Privacy Policy

This policy explains which data we collect when you use the Kararis platform operated by Zehra Eslem Karaca (04.09 Digital) ("Kararis", "we"), why we collect it, with whom we share it and which rights you have over that data.

The conditions under which your personal data is processed under the Turkish Personal Data Protection Law No. 6698 (KVKK), the legal grounds and the exercise of your rights are set out in a separate document: the KVKK Information Notice. Retention periods and the deletion procedure are also separate: the Data Retention and Deletion Policy. For transfers to artificial intelligence providers, see the AI Provider Statement.

1. Two different kinds of data, two different roles

Kararis is a multi-tenant platform and the data in it is not of a single kind. This distinction shapes the rest of the policy, which is why it comes first.

Account data. Data belonging to your user account — your name, e-mail address, session record and the log of the actions you take in the panel. For this data we are the data controller: we decide what we process and why.

Brand data. Advertising, analytics, commerce and reservation data that an agency connects to the platform on behalf of its own client (the brand). For this data we act as a data processor on behalf of the agency: the agency decides which account is connected, what the data is used for and when it is deleted, and we process it on the agency's instructions. The duty to inform the agency's own client rests with the agency.

2. Data we collect

a. Account and identity data

Your name, e-mail address and password. Your password is never stored in plain text; only an irreversible digest (hash) is kept. Your account is created only through an invitation link; this link is single-use and time-limited. The invitation record contains the invited e-mail address.

We also record which organization you are a member of, your role and which brands' data you are authorized to see. Your access boundary is read from this record.

b. Session and technical data

Cookies that keep your session alive and protect your forms against forgery (see section 9), the session duration and the standard request information sent by your browser.

c. Product usage record

An event record of how you use the product — such as which screen was opened or which decision was marked. This record is kept in the product's own database; no third-party behavioural analytics tool such as Google Analytics, Hotjar or Mixpanel is used, and no third-party tracking code runs in the panel.

d. Audit record

The setting up and removal of platform connections, the membership lifecycle and permission changes are written to an immutable audit ledger. This ledger shows who did what and when; API keys, tokens, passwords, raw request and response bodies and unsanitized error messages are not written to this ledger.

e. Legal text acceptance record

We record which legal text you accepted, in which version and when. This record cannot be changed afterwards.

f. Brand data from connected platforms

When you connect a platform account, we pull from that platform only the measurement data needed to provide the service:

Source	Data received
Google Ads	Spend, impression, click and conversion metrics at campaign, ad group and search term level; campaign goal and budget setting (see section 7)
Google Analytics 4	Daily aggregate metrics at session, source/medium, event and product (item) level (see section 7)
Google Search Console	Impression, click and ranking metrics at query and page level (see section 7)
Meta Ads	Performance metrics at campaign, ad set and ad level; creative text and ad configuration
Instagram (professional account)	Organic reach, engagement and audience summary at account and content level
Facebook Page	Text, image, link and publication time of organic posts published on the Page; the ID of the Instagram professional account linked to the Page (see section 6)
İkas	Amount, status and currency at order and order line level; stock status of products and variants
HotelRunner	Date, night, room, channel and amount information at reservation level

This data is the brand's commercial data; it is not the personal data of the brand's end customers. Order records do not hold the end customer's name, e-mail, phone or address. In reservation records, guest identity information is stripped from the provider's response before it is written to the database and is not stored. Data produced by Google Analytics is received aggregated at day and dimension level, not at user level.

g. Connection credentials

The API keys, secret keys and tokens of the platforms you connect are stored encrypted, are not shown back in the panel and are not written to the audit record.

h. Error and technical fault record

When an error occurs, an error trace and technical context are recorded for diagnosis; this record is also sent to the error monitoring service listed in section 5.

