Privacy Policy

1. Introduction

At AS Medya, we care about your privacy. This privacy policy has been prepared to inform you about the personal data that is collected, used and protected while you use our services.

2. Data We Collect

We may collect the following data while you use our services:

2.1 Account Information

• First and last name
• Email address
• Phone number
• Password (in encrypted form)

2.2 Social Media Data

When you connect your Facebook, Instagram or WhatsApp accounts:

• Social media profile information (name, profile photo)
• Page and account information
• Posts and comments
• Messages (only for the accounts you manage)
• Follower statistics

2.3 Usage Data

• IP address
• Browser type and version
• Pages visited
• Session durations

2.4 Google Workspace Data

When you connect your Google account to our application, we request access to data in the following scopes through Google's official OAuth 2.0 authorisation flow:

• Email and profile information (openid, userinfo.email, userinfo.profile): The email address, name and profile photo of the Google account you connect.
• Google Sheets (spreadsheets): Permission to add new rows only to the Google Sheet files you select. Other Sheets content is not read.
• Google Drive (limited) (drive.file): Access only to the files you explicitly select through Google Picker. We have no access to the other files in your Drive.
• Google Calendar (calendar): Access to your primary calendar in order to create, update, read and delete sales follow-up events.

3. Purposes for Which Data Is Used

We use the data we collect for the following purposes:

• To provide and improve our services
• To help you manage your social media accounts
• To enable you to view comments and messages
• To run automated reply systems
• To provide customer support
• Security and fraud prevention
• To fulfil legal obligations

4. Meta Platform Data

When you connect your Facebook, Instagram and WhatsApp accounts, the data we receive from Meta platforms is used only for the purposes you determine. This data:

• Is not shared with third parties
• Is not used for advertising purposes
• Is processed solely in order to provide our services
• Is deleted when you disconnect the account

5. Google Workspace Data and Google API Services

AS Medya CRM & AI's use and transfer of information received from Google API Services adheres to the Google API Services User Data Policy, including the "Limited Use" and "Limited Use exception" requirements.

5.1 Which Google Data Do We Access?

When you connect your Google account to our application, we request access only to the following limited OAuth scopes:

• openid, userinfo.email, userinfo.profile — user identification
• spreadsheets — adding rows to the Google Sheet you select
• drive.file — access only to the Sheet file you select through Google Picker
• calendar — managing sales follow-up events on Google Calendar

5.2 How Do We Use This Data?

We use your Google data only for the following purposes:

• To add new leads from Meta Lead Ads as new rows to the Google Sheet you have selected
• To optionally transfer past Meta Lead Ads records to a Google Sheet (with duplicate checking)
• To write sales follow-up events (meetings, calls, reminders) to Google Calendar and to display, update and delete them in our dashboard
• To display the identity of the Google account you connect (email, name, profile photo) in the dashboard

5.3 With Whom Do We Share Your Data?

We do not share, sell, rent or transfer your Google data to third parties. Google data is not used for advertising, for model training or for marketing purposes. Your data is used only:

• To provide the functionality of our application described above
• With competent authorities where legally required
• In line with your explicit instructions (e.g. writing data to the Sheet you selected)

Our infrastructure providers (Supabase, Vercel, Railway) process the data solely in order to provide storage and server services, and are subject to their own privacy policies.

5.4 How Do We Protect Your Data?

• Your Google OAuth tokens are stored in encrypted form on Supabase
• All traffic passes over HTTPS / TLS 1.2+
• Only the server-side components of our application can access the tokens; they are not exposed to the client side
• With access control and Row Level Security (RLS), each user can access only their own token

5.5 Retention and Deletion of Google Data

• Your Google OAuth tokens are retained only for as long as you keep your Google connection active in our application
• When you press the "Disconnect" button on the Accounts page, your Google token is permanently deleted from our database
• If you close your account entirely, all of your personal data, including your Google data, is deleted within 30 days
• You can also revoke our application's access at any time through Google, on the myaccount.google.com/permissions page

5.6 Limited Use

The use of data obtained through Google APIs complies with Google's Limited Use requirements:

• The data is used only to provide user-facing features of the application
• The data is not used for advertising and is not sold
• The data is not read by humans; the only exceptions are: (a) with the user's explicit consent, (b) for security purposes, (c) where legally required
• The data is not used to train AI/ML models

6. Data Sharing

We do not share your personal data with third parties except in the following cases:

• When you have given explicit permission
• Where legally required
• With our service providers (under a data processing agreement)

7. Data Security

We apply industry-standard security measures to protect your data:

• SSL/TLS encryption
• Secure data storage
• Access control and authorisation
• Regular security audits

8. Data Retention Period

We retain your data only for as long as necessary:

• Account data: for as long as your account is active
• Social media data: for as long as the connection is active
• Log data: 12 months maximum

9. Your Rights

Under the KVKK (Turkish Personal Data Protection Law) and the GDPR you have the following rights:

• The right to access your data
• The right to request rectification of your data
• The right to request erasure of your data
• The right to object to data processing
• The right to data portability

10. Data Deletion Request

To request the deletion of your data:

• You can close your account from the account settings
• You can remove your social media account connections
• You can submit a data deletion request by email

Data deletion requests are processed within 30 days.

11. Cookies

We use cookies on our website for session management and to improve the user experience. You can disable cookies from your browser settings.

12. Changes to This Policy

We may update this privacy policy from time to time. In the event of significant changes, we will notify you by email.

13. Contact

For questions about our privacy policy or your data: