This policy explains what personal data LinkSosyal (the “Platform”) processes, for which purposes, with whom and on what legal basis it is shared, how long it is retained, and your rights under Turkish Law No. 6698 (KVKK). By registering, you acknowledge that you have read and accept this policy.

1. Data Controller and Scope

Data controller: the operator of the LinkSosyal service, Rioforge Information Solutions (unit “Rioforge Digital Solutions”; registered with the Ministry of Micro, Small and Medium Enterprises, Government of India, Udyam Registration No. UDYAM-UP-02-0016102; Delhi, India) — phone: +90 530 306 28 53, e-mail: merhaba@linksosyal.com.

LinkSosyal is operated by a business registered in India and serves users in Türkiye. Turkish Law No. 6698 (KVKK) therefore applies to users in Türkiye, and India's Information Technology Act, 2000 and Digital Personal Data Protection Act, 2023 (DPDP Act) apply to our business.

This policy covers personal data processed while you use our website, the creator dashboard, public bio/store pages and our official API integrations. Section 3 explains that creators also act as data controllers for their own buyers and followers.

This policy applies to linksosyal.com and all of its subdomains (for example public bio pages), operated by Rioforge Information Solutions (the controller details above).

You may submit KVKK art. 11 requests to merhaba@linksosyal.com; requests are answered within 30 days at the latest. Information for EU/EEA/UK users under the GDPR is in section 13/A, and for the Indian DPDP Act in section 13/B.

2. Personal Data Processed

Identity and contact data: first and last name, e-mail, phone number where provided
Account and organization data: membership, role, team membership, session and security records, cookie preference record
Connected Instagram/Meta account data: public profile information, post and comment IDs, comment texts, commenter usernames, message threads, mention/tag events, interaction events and related technical identifiers — only with your explicit authorization and via official Meta APIs
Seller (creator) data: products, prices, stock, discount codes, campaigns, refund and invoice records
Buyer and CRM data: names, e-mail addresses, phone numbers, addresses and order details of buyers; names, e-mail addresses/Instagram IDs, tags and notes collected through lead forms
Product reviews, Q&A content and uploaded photos (including the reviewer's own photo)
Transaction data: orders, collection and refund records, payment service provider responses and verification records — card data is never stored by the Platform
Technical data: IP address, browser and device information, sign-in records, error and access logs
AI processing data: persona definition, example replies, message/comment texts sent for automatic reply generation, and generation logs
Meeting booking data: the name, e-mail, optional phone, optional address, note, time zone and chosen time of a person who books on a creator's page (section 7/B)
Google Calendar data: only when a creator connects it; details in section 7/A

3. Roles: Platform vs. Creator

For account, organization and platform-usage data, LinkSosyal is the data controller.

For buyer, order, delivery and buyer–creator messaging data in a creator's store, LinkSosyal acts as a data processor on the creator's instructions; the disclosure duty for that data lies with the seller-creator, under the data-processing arrangement between us set out in the Terms of Service.

For data obtained from your own Instagram/Meta account, the disclosure duty toward data subjects may rest with the creator or the Platform depending on the purpose of collection; the parties act in line with KVKK art. 10 and the Turkish Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

Instagram/Meta is an independent data controller for the processing it carries out on its own products; Meta's processing is governed by Meta's own policies.

4. Purposes and Legal Bases

Creating and operating the service (dashboard, bio page, store, automations) — performance of a contract (KVKK art. 5/2-c)
Running payment, invoicing, delivery and refund processes — performance of a contract (art. 5/2-c) and legal obligation (art. 5/2-ç)
Invoicing, accounting and statutory retention — legal obligation (art. 5/2-ç)
Account security, abuse, spam and fraud prevention, platform integrity — legitimate interest (art. 5/2-f)
Handling requests, complaints and disputes; establishing, exercising or protecting a right — legitimate interest (art. 5/2-f) and legal claims (art. 5/2-e)
Running automations and AI-assisted reply/content generation (on your instruction) — performance of a contract (art. 5/2-c)
Analytics and service improvement (aggregated measurement) — legitimate interest (art. 5/2-f)
Marketing and commercial electronic messages — explicit consent (art. 5/1); you may withdraw at any time
Non-essential cookies and similar technologies — explicit consent (art. 5/1)

5. Artificial Intelligence and Automated Processing

The Platform uses Claude AI models provided by Anthropic, PBC (USA). Text is sent to Anthropic only for these features: (a) Collab Radar on Pro and higher plans — when our rule-based checks are not confident, inbound DM conversations are classified automatically (for example as a brand collaboration offer); up to the 20 most recent inbound messages of that conversation are sent for this; (b) features you turn on yourself — AI-drafted DM replies (suggest or auto mode), AI intent triggers on an automation, AI personalization of automated messages and, where offered on your account, AI-assisted comment moderation (Comment Guard).

We send only the text the task needs — never your password or access tokens. AI usage records keep token counts, not the text. We do not use Instagram data to train AI models, and Anthropic does not use API data to train its models.

Automations run on your instruction and your rules. Where the applicable law requires it and a reply is generated without a human, the use of automated handling is disclosed to the data subject.

AI output is submitted for your approval or sent on your instruction; final content responsibility rests with the creator
Where a result is produced exclusively by automated means against you, your right to object under KVKK art. 11/(g) is reserved

6. Transfers and Cross-Border Transfers

Data is shared only to the extent necessary to run the service, limited to the relevant purpose and legal basis, with the service providers below. Our website does not use third-party advertising or analytics tools (e.g. Google Analytics, Meta Pixel); usage is measured on our own servers in aggregate.

Railway (hosting, database, queues and uploaded files) — data is hosted in the European Union (the Netherlands, europe-west4 region)

Meta Platforms (Instagram API: profile, media, comment and message data of the connected account, with your authorization)

Google Firebase Authentication (only when you choose “Sign in with Google”)

E-mail delivery (Resend or an SMTP provider): verification, password-reset and notification e-mails

Anthropic, PBC (Claude AI models — USA): only the comment/message text needed for the AI features listed in section 5; under Anthropic’s commercial terms, data sent through its API is not used to train its models

Payment service providers (iyzico and PayTR — Türkiye; Razorpay — India): LinkSosyal plan payments only; card details are never stored by us

Sentry (error monitoring): technical error records

Google (Google Calendar API): only when a creator chooses “Connect Google Calendar”; details in the “Google user data” section

Data is hosted outside Türkiye (in the EU) and the business operating the service is in India, so personal data is transferred abroad.

Cross-border transfers apply the regime of KVKK art. 9 as amended by Law No. 7499: (i) transfer to a country/sector/organization for which the Board has issued an adequacy decision; absent that, (ii) the standard contract published by the Board (with notification), (iii) binding corporate rules, or (iv) a written undertaking and Board authorization; where none applies, the statutory derogations are relied on.

For Meta's transfers outside the EEA, Meta's own transfer mechanisms apply; the Platform complies with the relevant data-transfer provisions of the Meta Platform Terms.

7. Processing of Meta/Instagram Data

We access Meta data only through official Meta APIs; we never request or store your password.

Under the Meta Platform Terms, we process Platform Data only for the purposes clearly described in this policy; this policy may not be interpreted inconsistently with Meta's terms.

We do not sell, license or purchase Platform Data
We do not attempt to re-identify, decode or reverse-engineer Platform Data
We do not build or augment user profiles with Platform Data without valid user consent
We do not process Platform Data for surveillance or in a discriminatory manner
We delete Platform Data when the purpose ends, when you disconnect, or when Meta requests it; where retention is required by law we document that basis
We provide an easily accessible way for users to request deletion of their data
We do not use Platform Data for advertising and do not share it with ad networks or data brokers
Meta permissions we request and why: instagram_business_basic — the connected account’s ID, username, profile picture, account type, follower/following/post counts and your recent media, to identify your account, show it in the dashboard and let you pick posts for automations
instagram_business_manage_comments — to read comments on your posts, post public replies, hide comments that match your moderation keywords, and delete a single comment only when you click “Delete on Instagram”
instagram_business_manage_messages — to send the automated DM (private reply) to commenters and to read and answer DMs in your Inbox
Business Asset User Profile Access — the name, username and profile picture of people who comment on or message your account, shown in your Inbox, Comments and Contacts pages
Meta Platform Terms: https://developers.facebook.com/terms/ · Developer Policies: https://developers.facebook.com/devpolicy/
To delete your data: Profile → Security → “Delete my data” (immediate); Instagram → Settings → Apps and websites → LinkSosyal → Remove (immediate, through Meta’s deletion request); or email merhaba@linksosyal.com. Step-by-step instructions: https://linksosyal.com/data-deletion

