Personal Data Notice (KVKK)

Your personal data is processed by Yusuf Özbaş as the data controller under Turkish Personal Data Protection Law No. 6698 (KVKK).

Address: Aksaray. Tax office and number: Aksaray / 6650381982. Email: help@igflow.app. Phone: +90 555 605 40 22.

This notice is for people who visit https://igflow.app, sign up or buy a plan.

Identity and contact: full name, email address, phone number.

Account security: an irreversible hash of your password, your two-step verification setting, the public key of a passkey if you add one (your fingerprint and face data never leave your device and do not reach us), session records, and sign-in and activity records (IP address, browser information, date and time).

Purchases: the plan you chose, the order amount and status, the billing address; for company buyers the company name, tax office and tax number. Your card number and card security details never reach us; you enter them on the payment institution's page.

Turkish ID number (T.C. kimlik numarası): asked for every payment when your billing address is an individual address in Türkiye; the self-employment receipt (e-SMM) is issued with this number. It is stored encrypted with your billing address; the panel shows only its last two digits.

Use of the service: the username, profile information and session data of the Instagram accounts you connect; the tasks, flows and scheduled posts you create, their results and error records; the messages you view in the inbox.

Support: the support tickets you open and the messages in them.

Optional connections: if you connect Google Drive, your Google account email and encrypted access tokens; if you add an AI or MCP connection, its encrypted keys.

We do not ask for and do not knowingly process special categories of personal data (health, biometric data, religion, political opinion and the like).

To create your membership, verify your identity, add the plan you bought and run the automations you request. Legal ground: processing is directly related to concluding or performing a contract (KVKK art. 5/2-c).

To take payment, issue self-employment receipts (e-SMM), meet obligations under distance selling and consumer law, and keep access and activity records for the period the law requires. Legal ground: compliance with a legal obligation (art. 5/2-ç).

To use your Turkish ID number on the self-employment receipt (e-SMM) and, when you pay with iyzico, to send it to the payment institution. Tax law requires the receipt to carry the buyer's ID number; iyzico also requires it under its own identity-verification obligations. Legal ground: compliance with a legal obligation (art. 5/2-ç) and performance of the contract (art. 5/2-c).

To keep accounts secure, prevent abuse and unauthorised access, diagnose errors and operate the service. Legal ground: legitimate interest, provided your fundamental rights and freedoms are not harmed (art. 5/2-f).

To answer your support requests and to exercise our rights in a dispute. Legal ground: performance of the contract (art. 5/2-c) and the establishment, exercise or protection of a right (art. 5/2-e).

We do not process your data for advertising or profiling. We may send you service messages (such as a verification code or a support ticket notice); promotional commercial messages are sent only if you give separate consent.

Your data is collected electronically, by fully or partly automated means, through the sign-up, phone verification, purchase and support forms, your actions in the panel, the activity records kept by our servers, strictly necessary cookies and the payment notification from the payment institution.

Payment institution: your name, email, phone, billing address, IP address and order amount are sent to the payment institution so the payment can be taken. When you pay with iyzico your Turkish ID number is sent too.

Turkish Revenue Administration (Gelir İdaresi Başkanlığı): the self-employment receipt (e-SMM) for every payment is issued in its system. The receipt carries your name or company name, Turkish ID or tax number, tax office for company buyers, address and the payment amount.

Meta Platforms (WhatsApp and Instagram): the phone verification code and service notices are sent over WhatsApp, which requires your phone number. Actions taken on your Instagram account on your behalf are sent to Instagram.

Google: only if you connect Google Drive, the files you export are written to your own Drive account.

AI providers: only when you use AI features (the help assistant, creating a flow with AI, AI nodes), the text you write and the related content are sent to the provider to produce an answer.

Hosting and infrastructure providers: data is stored on the servers that run the service.

Authorised public bodies: only where the law requires it and only as much as is required.

We do not sell your data and do not share it with third parties for marketing.

The servers of Meta, Google and AI providers may be located outside Türkiye. When these services are used, the relevant data is transferred abroad only as far as that service requires.

Phone verification is a required step of membership. Google Drive and the AI features are optional; no data is sent to those providers unless you use them.

Your account data is kept for as long as your membership lasts. When you ask for your account to be deleted, your data is deleted or anonymised, except for what must be kept by law.

Sign-in and activity records (including IP address) are kept for 1 year.

Order, payment and receipt records are kept for the period required by tax and commercial law.

Your Turkish ID number is kept until you delete the billing address it is stored with; deleting the address deletes it. The encrypted copy taken onto the order at payment is deleted once the receipt is issued; the number on the issued receipt is kept for the period tax law requires.

Per-target task records are kept for 90 days; the conversation history of AI message replies is kept for 90 days.

When you remove an Instagram account from the panel, its session data is deleted.

Under article 11 of KVKK you have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of processing and whether the data is used for that purpose, and to know the third parties in Türkiye or abroad to whom it is transferred.

You may ask for incomplete or inaccurate data to be corrected, for data to be deleted or destroyed under the conditions in the Law, and for these operations to be notified to the third parties who received the data.

You may object to a result against you produced solely by automated analysis of the processed data, and you may claim compensation if you suffer damage because your data was processed unlawfully.

Send your request from the email address registered on your account to help@igflow.app, or open a support ticket in the panel. The request must contain the information listed in the Communiqué on the Procedures and Principles of Application to the Data Controller (full name, contact details, the subject of the request).

Your request is concluded free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the operation involves a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

If your request is rejected, if you find the answer insufficient or if no answer is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the request.

While you use IGFlow, data about other people, such as the followers of the Instagram account you connect, the people you message and the people who comment, is also shown in the panel and processed on your instruction. For this data you are the data controller; IGFlow processes it only on your behalf and according to your instructions.

Using this data lawfully, and informing those people where required, is your responsibility.