3. Things we do not do

We do not sell your personal data or your brand data.
We do not use your data for ad targeting and do not share it with third parties for advertising purposes.
We do not run marketing or profiling cookies in the product.
We do not use your data to train an artificial intelligence model on our behalf.
We do not include a brand's data in any benchmarking pool without an explicit and revocable consent record (see section 8). Google data received through the authorization you give with your Google account does not enter any benchmarking pool even with a consent record (see section 7.e).

4. Purposes for which we use data

Providing the service: collecting and combining data, producing decisions with the rule engine, showing them in the panel and delivering reports by e-mail.
Creating your account, verifying your identity and enforcing your access boundary.
Ensuring security: detecting unauthorized access, keeping an audit record.
Diagnosing and fixing faults.
Measuring and improving the product's own quality.
Fulfilling our legal obligations and defending against legal claims.

We share your data only with the service providers needed to provide the service and, at your request, with the artificial intelligence assistant you connect yourself. The types of providers we use today are:

Provider type	Purpose	Data transferred
Hosting and database	Running the platform	All data on the platform
Error monitoring	Fault diagnosis	Error trace and technical context
E-mail delivery	Report and system e-mails	Recipient address and e-mail content
Artificial intelligence providers	Optional text generation	Listed in detail in the AI Provider Statement; for data received from Google APIs, the limit in section 7.d applies
The artificial intelligence assistant you connect	Reading through your assistant, at your request	Decisions, metrics and evidence within the brand scope you are authorized for (see sections 6.c and 7.d)

Apart from these, we share your data only (i) in the case of a legal obligation or a duly made request by an authorized public body, (ii) where necessary to establish or defend a legal claim and (iii) in the case of a merger or acquisition — in which case you will be informed in advance. For data received from Google APIs, the narrower rule in section 7.d applies.

6. Meta data

This section brings together in one place the data that comes from Meta platforms (Facebook, Instagram and Meta ad accounts). Data from Meta is also subject to the other sections of this policy. Meta data is processed only for the relevant brand's own performance decisions and reports; it is not sold or licensed, and it is not used for ad targeting, eligibility decisions, surveillance or building personal profiles.

a. Facebook Page organic posts

When a brand's Facebook Page is mapped to the brand in Kararis, the organic (non-advertising) posts published on that Page are read through the Meta Graph API. If an Instagram professional account is linked to the Page, that account is found the same way and the Instagram data in section 2.f is read from that account. The Meta permissions used and their purposes are:

Meta permission	Data read	Purpose
`pages_show_list`	The list of managed Pages and the Page access token needed to read the Page	Mapping the Page to the brand and reading its posts
`pages_read_engagement`	Text, image, link and publication time of Page posts; the ID of the Instagram professional account linked to the Page	Showing the brand's organic social content in the panel and in reports
`instagram_basic`, `instagram_manage_insights`	Posts and stories of the Instagram professional account, and the reach and engagement counts of these and of the account	Producing the brand's social performance summary
`ads_read`	Performance and configuration of the ad account at campaign, ad set and ad level	Producing the brand's advertising decisions and report

The Page access token is not stored; it is obtained from Meta again on every read.

When this path is enabled, the agency specialist will be able to set up the Meta connection with their own Meta account through Facebook Login for Business. When the connection is set up this way, the following data is received and stored:

your Meta user ID (the numeric ID Meta issues for this app),
the access token issued by Meta,
the list of ad accounts, Facebook Pages and Instagram professional accounts this token can access is received (so that you can map the accounts to brands); only the IDs of the accounts you map to brands are stored.

The access token is stored encrypted in the database; it is not written to the panel, to logs or to e-mail (see sections 2.g and 11). The token's lifetime is about 60 days and cannot be extended by Kararis; to renew it, you log in with Meta again. No data is read from a connection that has expired or been revoked. The Meta business account management permission (business_management) is not requested.

Kararis does not write data to Meta. The connection is read-only: it does not create, change or delete ads, campaigns, budgets, posts or Page settings; it does not send measurement or customer data to Meta.

Meta data can also be read through business access granted by the agency's Meta business partnership; on that path your personal Meta login is not used and the login data in this subsection is not received.

