1. Identity of the Data Controller
Rioforge Information Solutions (unit “Rioforge Digital Solutions”; registered with the Ministry of Micro, Small and Medium Enterprises, Government of India, Udyam Registration No. UDYAM-UP-02-0016102; Delhi, India) — phone: +90 530 306 28 53, e-mail: merhaba@linksosyal.com. The data controller is established outside Türkiye; once a data controller representative in Türkiye is appointed, their details will be published here.
2. Categories of Personal Data
- Identity (first and last name) and contact (e-mail, phone) data
- Account and organization data (membership, role, session and security records)
- Public profile, comment, message and interaction data of the Instagram account you connect, processed on your instruction via official APIs
- Customer transaction data (orders, plan, invoices, refunds and payment-provider responses)
- Transaction-security data (IP, device, log records)
- Data processed through cookies and similar technologies, and the cookie preference record
- AI processing data (persona, texts sent for automatic reply generation, and generation logs)
3. Purposes of Processing
- Creating your membership record and managing your account and organization
- Fulfilling contractual obligations (subscription, invoicing, delivery, refunds)
- Running payment infrastructure, e-Arşiv invoicing and accounting processes
- Service security, abuse and fraud prevention, and compliance with legal obligations
- Automation, AI-assisted content generation and analytics
- Marketing and commercial electronic messaging, where explicit consent exists
4. Recipients and Purposes of Transfer
Your data may be transferred, to the extent required by the service and legal obligations, to these service providers:
Railway (hosting, database, queues and uploaded files) — data is hosted in the European Union (the Netherlands, europe-west4 region)
Meta Platforms (Instagram API: profile, media, comment and message data of the connected account, with your authorization)
Google Firebase Authentication (only when you choose “Sign in with Google”)
E-mail delivery (Resend or an SMTP provider): verification, password-reset and notification e-mails
Anthropic, PBC (Claude AI models — USA): only the comment/message text needed for the AI features listed in section 5; under Anthropic’s commercial terms, data sent through its API is not used to train its models
Payment service providers (iyzico and PayTR — Türkiye; Razorpay — India): LinkSosyal plan payments only; card details are never stored by us
Sentry (error monitoring): technical error records
Data is hosted in the EU (the Netherlands) and the data controller is in India, so data is transferred abroad. These transfers apply the regime of KVKK art. 9 as amended by Law No. 7499 (adequacy decision, standard contract with notification to the Authority, binding corporate rules, written undertaking/Board authorization, and statutory derogations).
5. Method and Legal Grounds of Collection
Data is collected, partly automatically, via the website, creator dashboard, public pages, forms, e-mail and official API integrations.
Legal grounds: performance of a contract (KVKK art. 5/2-c), legal obligation (art. 5/2-ç), legal claims (art. 5/2-e), legitimate interest (art. 5/2-f), and explicit consent (art. 5/1) for marketing and non-essential cookies.
6. Your Rights under KVKK art. 11 and How to Apply
You have the rights to learn whether data is processed, to request information, to learn the purpose, to know the third parties to whom data is transferred, to request correction, to request deletion/destruction, to request notification of such actions, to object to the outcome of automated analysis, and to claim compensation for damage. The full list is in section 12 of the Privacy Policy.
You may send requests to merhaba@linksosyal.com; applications are concluded within 30 days at the latest. If you believe your personal data is processed contrary to the Law, your right to complain to the Turkish Personal Data Protection Board (www.kvkk.gov.tr) is also reserved.
7. VERBİS
Data controllers not resident in Türkiye must register with the Data Controllers' Registry (VERBİS) and appoint a data controller representative resident in Türkiye, regardless of employee or balance-sheet thresholds. This registration and representative appointment is in progress; once completed, the registry and representative details will be published in this notice.