Privacy Policy

Introduction

ROASEO Teknoloji ve İnovasyon A.Ş. ("ROASEO", "we") is a digital marketing agency that serves its clients through its own software platform at platform.roaseo.com. This Privacy Policy explains what data we collect when you use the platform and when you connect your advertising and social media accounts, how we use it, how long we keep it, and your rights.

To request deletion of your data, see our Data Deletion Instructions.

Information We Collect

• Account information: email, name, phone, company name, billing details.
• Data from connected accounts: described in detail in "Connected Advertising and Social Media Accounts" below.
• Usage information: modules used, number of generations requested, services delivered.
• Content you create: instructions, generated content, uploaded files and brand kit.
• Technical information: IP address, browser, device, logs.
• Payments: transaction history (card numbers are held by our payment provider iyzico, not by us).

Connected Advertising and Social Media Accounts

When you, or a person you authorize, connect a Meta (Facebook, Instagram), Google (Ads, Analytics, Search Console) or TikTok account to ROASEO — through a login flow such as "Connect with Facebook" or by granting our business portfolio access — we access only the accounts you select and only within the permissions you grant.

Data we access through Meta (Facebook and Instagram)

• Ad account, campaigns, ad sets, ads, creatives, audiences and performance metrics (spend, impressions, clicks, results, costs).
• Facebook Page and Instagram business account information, posts and insights (reach, followers, engagement).
• Leads from your own lead forms: the name, phone, email and answers collected in your form.
• Pixel / dataset and product catalog information.
• If you choose to use these features: publishing posts you approve, and Page and Instagram comments and messages.

How we use this data

• To create, edit and optimize ads on your behalf (new ads are created paused and published only after your approval).
• To report results in a private dashboard visible only to you and our team.
• To deliver leads from your lead forms to your dashboard, and to send lead outcomes (whether a lead became a customer) back to the Meta Conversions API solely to optimize your own campaigns.
• To report your Page and Instagram performance, and to plan and publish content you approve.

Google user data: ROASEO's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access: you can disconnect at any time. On Facebook: Settings & privacy → Settings → Business Integrations → ROASEO → Remove. On Google: Google Account → Security → Third-party apps with account access. After you disconnect we receive no new data from that account.

Content You Create

For AI features, only the content needed for the generation (brand information, ad copy, performance summaries) is sent to AI providers (e.g. Anthropic, fal.ai, ElevenLabs) at generation time; these providers do not use API data for model training.

Service Providers

Your data is processed only to deliver the service, by providers bound by confidentiality obligations:

• Hosting and database (Supabase, server infrastructure)
• Social media publishing infrastructure (to schedule and publish posts you approve)
• AI generation providers (within the limits described above)
• Payments (iyzico), email delivery and notifications (Telegram)

Retention and Deletion

• Data from connected accounts is kept for as long as our service continues.
• When you disconnect or our service ends, we stop collecting data from that account immediately and delete the related data within 30 days.
• We do not collect or keep data of businesses we do not work with.
• Records with a legal retention obligation (e.g. invoices) are kept for the period required by law.
• To request deletion: Data Deletion Instructions.

Security

• All traffic is encrypted with HTTPS / TLS.
• Access tokens for connected accounts are stored encrypted, server-side only, and are never sent to the browser.
• Database access is protected by Row Level Security; each client sees only their own data.
• Payment data is processed by PCI-DSS certified iyzico; we do not store card numbers.
• Access is limited to team members who need it for their work.

Your Rights

Under KVKK (Turkish data protection law) and GDPR you may request access to, correction of, or deletion of your data, learn the purposes of processing and the third parties it is shared with, and have your account and connected-account data deleted entirely.

Requests: [email protected] — answered within 30 days.

Changes

We may update this policy from time to time and will notify you by email of significant changes. The current version is always on this page.

Contact