1. Data Controller and Scope
Data controller: the operator of the LinkSosyal service, Rioforge Information Solutions (unit “Rioforge Digital Solutions”; registered with the Ministry of Micro, Small and Medium Enterprises, Government of India, Udyam Registration No. UDYAM-UP-02-0016102; Delhi, India) — phone: +90 530 306 28 53, e-mail: merhaba@linksosyal.com.
LinkSosyal is operated by a business registered in India and serves users in Türkiye. Turkish Law No. 6698 (KVKK) therefore applies to users in Türkiye, and India's Information Technology Act, 2000 and Digital Personal Data Protection Act, 2023 (DPDP Act) apply to our business.
This policy covers personal data processed while you use our website, the creator dashboard, public bio/store pages and our official API integrations. Section 3 explains that creators also act as data controllers for their own buyers and followers.
You may submit KVKK art. 11 requests to merhaba@linksosyal.com; requests are answered within 30 days at the latest.
2. Personal Data Processed
- Identity and contact data: first and last name, e-mail, phone number where provided
- Account and organization data: membership, role, team membership, session and security records, cookie preference record
- Connected Instagram/Meta account data: public profile information, post and comment IDs, comment texts, commenter usernames, message threads, mention/tag events, interaction events and related technical identifiers — only with your explicit authorization and via official Meta APIs
- Seller (creator) data: products, prices, stock, discount codes, campaigns, refund and invoice records
- Buyer and CRM data: names, e-mail addresses, phone numbers, addresses and order details of buyers; names, e-mail addresses/Instagram IDs, tags and notes collected through lead forms
- Product reviews, Q&A content and uploaded photos (including the reviewer's own photo)
- Transaction data: orders, collection and refund records, payment service provider responses and verification records — card data is never stored by the Platform
- Technical data: IP address, browser and device information, sign-in records, error and access logs
- AI processing data: persona definition, example replies, message/comment texts sent for automatic reply generation, and generation logs
3. Roles: Platform vs. Creator
For account, organization and platform-usage data, LinkSosyal is the data controller.
For buyer, order, delivery and buyer–creator messaging data in a creator's store, LinkSosyal acts as a data processor on the creator's instructions; the disclosure duty for that data lies with the seller-creator, under the data-processing arrangement between us set out in the Terms of Service.
For data obtained from your own Instagram/Meta account, the disclosure duty toward data subjects may rest with the creator or the Platform depending on the purpose of collection; the parties act in line with KVKK art. 10 and the Turkish Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
Instagram/Meta is an independent data controller for the processing it carries out on its own products; Meta's processing is governed by Meta's own policies.
4. Purposes and Legal Bases
- Creating and operating the service (dashboard, bio page, store, automations) — performance of a contract (KVKK art. 5/2-c)
- Running payment, invoicing, delivery and refund processes — performance of a contract (art. 5/2-c) and legal obligation (art. 5/2-ç)
- Invoicing, accounting and statutory retention — legal obligation (art. 5/2-ç)
- Account security, abuse, spam and fraud prevention, platform integrity — legitimate interest (art. 5/2-f)
- Handling requests, complaints and disputes; establishing, exercising or protecting a right — legitimate interest (art. 5/2-f) and legal claims (art. 5/2-e)
- Running automations and AI-assisted reply/content generation (on your instruction) — performance of a contract (art. 5/2-c)
- Analytics and service improvement (aggregated measurement) — legitimate interest (art. 5/2-f)
- Marketing and commercial electronic messages — explicit consent (art. 5/1); you may withdraw at any time
- Non-essential cookies and similar technologies — explicit consent (art. 5/1)
5. Artificial Intelligence and Automated Processing
The Platform uses Claude AI models provided by Anthropic, PBC (USA). Text is sent to Anthropic only for these features: (a) Collab Radar on Pro and higher plans — when our rule-based checks are not confident, inbound DM conversations are classified automatically (for example as a brand collaboration offer); up to the 20 most recent inbound messages of that conversation are sent for this; (b) features you turn on yourself — AI-drafted DM replies (suggest or auto mode), AI intent triggers on an automation, AI personalization of automated messages and, where offered on your account, AI-assisted comment moderation (Comment Guard).
We send only the text the task needs — never your password or access tokens. AI usage records keep token counts, not the text. We do not use Instagram data to train AI models, and Anthropic does not use API data to train its models.
Automations run on your instruction and your rules. Where the applicable law requires it and a reply is generated without a human, the use of automated handling is disclosed to the data subject.
- AI output is submitted for your approval or sent on your instruction; final content responsibility rests with the creator
- Where a result is produced exclusively by automated means against you, your right to object under KVKK art. 11/(g) is reserved
6. Transfers and Cross-Border Transfers
Data is shared only to the extent necessary to run the service, limited to the relevant purpose and legal basis, with the service providers below. Our website does not use third-party advertising or analytics tools (e.g. Google Analytics, Meta Pixel); usage is measured on our own servers in aggregate.
Railway (hosting, database, queues and uploaded files) — data is hosted in the European Union (the Netherlands, europe-west4 region)
Meta Platforms (Instagram API: profile, media, comment and message data of the connected account, with your authorization)
Google Firebase Authentication (only when you choose “Sign in with Google”)
E-mail delivery (Resend or an SMTP provider): verification, password-reset and notification e-mails
Anthropic, PBC (Claude AI models — USA): only the comment/message text needed for the AI features listed in section 5; under Anthropic’s commercial terms, data sent through its API is not used to train its models
Payment service providers (iyzico and PayTR — Türkiye; Razorpay — India): LinkSosyal plan payments only; card details are never stored by us
Sentry (error monitoring): technical error records
Data is hosted outside Türkiye (in the EU) and the business operating the service is in India, so personal data is transferred abroad.
