KVKK Privacy Notice
Notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).
Effective: 2 November 2026 · Version 3.0 · Last updated: 2 November 2026
1. Data controller
The data controller is the sole proprietorship trading as Art'st Studio. The legal name, tax details and address are on the Seller information page (https://artststudio.com/en/legal/seller-information). Contact: iletisim@artststudio.com and https://artststudio.com/en/contact.
This notice is prepared under Article 10 of Law No. 6698 and the Communiqué on the Procedures and Principles for the Duty to Inform, and applies to all Art'st Studio services.
2. Data processed and purposes
- Identity and contact (name, email, optional phone): opening the account, sign-in, support and important notices.
- Account security (password hash, two-step key, session records, IP address): protecting the account and the service and preventing abuse.
- Content (images, text, product details you upload): preparing the post, product, ad or suggestion you ask for.
- Connected-account data (access tokens, account IDs, post and ad performance): carrying out the publishing and reports you approve.
- Transaction data (plan, amount, transaction ID, time of contract acceptance, refund requests): forming and performing the sales contract, tax and accounting duties.
- Marketing (campaign and announcement emails): only if you opt in separately.
- Cookie and device data: essential cookies for sign-in; with consent, analytics and ad measurement.
3. Legal grounds
- Forming or performing a contract (Art. 5/2-c): account, plan and service.
- Legal obligation (Art. 5/2-ç): invoice, tax and consumer-law records.
- Establishing, exercising or protecting a right (Art. 5/2-e): keeping approval and transaction records.
- Legitimate interest (Art. 5/2-f): security, error logs, improving the service.
- Explicit consent (Art. 5/1): analytics and ad cookies, commercial electronic messages and passing Vitrin statistics to Ads suggestions. Not consenting does not stop you using the service.
4. How data is collected
Electronically, by automated or partly automated means: account and payment forms, in-app actions, the APIs of platforms you connect, and cookies.
5. Recipients and transfers abroad
Data is passed, only as far as needed, to hosting, database, email, payment, AI and sign-in providers, to the social and ad platforms you connect (only for actions you approve) and to authorities where the law requires.
Some hosting, database, email, AI and sign-in services are outside Türkiye (see the country column). Your personal data may therefore be transferred abroad. Transfers follow the conditions in Article 9 of Law No. 6698 and are limited to what the service needs.
The full list of providers and their countries is in the Privacy Policy table.
| Provider | Purpose | Data | Country |
|---|---|---|---|
| Vercel | Hosting, file storage, site metrics | Request logs, media you upload | USA |
| Neon | Database | Account, plan and content records | EU / USA |
| Upstash | Rate limiting and short-lived cache | IP address, session ID | EU / USA |
| iyzico | Plan payments | Payment amount and transaction ID (card data never reaches us) | Türkiye |
| Resend | Account and alert emails | Email address, email content | USA |
| Brevo | Backup email sending (when Resend does not answer) | Email address, email content | EU (France) |
| Google Drive | Backup of published post images and the database in Art'st Studio's own account | Images, account and content records | USA |
| Google (Search Console, Analytics, İşletme Profili) | Reading reports of the account you connect in SEO and Marka (if you connect it) | Access token, site and property reports | USA |
| Google Play | Verifying purchases in the Android app | Purchase token, product ID | USA |
| Google (Firebase Cloud Messaging) | App notifications (if you turn them on) | Device token, notification text | USA |
| Google (Analytics, Tag Manager, Ads, AdSense) | Measurement and ad cookies, only if you consent | Cookie IDs, page views | USA |
| Google Translate | Translating the page (if you pick a language) | Page text, IP address | USA |
| Google, Meta, X (giriş) | Signing in with these accounts (if you choose) | Name, email, profile photo | USA / Ireland |
| Meta, Google (YouTube, Google Ads), TikTok, LinkedIn, X, Pinterest, Etsy | Publishing and advertising you approve on accounts you connect, and reporting | Access token, post/ad content, performance data | USA / Ireland / Singapore |
| Shopify, ikas | Writing products to a store you connect (Store) | Product details, access token | Canada / Türkiye |
| Yapay zekâ sağlayıcıları (Google Gemini, Anthropic, OpenRouter, xAI, Pollinations; yedek: Groq, Mistral, Hugging Face) | Drafting copy, hashtags, images and campaign suggestions; a backup provider when the main one does not answer | Product/business text and images; no name or email is sent | USA / EU |
| Telegram | Notification messages and posts to a channel you add (only if you connect it) | Telegram user ID or the ID and name of the channel you add, message text; channel messages and member lists are not read | UAE / EU |
| IMG.LY | Downloading the background remover model files | IP address (your image never leaves your browser) | EU |
| Cloudflare (Turnstile, Workers AI) | Bot protection (Ads); AI fallback (Workers AI) | Browser signals; for the AI fallback, product/business text (no name or email is sent) | USA |
6. Your rights (Art. 11)
Send your request in writing from the email address registered to your account to iletisim@artststudio.com, or to the address on the Seller information page. Include your name, contact details and what you are asking for. Requests are answered free of charge within 30 days; if handling one has a real cost, the fee set by the Personal Data Protection Board may apply. If you get no answer or the answer is not enough, you can complain to the Personal Data Protection Board.
- learn whether your personal data is processed,
- ask for information about it,
- learn the purpose of processing and whether it is used for that purpose,
- know the third parties it is transferred to, in Türkiye or abroad,
- ask for correction if it is incomplete or wrong,
- ask for deletion or destruction under Article 7 of the Law,
- ask that a correction, deletion or destruction is passed on to those third parties,
- object to an outcome against you that results only from automated analysis,
- claim compensation for damage caused by unlawful processing.