Privacy Policy

Your personal data is processed by Social Analyze as data controller. For any question or request about this policy or your personal data: iletisim@socialanalyze.org

• Identity and contact: full name, email address, optional profile photo.
• Account: password (stored only as a bcrypt hash), language preference, sign-up and last sign-in dates, plan and usage counters.
• Security and usage: IP address, browser / device details, pages visited, API request logs, error logs.
• Connected social media accounts: depending on the permissions you grant, the account profile, posts and their metrics, comments, direct messages and analytics provided by the platform (see section 7).
• Content you create: brands, draft and scheduled posts, uploaded media, AI Assistant conversations, reports, listening topics, searches and alerts.
• Mobile app: the device push token used to deliver notifications and the record of your consent to AI features.
• Communication: messages you send through the contact form or by email.

The Social Listening and Competitor Intel modules collect publicly available content from social networks, through third-party data providers, for the topics and accounts you choose. This content may include personal data of third parties; it is processed only to run the analysis you requested.

Data is collected electronically, automatically or partly automatically, from the sign-up and profile forms, your actions on the Platform, the official APIs (OAuth) of the social accounts you connect, the mobile app and server logs. We rely on these legal bases:

• Performance of our contract with you (account, connected accounts, publishing, moderation, analytics, reports, AI features),
• Compliance with legal obligations (keeping records, responding to competent authorities),
• Legitimate interests (Platform security, preventing abuse, fixing errors, improving the service),
• Your explicit consent where required (for example, an international transfer that cannot rely on another legal basis).

• Creating your account, verifying your identity and providing the Platform,
• Performing the actions you request on connected accounts: publishing or scheduling posts, replying to, hiding or deleting comments and messages,
• Producing and showing analytics, reports, listening and competitor results,
• Running the AI Assistant, AI reply suggestions, Write with AI and AI report summaries at your request,
• Sending verification, notification and support emails and mobile notifications,
• Keeping the Platform secure, preventing abuse, fixing errors and improving the service,
• Meeting legal obligations.

Your data is never sold, never used for advertising and never shared with third parties for marketing.

To provide the service, data is shared with the following providers only as far as needed:

• Contabo (Germany): application servers, database and mail server. Backups are kept on a separate server.
• Cloudflare (USA, global network): content delivery and network security.
• OpenAI (USA): AI Assistant, AI reply suggestions, Write with AI and AI report summaries. Data needed for an answer is sent only when you use these features.
• Anthropic (USA): sentiment analysis of listening results; the AI Assistant model when selected by an administrator.
• DeepSeek, NVIDIA: used for the AI Assistant only if an administrator selects one of their models for your account.
• DeepL (Germany): translating content you ask to translate.
• Apify and Xquik: collecting public social media data for listening and competitor intel. Only search terms and account handles are sent to them.
• Expo and Apple Push Notification service (USA): delivering notifications to the iOS app.
• Google Analytics (USA): cookieless, anonymous usage measurement on the website (section 10).
• OpenPanel (our own server, Türkiye): cookieless product analytics on the website, in the panel and in the iOS app — pages and screens viewed, actions taken (e.g. scheduling a post, connecting an account; never post, message or AI text), device and approximate location. If you are signed in, this is linked to your account (email, name, plan). On the web, recordings of how pages are used, with all text and form fields masked, are kept for 30 days (section 10).
• Social networks (Meta, Google / YouTube and Google Business Profile, LinkedIn, TikTok, X): through each platform’s official API when you connect an account and when we act on your behalf.

Some of these providers are located outside Türkiye and the EEA, so your data is transferred internationally. Transfers rely on the safeguards in Article 9 of KVKK and GDPR (such as standard contractual clauses) or, where these are not available, on your explicit consent. AI providers do not use data sent through their APIs to train their models. Information may also be disclosed to competent public authorities where required by law.