If you have connected an artificial intelligence assistant of your own choice to Kararis — for example Claude (Anthropic) or ChatGPT (OpenAI) — (AI Provider Statement section 9), decisions, metrics and evidence produced from Meta data may also be transferred to that assistant. This transfer is sharing done at your request:

you set up the connection; without a connection no Meta data goes to any assistant,
the data goes when your assistant asks Kararis a question on your behalf,
only data within the organization and brand scope you are authorized for is read; an unauthorized target is rejected,
the reading is read-only and every call is written to the ledger,
the data goes to the assistant provider you chose, and that provider processes the data under its own terms (AI Provider Statement section 9.b).

This sharing is separate from the transfer Kararis makes for text generation to the artificial intelligence providers it chooses itself; that transfer is also listed in the AI Provider Statement.

d. Deletion of Meta data

When Meta login is enabled, for a connection set up through the login in section 6.b:

Removing the app from Meta. When you remove Kararis's access from your Facebook account settings, the access token of all your connections set up through this login and your Meta user ID are deleted and the connections are revoked.
Data deletion request through Meta. When you use Meta's data deletion request path, the same deletion is carried out; you are given a confirmation code with which you can track the status of your request.
Removing it from within Kararis. When you remove the connection from Kararis, the token and the Meta user ID are deleted in the same way and the connection is revoked. Because Kararis does not write to Meta, this does not withdraw your permission on the Meta side; you can remove the permission from your Meta settings.
Request by e-mail. You can also request deletion by writing to kvkk@kararis.com; the application procedure is in the KVKK Information Notice.

These paths do not delete the brand's advertising and social performance data: that data is the brand's business data and is subject to the periods and procedure in the Data Retention and Deletion Policy.

7. Google data

This section brings together in one place the data received from Google APIs: Google Ads, Google Analytics 4 and Google Search Console. This data can arrive by two paths: the authorization you give Kararis with your Google account (Google login, section 7.c) or Kararis's own Google API access. The rules of this section apply to data from both paths; only sections 7.c and 7.f are specific to the Google login path. Data from Google is also subject to the other sections of this policy; where this section sets a narrower rule, this section applies. The rules apply both to the raw data received from Google and to data aggregated, anonymized or derived from it (decisions, reports, summaries).

a. Scope and purpose

Google data is processed only to provide and improve the performance decisions, metrics and reports of the relevant brand that you see in the panel and in reports.

Google data is not sold; it is not transferred to advertising platforms, data brokers or information resellers.
It is not used for serving ads, retargeting, or personalized or interest-based advertising.
It is not used to determine credit-worthiness or for lending purposes.
It is not displayed or given to a third party conducting surveillance, and it is not used to build personal profiles.

You and your authorized team members seeing the data in the panel is the service itself. Kararis personnel and service providers read Google data only:

when you have given prior, affirmative agreement for us to view specific data (for example in a support request),
when necessary for security purposes (for example investigating a bug or abuse),
when necessary to comply with applicable law,
when the data (including derivations) is aggregated and used for internal operations in accordance with applicable privacy law.

We ensure that our employees, contractors, agents and successors also comply with these rules.

b. Data accessed and Google permissions

Google permission	Data read	Purpose
`adwords` (Google Ads)	List of accessible ad accounts; performance at campaign, ad group, keyword, search term, landing page and product level; budget and bidding goal settings; Google Shopping product approval and eligibility status	Producing the brand's advertising decisions and report
`analytics.readonly` (Google Analytics 4)	List of accessible properties and property settings; session, source/medium, conversion, revenue and product metrics — aggregated at day and dimension level, not at user level	Showing the brand's traffic, demand and revenue metrics
`webmasters.readonly` (Google Search Console)	List of accessible properties; click, impression and ranking at search query and page level	Showing the brand's organic search performance
`openid`, `email`	The identifier Google assigns to the Google account that sets up the connection, and its e-mail address	Showing which Google account set up the connection

Search Console query text may contain the phrase internet users searched for on Google; Kararis does not associate this text with the person who searched and receives no such information.

