Privacy Policy

Effective date: September 27, 2026

This policy explains how your personal data is processed when you use the Provly website (provly.co), mobile app and browser extension (together, the "Service"). It serves as the information notice under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and is also written for users in the European Union under the General Data Protection Regulation (GDPR). If this translation and the Turkish version differ, the Turkish version prevails.

1. Controller

[COMPANY NAME], [ADDRESS] Email: [CONTACT EMAIL]

2. What we process

• Account: first and last name, email address, username and password (the password is stored only in hashed form in our sign-in system; we cannot see it).
• Profile: the @username you choose.
• Use of the Service: ads you save, your boards and folders, brands and keywords you track, stores you analyze, and your plan's usage counters (for example how many result pages you used this month).
• Community: your friendships, messages with friends, ads/products/stores you send and receive, and your notifications.
• Session and security: session information, the device you signed in on last, and whether your website tabs are online.
• Feedback: ideas and problem reports you send, and any screenshot you choose to attach.
• Payment: your subscription status and Stripe customer ID. Card details are processed by Stripe and never reach our systems.
• Instagram connection (optional): the Instagram username you connect, and the link/caption of posts you send to Provly by DM.
• Browser extension: the content of ads you save to Provly (text, media links, dates, reach) and the domain of the store you open in the panel. The extension does not read or send us your Facebook, Instagram or TikTok session details; it only uses your Provly session.
• Mobile app: your session key is stored only in your device's secure Keychain. The app contains no advertising or analytics trackers and does not access your location, contacts or photos.

The Service also processes ads and advertiser page details from public ad libraries. People who appear in these ads can ask for the content to be removed at the address below.

3. Why and on what legal basis

• To create your account, provide the Service and manage your plan and payments (performance of a contract: KVKK art. 5/2-c, GDPR art. 6/1-b);
• To keep the Service secure, prevent abuse, fix errors and improve the Service (legitimate interests: KVKK art. 5/2-f, GDPR art. 6/1-f);
• To meet legal obligations such as keeping invoices (KVKK art. 5/2-ç, GDPR art. 6/1-c);
• For optional features such as the Instagram connection, when you turn them on (consent: KVKK art. 5/1, GDPR art. 6/1-a). You can withdraw your consent at any time.

4. Who we share it with

We do not sell your data or share it for advertising. We share it only as needed with the providers that help us run the Service:

• Amazon Web Services: server and database hosting;
• Cloudflare (R2): storage of ad media and feedback screenshots;
• Stripe: subscription payments;
• Meta (Instagram): only if you turn on the Instagram connection, so that it can work.

These providers' servers may be outside Türkiye; your data is transferred with the safeguards required by KVKK art. 9 and the GDPR. We may also disclose information to authorities when the law requires it. The friends you message or send items to see those messages and items; boards and folders you give a public link can be seen by anyone with the link.

5. How long we keep it

• Account data is kept while your account is open. When you close your account, it is deleted or anonymized within 30 days.
• Records we must keep by law (such as invoices) are kept for the period the law sets (generally 10 years in Türkiye).
• Security logs are kept for up to 12 months.

6. Cookies

The website uses only the cookies it needs to work:

• af_session: keeps you signed in (7 days);
• provly_lang: remembers your language (1 year);
• ig_oauth_state: protects the Instagram connection step (10 minutes).

We do not use advertising or analytics cookies.

7. Security

Your data travels over encrypted connections (HTTPS), passwords are stored hashed, and access to our systems is limited to authorized people. No system is completely secure, but we take reasonable technical and organizational measures to protect your data.

8. Your rights

Under KVKK art. 11 and the GDPR you have the right to know whether your data is processed, to get information about it and a copy, to have it corrected or deleted, to object to processing, to receive your data in a portable format, and to withdraw consent. Send your request to [CONTACT EMAIL]; we answer within 30 days. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority, or, in the EU, to your country's data protection authority.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

10. Changes

We may update this policy. We will announce material changes in the app, on the website or by email before they take effect.

11. Contact

Send questions and requests to [CONTACT EMAIL].