessed.

One shared session cookie works across all *.artststudio.com sites for single sign-in. The cookies are listed in the Cookie Policy.

Instagram (professional account): your username and account ID (instagram_business_basic); publishing the image and caption you approve (instagram_business_content_publish); showing, replying to, hiding or turning off comments on posts you share from Vitrin (instagram_business_manage_comments); if you allow it, incoming messages so you can answer customers (instagram_manage_messages); reach, like and save counts of those posts (instagram_business_manage_insights). Follower lists are not read.

Facebook Page: the Pages you manage (pages_show_list), posting to the Page you pick (pages_manage_posts) and engagement counts of those posts (pages_read_engagement); subscribing that Page to the app for new comment notifications (pages_manage_metadata); if the Page is in a business portfolio, that portfolio's Page list (business_management). Your personal profile and messages are not read.

Threads: your username (threads_basic) and the post you publish (threads_content_publish). Replies and insights are not read.

TikTok: your name and profile photo (user.info.basic); your video is uploaded with the visibility you pick (video.publish).

YouTube: your channel name (youtube.readonly) and the video you upload (youtube.upload). By connecting YouTube you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms); the Google Privacy Policy (https://policies.google.com/privacy) applies. Remove access in Settings > Connected accounts or at https://security.google.com/settings/security/permissions.

X: your name and handle (users.read, tweet.read), text and up to four images (tweet.write, media.write), and a refresh token that keeps you signed in (offline.access).

LinkedIn: your name and profile (openid, profile), the text and image you share (w_member_social). Pinterest: your boards, your pins and the pin you create (boards:read, pins:read, pins:write).

Bluesky (with an app password; your account password is never asked for), Mastodon (read:accounts, write:statuses, write:media), Reddit (identity, submit), Tumblr (basic, write, offline_access), Telegram (the ID and name of the channel you add; channel messages are not read) and Google Business Profile (business.manage; reviews are not read): only the post you approve is published.

Access tokens are stored encrypted on the server, used only for actions you approve, and never sold or handed to others. Disconnecting in Settings > Connected accounts deletes that token.

If you connect a Shopify or ikas store, its access token and the product details you write are processed; only products you approve are written to that store. Customer and order records in your store are not read.

If you connect a Meta (Facebook/Instagram) ad account, an encrypted access token and the IDs of the ad account, Facebook Page and Instagram account are processed. Campaigns are created paused on Meta and start only when you press "Go live".

If you connect Google Ads, only the adwords scope is used to read the ad account, campaigns and performance, to create and report campaigns on your instruction. If you connect TikTok or Etsy, likewise only the actions you approve are taken.

Summary statistics from Vitrin used for campaign suggestions (age ranges, city/country, engagement rate, average reach) are kept for at most 90 days; campaign and approval records are kept for 2 years as proof, and security logs without personal data for 30 days.

Meta or Google charge ad spend directly to the payment method in your ad account; those card details never reach us.

In SEO, connecting Google Search Console reads only the search performance and index status of the site you pick (webmasters.readonly). In Marka, connecting Google Analytics or Google Business Profile reads only summary reports of the property you pick (analytics.readonly, business.manage).

This data is used only to show you reports and suggestions; you can remove access at any time.

Art'st Studio's use and transfer of information received from Google APIs (Google sign-in, YouTube, Google Ads, Search Console, Analytics, Business Profile, Drive) adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

This data is used only to provide the features you use; it is not sold, not used for advertising and not used to train generalised AI models. No person reads it unless you give explicit consent, it is needed for security (investigating abuse) or the law requires it.

For captions, hashtags, images or campaign suggestions, the image and product/business text you provide are sent to an AI provider. No name, email or phone is sent. Your shop name is used only if it is on the image or you entered it as the shop name.

Until you press "Accept" on the cookie notice, Google Tag Manager, Google Analytics, Google Ads and AdSense do not load and no measurement request goes to Google. If you press "Reject", they never load. The free plan includes ads; refusing personalised ads does not close the service.

Google's advertising cookies let ads be shown based on your visits to this and other sites. You can turn off personalised ads at https://adssettings.google.com. How Google uses data: https://policies.google.com/technologies/partner-sites

If you turn on notifications, a device token is stored so we can reach your device; it is not used once you turn them off and is deleted with your account.

A crashed page may be written to an error log; your email is left out and the log is kept for at most 90 days.

Plan payments are completed on iyzico's payment page; your card number never reaches us and is not stored. The amount, plan, transaction ID and the time you accepted the contract are kept.

• Account, content and settings: until you delete your account.
• Connected-account tokens: until you disconnect or delete your account.
• Images of published posts: backed up in Art'st Studio's own cloud storage (including Google Drive); deleted with their backups when you delete your account.
• Payment, invoice and refund records: up to ten years, as tax and commercial law require.
• Error logs: at most 90 days. Ads security logs: 30 days.
• Cookie choice: 180 days.

Personal data is never sold. It is shared only as far as needed to run the service, with the providers below. Where the law requires, it may also be given to the competent authorities.

Some hosting, database, email, AI and sign-in services are outside Türkiye (see the country column). Your personal data may therefore be transferred abroad. Transfers follow the conditions in Article 9 of Law No. 6698 and are limited to what the service needs.

Connections are encrypted with HTTPS. Access tokens and two-step verification keys are stored encrypted. Each user can reach only their own data.

Under Article 11 of Law No. 6698 you have the right to:

Send your request in writing from the email address registered to your account to iletisim@artststudio.com, or to the address on the Seller information page. Include your name, contact details and what you are asking for. Requests are answered free of charge within 30 days; if handling one has a real cost, the fee set by the Personal Data Protection Board may apply. If you get no answer or the answer is not enough, you can complain to the Personal Data Protection Board.

• learn whether your personal data is processed,
• ask for information about it,
• learn the purpose of processing and whether it is used for that purpose,
• know the third parties it is transferred to, in Türkiye or abroad,
• ask for correction if it is incomplete or wrong,
• ask for deletion or destruction under Article 7 of the Law,
• ask that a correction, deletion or destruction is passed on to those third parties,
• object to an outcome against you that results only from automated analysis,
• claim compensation for damage caused by unlawful processing.

You can delete your account yourself in each app's Settings; the steps are on the Data Deletion page. Everything is deleted except payment records the law requires us to keep.

This policy may be updated. The current version is always published at this address; we also email you about important changes.