7/A. Google user data

This section describes the data we receive from Google APIs when a creator chooses “Connect Google Calendar”. Connecting Google Calendar is optional; if you do not connect it, no Google Calendar data is processed.

LinkSosyal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Policy: https://developers.google.com/terms/api-services-user-data-policy

What we access: (1) the e-mail address of the connected Google account (to show which account is connected); (2) free/busy time ranges of the creator's primary calendar (start and end times only — we never read the titles, descriptions, attendees or other content of the creator's existing events); (3) the calendar events that LinkSosyal itself creates for bookings made through LinkSosyal (created, updated when rescheduled, deleted when cancelled), including a Google Meet link when the creator picks Google Meet as the meeting location
Scopes in plain words: openid/email — to show which Google account is connected; calendar.freebusy — to see availability; calendar.events — to create and manage the booking events we add
Why: to stop visitors booking times when the creator is busy, and to put bookings into the creator's own Google Calendar. No other purpose
Storage and security: OAuth access and refresh tokens are encrypted at rest with AES-256-GCM; busy ranges are stored as start/end times only, up to 90 days ahead, and refreshed about every 15 minutes; data is transmitted over HTTPS/TLS
Sharing: we do not sell Google user data; we do not transfer it to advertising platforms, data brokers or information resellers; we do not use it for advertising (including retargeting or personalized ads) or for credit-worthiness or lending decisions; we do not use it to train generalized AI/ML models
It is shared only with the infrastructure processors needed to run the feature (hosting/database — see the list in section 6), for security purposes, to comply with law, or, with the user's consent, in a merger or acquisition
Human access: our staff do not read this data except with the user's explicit permission (for example a support request), for security investigations, to comply with law, or in aggregated/anonymized form for internal operations
Retention and deletion: disconnecting in Dashboard → Meetings → Calendar sync revokes the Google token and immediately deletes the stored tokens and busy ranges. Events already created in your own Google Calendar stay there (you can delete them in Google Calendar). Deleting your LinkSosyal account also deletes this data. You can also revoke access at https://myaccount.google.com/permissions

7/B. Meeting bookings

A person who books a meeting on a creator's page (the “booker”) enters: name, e-mail, optional phone, an optional address for in-person meetings at the booker's place, an optional note, time zone and the chosen time.

The creator is the controller of this data; LinkSosyal processes it on the creator's behalf to run the booking, send confirmation and cancellation e-mails with a calendar (.ics) file from no-reply@linksosyal.com, and show the data in the creator's dashboard. The consent checkbox given at booking is logged.

If the creator has connected Google Calendar, the booking is added as an event to the creator's own Google Calendar. That event sends Google: the booker's name and e-mail (as an attendee), their phone and note if given (in the event description), the e-mail addresses of any added guests, the meeting time and the meeting location or link. Google keeps this data under the creator's account, under Google's privacy policy.

The booker can cancel through the link in their e-mail. Data is kept while the creator's account is active, unless the creator deletes it earlier.

For requests about your rights, contact the creator first; you can also contact us at merhaba@linksosyal.com.

8. Retention

Data is kept while the service is active and for statutory retention periods. For invoices and accounting records, the baseline is the five-year retention period under Turkish Tax Procedure Law art. 253; where commercial or other legislation requires longer, that period applies.

When you delete your account, untransferred content and personal data are deleted or anonymized at the end of the statutory periods. Platform Data is deleted immediately upon Meta's request or a user's deletion request.