• Account data and the content you create are kept while your account is open.
• When you delete your account (Profile → Security in the web panel, or Profile → Delete account in the iOS app), data with no legal retention obligation is deleted or anonymised within 30 days.
• When you remove a connected social account, or revoke our access in the platform’s settings, that account’s stored data and access tokens are deleted.
• Database backups are kept for 15 days; deleted data leaves the backups when that period ends.
• API request and performance logs are kept for 30 days. Records required by law are kept for the legally required periods.

In the Social Media Management module you connect Facebook Pages, Instagram professional accounts, X, YouTube, LinkedIn and TikTok accounts through each platform’s own official login (OAuth). You choose which permissions to grant on the platform’s own consent screen.

Depending on the permissions you grant, we receive and store: the account’s public profile (name, username, profile picture, follower counts), the posts published by the account and their metrics, comments on those posts, direct messages sent to the account, and account-level analytics provided by the platform.

• We use this data only to display it to you in the panel and to perform the actions you request — replying to, hiding or deleting comments, sending messages and publishing or scheduling posts on your behalf.
• When you request an AI reply or caption suggestion, the text of the relevant comment, message or brief is sent to our AI provider solely to generate that suggestion.
• Platform access tokens are stored encrypted (AES-256-GCM) and are used only to call the platform APIs on your behalf.
• Data is refreshed periodically while an account is connected. See Data deletion for deletion instructions.

YouTube: our use of YouTube data is governed by the YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service; Google’s handling of data is described in the Google Privacy Policy. You can revoke access at any time from Google security settings.

Google user data (YouTube)

This section describes how Social Analyze accesses, uses, shares, protects, retains and deletes data received from Google APIs when you connect a YouTube channel. It applies in addition to the rest of this policy.

Scopes we request:

• youtube.force-ssl — read the connected channel’s profile, videos and video statistics, and the comments on those videos, so we can show them in the panel; and, only when you ask, upload a video you select in the composer (with the title, description, thumbnail and privacy setting you choose, immediately or at the time you schedule), reply to, hold for review, publish or delete comments, and delete videos.
• yt-analytics.readonly — read the channel’s analytics (views, watch time, likes, comments, shares, subscribers gained/lost and audience age, gender and country) to show charts in the Analytics section.

Data we access. Raw data: the channel’s ID, title, handle, avatar and subscriber count; the channel’s videos with their title, description, thumbnail, publish time, privacy status and statistics (views, likes, comments); and the comments and replies on those videos (text, author display name and avatar, time). Aggregated data: YouTube Analytics reports for the channel (daily views, watch time, likes, comments, shares, subscribers gained/lost, and audience age, gender and country distribution). These reports are aggregated and anonymized by Google; we do not receive the identity of individual viewers. We do not access any other Google account data (such as Gmail, Drive or contacts).

How we use it. Raw and aggregated Google user data is used only to provide the user-facing features you use in Social Analyze: showing your videos, comments and analytics in the panel; comment moderation (reply, hide, publish, delete) and uploading or deleting videos, always on your explicit instruction; reports and data exports that you generate; and, when you use an AI feature, generating the answer you asked for. We do not use Google user data for advertising, retargeting or personalized ads, profiling, credit or lending decisions, or any purpose unrelated to these features, and we do not create anonymized or aggregated datasets from it for other purposes.

Sharing and transfer. We do not sell Google user data and do not transfer it to data brokers, advertisers or other third parties. It is shared only: (a) with the members of your own workspace whom you give access to the brand; (b) with our AI provider (OpenAI by default; Anthropic if an administrator selects a Claude model for your account), only when you explicitly use an AI feature and only the data needed for that request (for example the text of one comment for an AI reply suggestion, or the channel and video statistics you ask the AI Assistant about or include in an AI report summary); these providers process API data to return the answer and do not use it to train their models; (c) with people who open a report share link that you create; (d) with our infrastructure providers (hosting and network security), which process it only on our behalf; and (e) where required by law. Google user data is not used to develop, improve or train generalized AI or machine-learning models.

