← Back to Home

Privacy Policy

Last updated: 7 April 2026

This English translation is provided for convenience. In case of any discrepancy, the Turkish version prevails. Read the Turkish version

At İndoles Yazılım Anonim Şirketi (“Aduardo”, “we”, “us” or “our”) we attach great importance to the protection of your personal data. This Privacy Policy explains which data we collect, how we use it, with whom we share it and what your rights are in respect of the AI-powered brand management and social media automation platform (the “Service”) we provide at aduardomind.com.

By using our Service you are deemed to have accepted this policy. If you do not accept it, please do not use our Service.

1. Data Controller

İndoles Yazılım Anonim Şirketi is responsible for the processing of your personal data.

2. Personal Data We Collect

2.1 Data You Provide Directly

  • First name, last name and email address (during registration)
  • Password (stored in hashed form using bcrypt)
  • Company/brand name and industry information
  • Profile photo (optional)
  • Billing details and payment method (via the payment provider)

2.2 Social Media Integrations

When you connect your Facebook, Instagram, WhatsApp Business or Telegram accounts to our platform, the following data is processed:

  • Platform access tokens (protected with AES-128-CBC + HMAC-SHA256 / Fernet encryption)
  • Page/account name, ID and profile information
  • Post performance metrics (likes, comments, reach, etc.)
  • Ad account data (if ad management is used)

2.3 Automatically Collected Data

  • IP address, browser type and device information
  • Session and usage data (which features are used)
  • Cookie data (see the Cookie Policy for details)

2.4 Data Generated by AI

  • Brand DNA analysis results
  • Text and visuals generated by AI
  • Campaign suggestions and content calendar data
  • Vector embeddings (for brand memory)

3. Purposes of Processing

Your personal data is processed for the following purposes:

  • Account creation, authentication and session management
  • Planning, creating and automatically publishing your social media content
  • AI-powered brand analysis, content generation and campaign optimization
  • Credit-based usage tracking and subscription management
  • Providing performance reports and analytics data
  • Technical support and customer communication
  • Improving service quality and developing new features
  • Fulfilling legal obligations

4. Legal Grounds

  • Performance of a contract: processing necessary to provide the Service
  • Legitimate interest: service security, fraud prevention, service improvement
  • Explicit consent: social media integrations, marketing communication
  • Legal obligation: tax and accounting obligations

5. Data Sharing

Your data is shared with third parties only in the following cases:

  • Social media platforms: content is published with your approval (Facebook/Meta, Instagram, WhatsApp, Telegram). Tokens are used solely for authorized API operations.
  • AI service providers: anonymized data is sent to the Google AI (Gemini) and Groq platforms for content generation. These providers do not use your data for model training.
  • Infrastructure providers: server hosting (AWS), email delivery (AWS SES), database and cache services.
  • Payment processors: your payment details are processed directly by the payment provider; your credit card details are not stored on our servers.
  • Legal requirements: data may be shared with the competent authorities in the event of a court order or a legal obligation.

Your data is under no circumstances sold or rented to third parties for advertising purposes.

6. Data Security

The following measures are taken to keep your data secure:

  • All communication is protected with SSL/TLS encryption
  • User passwords are hashed one-way with the bcrypt algorithm
  • Social media tokens are encrypted with Fernet (AES-128-CBC + HMAC-SHA256)
  • JWT-based session management (HttpOnly, Secure, SameSite=Strict cookies)
  • Authorization through role-based access control (RBAC)
  • Abuse prevention through rate limiting
  • Regular security updates and audits

7. Data Retention Periods

  • Account data: for as long as the account is active + 30 days after the account is deleted
  • Content and campaign data: for as long as the account is active
  • Usage logs: 12 months
  • Billing data: 10 years as required by law
  • Social media tokens: deleted immediately when the connection is removed

8. Your Rights

Under the Turkish Personal Data Protection Law (KVKK) and related legislation you have the following rights:

  • To learn whether your personal data is being processed
  • To request information if it has been processed
  • To learn the purpose of processing and whether the data is used in line with that purpose
  • To know the third parties in Türkiye or abroad to whom the data is transferred
  • To request the correction of incomplete or inaccurately processed data
  • To request the erasure or destruction of the data
  • To object to a result to your detriment that arises from the analysis of the processed data exclusively by automated systems

To exercise these rights you may contact [email protected]. Applications are answered within 30 days at the latest.

8.1 Rights of users in Türkiye (KVKK)

If you are located in Türkiye, your personal data is processed under Law No. 6698 on the Protection of Personal Data (“KVKK”). Our detailed disclosure — covering the categories of data processed, the legal grounds, data transfers and how to submit a data subject application — is published in Turkish on our KVKK Clarification Text page.

9. International Data Transfers

While the Service is being provided, your data may be processed on servers outside Türkiye through our infrastructure providers. Such transfers are carried out within the framework of adequate security measures and standard contractual clauses. Data sent to AI service providers is anonymized and does not qualify as personal data.

10. Children’s Privacy

Our Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from persons under 18. If we become aware of such a case, the relevant data is deleted immediately.

11. Changes to This Policy

We may update this policy from time to time. You will be informed at your registered email address when material changes are made. The current policy is always published on this page.

12. Contact

For any questions, requests and complaints regarding privacy: