Privacy Policy

1. Data we process

• Account data: name, email, password hash (the password itself is not stored), company/account name, team members and their roles, two-factor authentication setting.
• Billing data: billing name, address, tax ID/Turkish national ID number (where required for invoicing), purchased plan, payment amount and date, the payment provider's transaction reference.
• Content data: product/site links you enter and publicly available information read from those pages, images and logos you upload, and the scripts, images, videos, audio and text we produce.
• Connected account data: access authorizations for the advertising, social media and website accounts you connect, account/page IDs, campaign and ad settings, performance metrics (impressions, clicks, spend, conversions).
• Conversion data (optional): if you connect your store, your customers' order events (see Section 5).
• Usage and security data: session information, sign-in times, activity and audit logs, error logs, IP address (short-term, for security and abuse prevention).
• Support data: messages you send through the support form and by email.

The Service is not designed to collect special categories of personal data (health, biometric, religion, etc.); we ask that you do not upload such data as content. The Service is not intended for persons under 18 years of age.

2. Payment and card information

3. Why we use data

• To create your account, verify your identity and provide the Service (ad production, publishing, measurement, optimization, reporting).
• Payment, invoicing, credit and subscription management; obligations arising from tax and commercial legislation.
• Security, prevention of fraud and abuse, and enforcement of AI usage limits.
• Transactional notifications about the Service (verification, payment, campaign status, security alerts).
• To respond to your support requests.
• To improve the Service — only with aggregated and de-identified statistics.
• If you have given consent, commercial electronic messages such as the blog/newsletter (every message includes an unsubscribe link).

We do not sell or rent your data, and we do not give it to third parties for ad targeting purposes. We do not use data received from your connected accounts for the general training of AI models.

4. Advertising, social media and Google account connections

We connect to your Meta (Facebook, Instagram), TikTok, Google Ads, LinkedIn and Google Search Console/Analytics accounts via OAuth, with your explicit consent; for ChatGPT Ads (OpenAI) and Bing you enter the API key of your own account, and for WordPress, Shopify and ikas you enter an application password/access token in the panel yourself. We only request the permissions shown on the connection screen.

• Access tokens and API keys are stored in a separate vault with KMS envelope encryption, are never shown again in the panel and are not written to logs.
• These authorizations are used only for the tasks you request: creating and publishing ads/posts, reading performance, and applying changes you approve.
• You can remove a connection at any time from the panel or from the relevant platform's settings; when you do, the stored tokens are deleted.

Google API data — Limited Use

14ads's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only for the features we provide to you; it is not used to sell advertising, for credit assessment or for the general training of AI models, and it is not read by humans except with your permission, for security purposes or where required by law.

Platform-specific terms: Third-Party Platform Terms.

5. Conversion data relating to your customers

Connecting store conversion notifications is optional. If you connect it, your store sends us order events of your own customers; we forward these to advertising platforms only as a one-way hash (SHA-256): the plain-text email and phone number are neither stored nor sent. Order ID, amount, currency, time and page URL are sent in plain form. For this data you are the data controller and 14ads is the data processor; informing your customers and obtaining their consent where required is your obligation.

6. Site measurement

We measure which pages are visited and which channels visitors come from on our own server. This measurement uses no cookies and is not sent to third parties. IP addresses are not recorded; they are one-way hashed with a key that is renewed every day and deleted the following day. Only campaign tags (utm) are taken from query parameters. The user panel is not measured. If your browser sends a “Global Privacy Control” or “Do Not Track” signal, no measurement takes place. Measurement records are deleted after 13 months.

Google Analytics (only with your consent): If you consent in the cookie banner, page view and interaction statistics are collected with Google Analytics 4. The following is sent to Google: the address of the page you visit (with query parameters removed except campaign tags), the referring site, browser/device information, approximate location and the _ga cookie ID. The user panel, admin area and token-bearing addresses such as email verification or password reset are not measured. Google signals and ad personalization are turned off; the data is not used for advertising. Google processes this data as a data processor and its servers are outside Turkey. You can withdraw your consent at any time via the “Cookie preferences” link in the footer. Google Analytics data is deleted after 14 months.

7. With whom we share data

To provide the Service, we share only the necessary data with the following groups of recipients:

Since a significant number of these providers are located abroad, this sharing constitutes a cross-border transfer; the legal basis for the transfer is explained in the KVKK Information Notice.

8. Retention periods and security

We retain data for as long as your account remains open and for the periods required by applicable legislation; the periods are listed in a table in the KVKK Information Notice. We use TLS encryption in transit, KMS envelope encryption for secret keys, role-based access, mandatory two-factor authentication for staff and an immutable audit log. In the event of a data breach, we notify the Personal Data Protection Board and the affected persons in accordance with the KVKK.

9. Account and data deletion

You can delete your account yourself from the panel: Panel → Account and data → “Delete my account”. Your ads are paused as soon as you submit the request; for 7 days you can sign in and withdraw the request. When this period expires, campaigns, produced videos and images, measurement records, social posts, notifications, conversion events, integrations, connected account tokens and Visibility Agent data are permanently deleted; subscriptions with the payment provider are cancelled; and the user and account records are anonymized.

What remains: invoicing and credit ledger records are retained linked to the anonymized account, due to retention obligations under tax and commercial legislation; the security audit log cannot be altered. Data previously sent to advertising platforms remains in those platforms' records; to have it deleted, you need to use the relevant platform's tools.

Deleting your Facebook/Instagram connection data: You can remove 14ads in the “Apps and websites” section of your Facebook settings and delete your account using the steps above, or send a deletion request through our support channel; the request is completed within 30 days at the latest.

10. Your rights and contact

You can find your rights under Article 11 of the KVKK (request for information, rectification, erasure, objection, etc.) and how to apply in the KVKK Information Notice. For privacy-related questions, you can use the in-panel support form.

When we update this policy, we change the date at the top of the page; we announce material changes by email or panel notification.