The adwords permission is the only permission of the Google Ads API and covers reading and writing together; Kararis uses this permission only to read.

Once this path is enabled, an agency specialist will be able to set up the Google connection with their own Google account. When the connection is set up this way, the following data is received and stored:

your Google account identifier (the identifier Google assigns for this application) and your Google account's e-mail address,
the refresh token issued by Google and the list of permissions you granted,
if you access ad accounts through a manager account, the ID of that manager account,
the list of ad accounts, Analytics properties and Search Console properties this authorization can access is received (so that you can map them to brands); only the IDs of the accounts you map to brands are stored.

The refresh token and the Google account details are stored encrypted in the database and are not written to the panel, to logs or to e-mail (see sections 2.g and 11). The short-lived access token produced from the refresh token is not stored; it is held in memory only while reading. If you connect the same Google account in more than one organization, each organization holds its own separate connection.

Kararis does not write data to Google. The connection is read-only: it does not create, change or delete campaigns, budgets, bids, ads, or Analytics or Search Console settings, and it does not send measurement or customer data to Google.

Google data may also be read through Kararis's own Google API access; on that path your personal Google login is not used and the login data in this subsection is not received. The rules of this section other than 7.c and 7.f apply in the same way to data received on that path.

Data received from Google APIs, whichever path it was received on, is transferred to another party only in the following cases:

Service providers. The hosting, error monitoring and e-mail providers in section 5, only to the extent needed to provide the service.
Artificial intelligence providers. If the artificial intelligence feature is on (AI Provider Statement section 2), content produced from Google data is sent only to an artificial intelligence provider that commits not to use data sent through its API for model training. Google data is not sent to router providers that hand the request to different sub-providers depending on current conditions (AI Provider Statement section 5). If no such provider is available, the feature works without artificial intelligence text for that content. Kararis does not use Google data to train a model on its own behalf.
The artificial intelligence assistant you connect (MCP). The conditions in section 6.c apply to Google data in the same way: you set up the connection, data goes when your assistant asks a question on your behalf, only data within the organization and brand scope you are authorized for is read, read-only, every call is logged, and the data is processed under the terms of the assistant provider you chose.
Security and law. Where necessary for security purposes (for example investigating abuse) or to comply with applicable law.
Merger or acquisition. In a merger, acquisition or sale of assets, Google data is transferred only after obtaining your explicit prior consent.

Apart from these, Google data is not transferred, sold or used for any other purpose.

e. Anonymous benchmarking pool

Google Ads, Google Analytics 4 and Google Search Console data received from Google APIs, whichever path it was received on — in raw, aggregated, anonymized or derived form — is not included in the anonymous benchmarking contribution in section 8, even if your organization has turned that contribution on.

f. Deletion of Google data

Once Google login is enabled, for a connection set up through the login in section 7.c:

Removing it from within Kararis. When you remove the connection from Kararis, the refresh token, the Google account identifier and the e-mail address are deleted immediately and the connection is revoked. This closes only the connection in that organization. Because Kararis does not write to Google, this does not withdraw your permission on the Google side; you can remove the permission from your Google account's third-party access page.
Removing access from your Google account. Google does not separately notify Kararis of this removal; Kararis sees it at the next token refresh attempt. At that point the refresh token, the Google account identifier and the e-mail address of the connections set up with that Google account are deleted immediately and the connection is marked as revoked; no further data is read from that connection.
Request by e-mail. You can also request deletion by writing to kvkk@kararis.com; the application procedure is in the KVKK Information Notice.

