1.Who we are
Mücahid Ali Karaman, a business registered in Türkiye with its registered address at Meşrutiyet Mah. Karanfil Sk. Zafir İş Merkezi No: 4/91, 06420 Çankaya, Ankara, Türkiye, runs postivate.com and the Postivate service (“Postivate”, “we”). This policy explains what personal data we collect, why, who we share it with, how long we keep it and what your rights are under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU and UK General Data Protection Regulation (GDPR).
We are the data controller for the data about our customers’ accounts, billing and use of the Service. For the content your organization adds (posts, media, comments and any personal data in them), your organization decides what goes in and why; we process it on its behalf to provide the Service. If your organization needs a data processing agreement, contact us.
Questions or requests: [email protected].
2.What we collect
- Account
- Your name, email address, password (stored only as an Argon2id hash, never in plain text), time zone and profile picture. If you sign in with Google: your Google account ID, name, verified email address and profile picture. We don’t receive your Google password or access your Google data beyond that.
- Organization and billing
- Organization and workspace names, your plan and add-ons, and the billing name, email and address you give at checkout. Card details go to our payment provider; we only keep the card brand and last four digits.
- Connected social accounts
- The account’s name, handle, picture, ID and follower count, and the access tokens the network gives us. Tokens are encrypted (AES-256-GCM) and never shown in the dashboard, API or to AI agents. For a Telegram channel or group: the chat’s ID, title, public username and member count. Our bot only posts to chats where someone added it as an admin, and we never get access to a person’s Telegram account or private chats. For a Mastodon account: also the server it lives on. We register Postivate as an app on that server to connect, and disconnecting the account in Postivate revokes our access there. For a Pinterest account: its boards are read from Pinterest when you pick where a Pin goes, and only the board you choose is saved, with the post. A board you create from the composer is created on your Pinterest account. For a TikTok account: its posting options are read from TikTok when you write a post for it, so the composer can show them, and the settings you choose, such as who can view the post, are saved with the post.
- Your content
- Posts, drafts and their revisions, media you upload or generate, comments, approvals, templates and your Brand Profile.
- Results
- Metrics the networks report for your posts and accounts, such as reach, engagement and follower counts.
- Security and activity
- For each signed-in session: IP address, browser and device (user agent) and last activity. A log of actions in your organization (who did what, and when, including actions by API keys and AI agents), and records of AI use (feature, model and usage, not your prompts).
- Developer access
- API keys (stored as a hash), apps you connect over MCP and the permissions you grant them, and webhook endpoints and their delivery history.
- Notifications and email
- If you turn on browser notifications: the push subscription your browser gives us. For the emails we send you (password resets, invitations and the notification emails you choose): what was sent, when, and whether it was delivered, bounced or marked as spam. We don’t track whether you open our emails or click their links.
- Support
- What you tell us when you contact us.
On postivate.com, and only if you accept it, Google Analytics collects how you use the site: pages viewed, how you got there, approximate location, device and browser. Google Analytics doesn’t store IP addresses. We use no advertising tools.
3.Why we use it, and on what legal basis
- Creating your account and providing the Service: publishing to the networks you connect, AI features, analytics, notifications and support
- Necessary to perform our contract with you
- Billing, invoicing and tax records
- Contract, and legal obligations
- Keeping accounts and the Service secure: sessions, preventing abuse, investigating problems
- Our legitimate interests, and legal obligations
- Telling you about changes to the Service, these policies or your subscription
- Contract, and our legitimate interests
- Understanding how the Service is used, in aggregate, to improve it
- Our legitimate interests
- Measuring visits to postivate.com with Google Analytics
- Your explicit consent, which you can withdraw at any time from “Cookie settings” in the site footer
- Responding to legal claims and requests from authorities
- Legal obligations, and establishing or defending legal claims
We don’t sell personal data, we don’t use it for advertising, and we don’t use your content to train AI models.
4.AI features
When you use the AI assistant, we send only what the request needs to our AI providers:
- Writing features (drafts, rewrites, translations, hashtags, channel versions and ideas) send your text and your workspace’s Brand Profile to Anthropic.
- Image generation sends your image prompt with your brand’s name and description to OpenAI. The generated image is stored in your Postivate library.
Under their commercial API terms, these providers don’t use this data to train their models, and they keep it only for a limited time, for example to detect abuse. We don’t keep your prompts; we record only which feature was used, the model and the usage.
AI agents you connect over MCP (such as Claude, ChatGPT or Cursor) receive the data you allow them to access. Their use of it is governed by their providers’ policies.
6.International transfers
Some of our providers are outside Türkiye and the European Economic Area, mainly in the United States. When we transfer personal data abroad, we rely on the safeguards the law provides, such as standard contracts under KVKK Article 9 and the European Commission’s standard contractual clauses, and we choose providers that protect data to a comparable standard.
7.How long we keep it
- Account, organization and content
- While your organization exists. When a trial or subscription ends, the data stays so you can pick up where you left off, until the organization is deleted or you ask us to delete it.
- Sign-in sessions
- A session lasts up to 30 days; you can end any session from your account settings.
- Activity of API keys and apps
- 90 days
- Webhook delivery history
- 30 days
- Emails we sent you
- 30 days. An address that bounced or marked our emails as spam is kept on a do-not-email list until you ask us to remove it.
- Analytics history shown in the app
- Depends on your plan (30 days to 24 months).
- Billing and tax records
- As long as tax and commercial law require, up to 10 years.
- Website statistics (Google Analytics)
- Up to 14 months. The cookies last up to 2 years, or until you clear them or withdraw consent.
When an organization is deleted, its workspaces, connected channels and their tokens, posts, media files, API keys and activity log are deleted. Copies in backups are removed in their normal rotation.
8.Your rights
Under KVKK Article 11 and, where it applies, the GDPR, you can ask us to:
- tell you whether we process your personal data, and give you a copy of it;
- tell you why we process it and who we share it with, in Türkiye or abroad;
- correct data that is wrong or incomplete;
- delete it or restrict how we use it, when there is no longer a reason to keep it;
- give it to you in a portable format (GDPR);
- stop processing based on our legitimate interests, or on your consent if we ever ask for it;
- object to a result that affects you and comes solely from automated analysis, and claim compensation for damage caused by unlawful processing.
Send requests to [email protected] from the email address on your account. We answer within 30 days. To delete your user account, write to us; the organization’s owner can delete the whole organization from its settings. If your organization added you, some requests about its content are best sent to the organization, and we will help it respond.
You can also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, if you are in the EU or UK, your local data protection authority.
9.Security
We protect data with encryption in transit (HTTPS), encrypted storage of social network tokens and other secrets, hashed passwords, API keys and session tokens, private storage for media that is only reachable through short-lived signed links, and role-based access within your organization. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.
11.Children
Postivate is for people aged 18 and over. We don’t knowingly collect data from children; if you believe a child has given us personal data, contact us and we will delete it.
12.Changes to this policy
If we change this policy in a way that matters to you, we will tell you in the app or by email before the change takes effect. The date at the top shows the latest version.
13.Contact
Mücahid Ali Karaman, Meşrutiyet Mah. Karanfil Sk. Zafir İş Merkezi No: 4/91, 06420 Çankaya, Ankara, Türkiye. Email: [email protected].