How we protect it. All traffic is encrypted in transit with HTTPS (TLS). OAuth access and refresh tokens are encrypted at rest with AES-256-GCM. The database is not reachable from the internet (it only accepts connections from the application server), the application runs as an unprivileged system user, and server access is limited to authorized personnel using SSH keys (password login is disabled). Inside Social Analyze, access to a brand’s data is limited to the account owner and the team members they authorize, per section. Our staff do not read Google user data unless you ask us for support, it is needed for security purposes, or it is required by law.

Retention and deletion. Google user data is kept only while the channel is connected to a brand in Social Analyze. When you remove the channel in the panel, delete the brand or delete your Social Analyze account, the channel’s tokens and stored data (videos, comments and analytics) are deleted from our live database immediately, and nightly backups are overwritten within 15 days. If you revoke access in your Google account settings, we can no longer read or change anything on the channel; the channel then shows as disconnected and you can remove it to delete its stored data. You can also request deletion at any time via Data deletion or iletisim@socialanalyze.org; we complete such requests within 30 days.

Google user data (Google Business Profile)

When you connect a Google Business Profile we request the business.manage scope. With it we only access the following data of the locations you select: business name, category, address, phone, website, Google Maps link and profile image; customer reviews (star rating, text, the reviewer’s public Google name and photo, date) and your replies to them; your business posts; and aggregated, anonymous performance data provided by Google (views on Maps and Search, website clicks, calls and direction requests, search terms that found your business). We use this data only to show it in the panel and in your reports and, always on your explicit instruction, to reply to reviews, delete your reply and publish or delete business posts. We never edit your business information (address, hours, etc.) and cannot delete customer reviews. Sharing, protection, retention and deletion follow the same rules as the YouTube section above: when you remove the location in the panel its tokens and stored data are deleted.

Limited Use: Social Analyze’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI features run only when you use them. Your question and the brand data needed to answer it (analytics, posts, comments, messages) are sent to the AI provider listed in section 5. The iOS app asks for your consent before first use; if you decline, nothing is sent, and you can withdraw consent in Profile → Privacy. AI output can be wrong — review it before you publish.

Under Article 11 of KVKK and the GDPR you have the right to:

• Find out whether your personal data is processed and request information about it,
• Learn the purpose of processing and whether the data is used for that purpose,
• Know the third parties, in Türkiye or abroad, to whom your data is transferred,
• Ask for incomplete or inaccurate data to be corrected, for data to be erased or destroyed, and for these actions to be notified to recipients,
• Object to a result against you that arises solely from automated analysis,
• Claim compensation for damage caused by unlawful processing,
• Under the GDPR, also receive your data in a portable format and restrict processing.

Send your request from your registered email address to iletisim@socialanalyze.org. Requests are answered free of charge within 30 days. If you are not satisfied with the answer, you can complain to the Turkish Personal Data Protection Authority or, if you are in the EU, to your local data protection authority.

• Essential: your language preference (NEXT_LOCALE, 1 year) and the in-app view for pages opened from the iOS app (sa_inapp, session only).
• Session: your sign-in token is kept in your browser’s local storage, not in a cookie, and is removed when you sign out.
• Analytics: Google Analytics runs in consent mode without cookies; no analytics or advertising cookies are written to your browser and only anonymous, aggregate measurement takes place.
• Product analytics: OpenPanel, running on our own server, uses no cookies or local storage; signed-out visits are told apart by a daily-rotating, non-reversible identifier derived from IP and browser details, and signed-in activity is linked to your account. Pages whose URL carries a secret link, such as password reset, are not measured.

We protect your data with TLS encryption on every connection, bcrypt password hashing, AES-256-GCM encryption of platform access tokens, signing out all sessions when a password changes, account lockout and rate limits, access controls, regular security updates and daily backups to a separate server.

The Platform is a business tool and is not directed at anyone under 18. We do not knowingly collect data from anyone under 18.

This policy may be updated to reflect changes in our services or the law. We will notify you of significant changes by email to your registered address. The current version is always published on this page.

For all questions and requests about this policy or your personal data: iletisim@socialanalyze.org