Cross-border transfers apply the regime of KVKK art. 9 as amended by Law No. 7499: (i) transfer to a country/sector/organization for which the Board has issued an adequacy decision; absent that, (ii) the standard contract published by the Board (with notification), (iii) binding corporate rules, or (iv) a written undertaking and Board authorization; where none applies, the statutory derogations are relied on.
For Meta's transfers outside the EEA, Meta's own transfer mechanisms apply; the Platform complies with the relevant data-transfer provisions of the Meta Platform Terms.
7. Processing of Meta/Instagram Data
We access Meta data only through official Meta APIs; we never request or store your password.
Under the Meta Platform Terms, we process Platform Data only for the purposes clearly described in this policy; this policy may not be interpreted inconsistently with Meta's terms.
- We do not sell, license or purchase Platform Data
- We do not attempt to re-identify, decode or reverse-engineer Platform Data
- We do not build or augment user profiles with Platform Data without valid user consent
- We do not process Platform Data for surveillance or in a discriminatory manner
- We delete Platform Data when the purpose ends, when you disconnect, or when Meta requests it; where retention is required by law we document that basis
- We provide an easily accessible way for users to request deletion of their data
- We do not use Platform Data for advertising and do not share it with ad networks or data brokers
- Meta permissions we request and why: instagram_business_basic — the connected account’s ID, username, profile picture, account type, follower/following/post counts and your recent media, to identify your account, show it in the dashboard and let you pick posts for automations
- instagram_business_manage_comments — to read comments on your posts, post public replies, hide comments that match your moderation keywords, and delete a single comment only when you click “Delete on Instagram”
- instagram_business_manage_messages — to send the automated DM (private reply) to commenters and to read and answer DMs in your Inbox
- Business Asset User Profile Access — the name, username and profile picture of people who comment on or message your account, shown in your Inbox, Comments and Contacts pages
- Meta Platform Terms: https://developers.facebook.com/terms/ · Developer Policies: https://developers.facebook.com/devpolicy/
- To delete your data: Profile → Security → “Delete my data” (immediate); Instagram → Settings → Apps and websites → LinkSosyal → Remove (immediate, through Meta’s deletion request); or email merhaba@linksosyal.com. Step-by-step instructions: https://linksosyal.com/data-deletion
8. Retention
Data is kept while the service is active and for statutory retention periods. For invoices and accounting records, the baseline is the five-year retention period under Turkish Tax Procedure Law art. 253; where commercial or other legislation requires longer, that period applies.
When you delete your account, untransferred content and personal data are deleted or anonymized at the end of the statutory periods. Platform Data is deleted immediately upon Meta's request or a user's deletion request.
Concrete periods: comment activity records, send-queue records and raw webhook records received from Meta are deleted automatically after 90 days. When you disconnect Instagram (or remove the app in your Instagram settings), the access token, DMs, comment records, contacts that came from Instagram, automations and queue data are deleted immediately and permanently. Deletion through Profile → Security → “Delete my data” or through Meta's data deletion callback is processed immediately: the access token, DMs, comment records, comment text in automation history, contacts that came from Instagram and that account's raw webhook records are deleted at once; requests made through Meta can be confirmed with the confirmation code at https://linksosyal.com/data-deletion.
9. Data Security and Breach Notification
Under KVKK art. 12 we take appropriate technical and administrative measures to prevent unlawful processing of and access to data and to ensure its safekeeping. Access tokens are stored encrypted; access is restricted on a role and authorization basis.
If we detect that personal data has been obtained unlawfully by others, we notify the data subject and the Turkish Personal Data Protection Board as soon as possible.
If a security incident affects Platform Data, we also follow Meta's incident-reporting mechanisms.
11. Children's Data
The Platform is not intended for use by persons under 18 and does not knowingly collect personal data of children. If we become aware of such processing, we delete it.
12. Your Rights under KVKK art. 11
- To learn whether your personal data is processed
- To request information about it if processed
- To learn the purpose of processing and whether it is used accordingly
- To know the third parties to whom data is transferred in or outside Türkiye
- To request correction of incomplete or inaccurate data
- To request deletion or destruction under KVKK art. 7
- To request that corrections/deletions be notified to third parties
- To object to a result produced exclusively by automated systems
- To claim compensation for damage caused by unlawful processing
13. How to Apply
You may send requests regarding your rights to merhaba@linksosyal.com. Your application is concluded free of charge within 30 days at the latest, depending on its nature; where the process involves an additional cost, the tariff set by the Board applies.
If your application is rejected, the response is insufficient, or no response is given in time, you may complain to the Board within 30 days of learning the response and in any case within 60 days of the application date.
14. Grievance Officer (India)
For complaints and data requests under India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act, 2023: Grievance Officer, Rioforge Information Solutions — e-mail: merhaba@linksosyal.com, phone: +90 530 306 28 53.
Complaints are acknowledged within 48 hours and resolved within one month at the latest. The KVKK application and Board-complaint rights of users in Türkiye remain fully reserved.
16. Changes
This policy is updated when needed; material changes are announced via e-mail and on-site notice. The current version is always published at this address.