These paths do not delete the brand's measurement data already received from Google: that data is the brand's business data and is subject to the periods and procedure in the Data Retention and Deletion Policy. A connection breaking does not by itself trigger deletion; the brand or the agency withdrawing access as an organization, a deletion request or the end of the relationship does.

g. Google API Services User Data Policy statement

Kararis's use and transfer to any other app of information received from Google APIs — through Google login or through its own Google API access — will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Anonymous benchmarking contribution

Kararis is preparing for a capability that could produce industry benchmarks from brands' anonymized data. This contribution:

is given at organization level,
is off by default,
is always revocable,
is recorded together with an explicit statement that the agency has obtained this right from its own client,
is written to the ledger immutably, with opting in and revoking recorded separately.

Without a consent record, a brand's data enters no benchmarking pool. This is not a default setting; it is fixed in the software itself and cannot be turned on by a configuration change.

9. Cookies

Kararis uses only the cookies that are strictly necessary for the service to work. It does not use advertising, profiling or third-party analytics cookies.

Cookie	Purpose	Duration
Session cookie	Keeps you logged in	For the session; ends on inactivity
`XSRF-TOKEN`	Protects forms against cross-site request forgery	For the session

Both cookies are first-party and are sent with HttpOnly / SameSite protections. Strictly necessary cookies do not require separate consent; if you block these cookies you cannot log in to the platform.

Our landing page loads its visual style file through a content delivery network; during this request your browser's IP address is visible to the relevant network provider. This request sets no cookie and is not repeated on any page after you log in.

10. Transfers abroad

Some of the service providers we use are located outside Türkiye. Transfers to these providers are made in accordance with Article 9 of the KVKK, through the standard contract announced by the Board or other appropriate safeguard mechanisms. Details of transfers to artificial intelligence providers are in the AI Provider Statement.

11. Security

All traffic is encrypted with TLS.
Passwords are stored as irreversible digests; a minimum of 12 characters is required.
Secret keys and tokens of platform connections are kept encrypted in the database and are not written back to the interface.
An organization's data can be accessed only by the active members of that organization, and only within the brands they are authorized for. This boundary is enforced not in the interface but in the core of the application and is continuously verified by automated tests.
When permission or scope does not match, the system does not open access, it closes it.

No system offers absolute security. If we detect a breach affecting your personal data, we will inform you and the Personal Data Protection Board within the period required by law.

12. Your rights

Your rights under Article 11 of the KVKK, the scope of these rights and the application procedure are explained in detail in the KVKK Information Notice.

13. Children's data

Kararis is a business tool and is not intended for use by persons under 18. If we learn that we have unknowingly collected a child's personal data, we delete it without delay.

14. Changes to this policy

Every version of this policy carries a version number and an effective date. Earlier versions remain accessible in the form your acceptance record points to. When we make a material change we will inform you; the publication of a new version does not retroactively change the consent you gave to an earlier version.

Version note (1.1). The operator and data controller of the platform has been updated to Zehra Eslem Karaca (04.09 Digital), and the contact address has been written out in full as the business address in the tax record. Section 6 (Meta data) was added with this version: Facebook Page organic posts, Meta login (Facebook Login for Business) data, sharing through the assistant connection and the ways Meta data is deleted. A Facebook Page row was added to section 2.f and an assistant sharing row to section 5; the numbers of the following sections shifted by one. The other provisions did not change.

Version note (1.2). Section 7 (Google data) was added with this version: the scope and purpose of Google Ads, Google Analytics 4 and Google Search Console data received through the authorization given with a Google account (Google login) or through Kararis's own Google API access, the Google permissions requested, Google login data, sharing and the artificial intelligence provider limit, exclusion from the anonymous benchmarking pool, the ways the data is deleted and the Google API Services User Data Policy (Limited Use) statement. References to section 7 were added to the Google rows of section 2.f, to section 3 and to section 5; the former section 7 and the sections after it shifted by one. The other provisions did not change.

15. Contact

For your questions and requests: kvkk@kararis.com

Zehra Eslem Karaca (04.09 Digital) Kayabaşı Mah. 75. Yıl Cad. 1. Bölge -Akik- C8 Blok No: 4 B İç Kapı No: 25, Başakşehir/İstanbul