Concrete periods: comment activity records, send-queue records and raw webhook records received from Meta are deleted automatically after 90 days. When you disconnect Instagram (or remove the app in your Instagram settings), the access token, DMs, comment records, contacts that came from Instagram, automations and queue data are deleted immediately and permanently. Deletion through Profile → Security → “Delete my data” or through Meta's data deletion callback is processed immediately: the access token, DMs, comment records, comment text in automation history, contacts that came from Instagram and that account's raw webhook records are deleted at once; requests made through Meta can be confirmed with the confirmation code at https://linksosyal.com/data-deletion.

9. Data Security and Breach Notification

Under KVKK art. 12 we take appropriate technical and administrative measures to prevent unlawful processing of and access to data and to ensure its safekeeping. Access tokens are stored encrypted; access is restricted on a role and authorization basis.

If we detect that personal data has been obtained unlawfully by others, we notify the data subject and the Turkish Personal Data Protection Board as soon as possible.

If a security incident affects Platform Data, we also follow Meta's incident-reporting mechanisms.

10. Cookies

Our cookie usage is described in the separate Cookie Policy. The disclosure text and the consent texts are separate documents; explicit consent for non-essential cookies is obtained only through a separate consent mechanism.

11. Children's Data

The Platform is not directed to children; users must be at least 18 and we do not knowingly collect personal data of children. Because the DPDP Act requires verifiable parental consent for persons under 18, we do not allow them to open accounts. We delete data we learn was collected from a child; you can report such a case to merhaba@linksosyal.com.

12. Your Rights under KVKK art. 11

For details on KVKK, see the KVKK Disclosure Statement (the “kvkk” document on this site). Cross-border transfers rely on KVKK art. 9: an adequacy decision, the standard contracts announced by the Board or, where applicable, explicit consent.

To learn whether your personal data is processed
To request information about it if processed
To learn the purpose of processing and whether it is used accordingly
To know the third parties to whom data is transferred in or outside Türkiye
To request correction of incomplete or inaccurate data
To request deletion or destruction under KVKK art. 7
To request that corrections/deletions be notified to third parties
To object to a result produced exclusively by automated systems
To claim compensation for damage caused by unlawful processing

13. How to Apply

You may send requests regarding your rights to merhaba@linksosyal.com. Your application is concluded free of charge within 30 days at the latest, depending on its nature; where the process involves an additional cost, the tariff set by the Board applies.

If your application is rejected, the response is insufficient, or no response is given in time, you may complain to the Board within 30 days of learning the response and in any case within 60 days of the application date.

13/B. India's DPDP Act 2023

LinkSosyal (Rioforge Information Solutions) acts as a “Data Fiduciary” under the DPDP Act. Personal data is processed on the basis of consent (and for the legitimate uses the Act permits); you may withdraw consent at any time — withdrawal does not affect the lawfulness of processing done before it.

To obtain a summary of the personal data processed
To request correction, completion, updating and erasure of personal data
To use the grievance redressal mechanism
To nominate another person to exercise your rights in the event of death or incapacity
Grievance Officer: Rioforge Information Solutions — e-mail: merhaba@linksosyal.com, phone: +90 530 306 28 53 (section 14). We aim to respond to requests within 30 days
If your grievance is not resolved, you may complain to the Data Protection Board of India

14. Grievance Officer (India)

For complaints and data requests under India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act, 2023: Grievance Officer, Rioforge Information Solutions — e-mail: merhaba@linksosyal.com, phone: +90 530 306 28 53.

Complaints are acknowledged within 48 hours and resolved within one month at the latest. The KVKK application and Board-complaint rights of users in Türkiye remain fully reserved.

15. Requests from Public Authorities

We handle requests for personal data from public authorities — such as courts, prosecutors, law enforcement or regulators in Türkiye, India or elsewhere — according to these principles:

Legality review: every request is checked for coming in writing from a competent authority, for its legal basis and for its scope; informal or unauthorized requests receive no data
Challenge: we challenge requests that are vague, overly broad or lack a legal basis, request a court order where appropriate, or use available legal remedies
Data minimization: we disclose only the minimum data the request specifically asks for and the law requires; where the law allows, we inform the affected user
Documentation: every request is recorded with its date, requesting authority, legal basis, the data requested and disclosed or refused, the reasoning and the people who decided

16. Changes

This policy is updated when needed; material changes are announced via e-mail and on-site notice. The current version is always published at this address.

Privacy Policy