Privacy Policy & KVKK Clarification Notice

Purpose of this notice

This document is the clarification notice (aydınlatma metni) prepared under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and also explains how Canli Pazarci ("we", "us", "data controller") processes personal data when you use our Service.

1. Data controller

Data controller: the operator of the Canli Pazarci service at canlipazarci.com.tr (trade name, MERSİS, registered address, and KEP are listed on the Company & Contact page; placeholders will be replaced when registration data is final). For KVKK applications and privacy requests, write to info@canlipazarci.com.tr. We will respond as required by KVKK Article 13.

2. Categories of personal data

Depending on how the Service is used, we may process:

• Identity / account data — name (if provided), email address, authentication credentials, and account settings
• Instagram / comment data — connected Professional account identifiers, live comment usernames and bodies, related media/context IDs, AI relevance labels, draft replies, and CRM contact fields you store (e.g. display name, phone, address, notes)
• Transaction / security / technical data — logs, session cookies, IP address, device/browser information, and similar security telemetry needed to operate the Service

3. Purposes of processing

Personal data are processed for the following purposes:

• Creating and managing user accounts; authenticating access
• Providing live-comment capture, AI classification, reply drafting, CRM, and related Service features
• Connecting Instagram accounts via Meta OAuth and receiving webhook events
• Security, abuse prevention, troubleshooting, and Service improvement
• Communicating about the Service (support, security, and material updates)
• Fulfilling legal obligations and establishing, exercising, or defending legal claims
• Processing payments and invoices for Service fees through our payment service provider

4. Legal bases (KVKK Art. 5)

We rely on one or more of the following KVKK Article 5 bases, as applicable:

• Processing is necessary for the conclusion or performance of the contract (providing the Service you request)
• Processing is mandatory for us to fulfil our legal obligations
• Processing is necessary for our legitimate interests (security, Service integrity, limited product improvement), provided it does not harm fundamental rights and freedoms
• Where required (for example certain optional processing or transfers), your explicit consent (açık rıza), which you may withdraw without affecting the lawfulness of prior processing

5. Collection method

Data are collected by wholly or partly automated means: directly from you (registration, account forms), from Meta/Instagram APIs and webhooks when you connect an account, and automatically from your device/browser when you use the Service.

6. Transfer of personal data

We do not sell personal data. Data may be shared with processors/service providers that host and operate the Service (for example cloud hosting, database, email delivery, AI model providers, and licensed payment service providers that process card payments for Service fees), with Meta as needed for Instagram integrations, with competent authorities when required by law, and in connection with a merger, acquisition, or similar corporate transaction. Some providers may process data outside Türkiye. Cross-border transfers are carried out only in accordance with KVKK Article 9 (including adequacy, standard contracts / Board-approved mechanisms, or explicit consent where required).

7. Retention

We retain personal data only as long as necessary for the purposes above and for applicable limitation periods under Turkish law. When the purpose ceases, data are deleted, destroyed, or anonymised under KVKK and the Regulation on Deletion, Destruction or Anonymisation of Personal Data. You can also request deletion; see our Data Deletion Instructions.

8. Security measures

We implement reasonable technical and organisational measures under KVKK Article 12 (access controls, encrypted transport where appropriate, least-privilege access, logging, and vendor diligence). No method of transmission or storage is completely secure.

9. Your rights under KVKK Article 11

By applying to us, you may:

• Learn whether your personal data are processed
• Request information about processing if data are processed
• Learn the purpose of processing and whether it is used in line with that purpose
• Know the third parties in Türkiye or abroad to whom data are transferred
• Request correction of incomplete or inaccurate data
• Request deletion or destruction under the conditions in KVKK Article 7
• Request that correction/deletion be notified to third parties to whom data were transferred
• Object to results arising against you from exclusively automated analysis
• Request compensation for damage arising from unlawful processing

10. How to apply (KVKK Art. 13)

Submit requests in writing to info@canlipazarci.com.tr, or via another method recognised under the Communiqué on the Principles and Procedures for Application to the Data Controller (including, where available, the email registered on your Canli Pazarci account). We conclude requests free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. If the process requires an additional cost, the tariff set by the Personal Data Protection Board may apply.

11. Complaint to the Board

If your application is rejected, the response is insufficient, or you receive no timely response, you may file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within thirty days of learning our response and in any event within sixty days of the application date, under KVKK Article 14.

12. Cookies and similar technologies

We use session and security-related cookies/storage necessary to keep you signed in and protect the Service. These are required for the Service to function. We do not use advertising cookies in the core product.

13. Children

The Service is directed to adults and businesses. It is not intended for individuals under 18. We do not knowingly collect personal data from children.

14. Note for merchants

When you store commenter phone numbers, addresses, or other customer data in the CRM, you typically act as an independent data controller for those individuals. You must fulfil your own KVKK clarification and other obligations. Canli Pazarci provides tools; it does not replace your controller responsibilities.

15. Changes

We may update this notice from time to time. The "Last updated" date at the top reflects the latest revision. Where required by KVKK or other law, we will provide additional notice.

16. Contact

Privacy and KVKK requests: info@canlipazarci.com.tr. See also Company & Contact for seller identity fields.