Privacy Policy
What data we collect, why we process it, who we share it with, and how long we keep it.
This policy explains what data we collect when you use Mentorivo, why we process it, who we share it with and how long we keep it. The legal bases and how to exercise your rights are covered separately in the Data Protection Notice (KVKK / GDPR).
1. Who the controller is
For data about your account, subscription and usage, the data controller is Mekjoy Dijital Bilişim Anonim Şirketi.
For data coming from your ad accounts and stores the position is different: there we act on your instructions. That distinction matters legally and is set out in detail in the Data Protection Notice.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account details | Name, email address, password hash, interface language, profile image | Directly from you, at sign-up |
| Workspace details | Workspace name, members, roles, invitations | From you and from whoever invited you |
| Billing details | Billing name, address, tax office and number, payment status | From you; payment confirmation from iyzico |
| Session and security records | IP address, user agent, sign-in time, token rotation records | Automatically, while using the service |
| Audit log | Which user performed which action and when, values before and after the change | Automatically, from in-app operations |
| Advertising and commerce data | Campaigns, ad sets, ads, keywords, impression/click/conversion metrics, product catalogue | From the platform accounts you connect |
| Creative content | Images you upload, images and videos you generate, prompt text you write | From you and from the generation providers |
| Support correspondence | Tickets you open, message content, attachments | Directly from you |
| Notification addresses | Phone number, Telegram or Slack account added to receive notifications | From you, optional |
3. Ad account data — a special case
Data from the advertising and commerce accounts you connect is the core of the product. Three rules apply to it:
- It is processed only to provide the service to you. It is not sold, rented or used to market to other customers.
- It stays inside the workspace boundary. The application layer rejects any query that does not carry a workspace identifier; this is a constraint written into the database access layer, not a preference.
- Your access tokens (OAuth) are stored encrypted with AES-256-GCM. Unencrypted copies do not exist in the database.
When processing order data we do not store your customers' names, addresses or phone numbers — only the opaque customer identifier the platform provides. The point is to never receive personal data we do not need.
4. Why we process it
- To create your account, verify your identity and maintain your session.
- To analyse your ad accounts and produce reports and recommendations.
- To run the automation rules you set up and record their results.
- To provide AI-assisted creative generation and agent features.
- To handle subscriptions, credits and invoicing.
- To send the notifications you ask for and to answer support requests.
- To keep the service secure and to detect and prevent abuse.
- To meet our legal obligations and to provide evidence in possible disputes.
- To improve the product using aggregated, de-identified usage statistics.
We do not sell or rent your data to third parties for marketing without your explicit consent. That is not the product's business model.
5. Data sent to AI providers
Creative generation and agent features run on third-party AI providers. That means your data leaves our servers, and you should know what goes.
| Feature | What is sent | Provider |
|---|---|---|
| Agent (chat, analysis, proposals) | Your question, campaign and metric summaries, workspace configuration | Anthropic (USA) |
| Image and video generation | Your prompt, product images you upload, the template you choose | fal.ai (USA) |
| Avatar video | Your prompt, the chosen avatar and voice | HeyGen (USA) |
| Virtual try-on | Product and model images | FASHN (USA) |
- Your account password, payment details and OAuth tokens are NEVER sent to these providers.
- Generated output is stored in our own storage; temporary copies at the provider are subject to that provider's retention policy.
- You can choose not to use these features; if you do not use them, no data goes to these providers.
6. Who we share with
We work with a number of service providers in order to deliver the service. Each accesses only as much data as its own job requires and is bound by contract.
| Provider | Purpose | Location |
|---|---|---|
| Netvay Bilişim Hizmetleri | Server and database hosting | Türkiye |
| iyzico | Payment collection and refunds | Türkiye |
| Cloudflare R2 | Storage of image and video files | Global (multi-region) |
| Anthropic | Agent and text generation | USA |
| fal.ai | Image and video generation | USA |
| HeyGen | Avatar video generation | USA |
| FASHN | Virtual try-on imagery | USA |
| Meta, Google, TikTok, LinkedIn, X | Access to the ad accounts you connect | USA / global |
| Shopify, Trendyol, İkas and other commerce platforms | Access to the stores you connect | Varies by platform |
| Our email infrastructure | Sending transactional and notification email | Türkiye |
Beyond these, data may be shared on a lawful request from a competent public authority, where necessary to establish or defend a legal claim, and in a merger or transfer of business (with prior notice).
7. International transfers
Our servers and database are located in Türkiye. Even so, the table above includes providers outside Türkiye, which means part of the data is transferred abroad.
Transfers follow the conditions in Article 9 of the KVKK: an adequacy decision, appropriate safeguards, or your explicit consent. When you use the AI features you should be aware this transfer takes place; the detail is in the Data Protection Notice.
8. How long we keep it
| Data | Period | Reason |
|---|---|---|
| Account and profile | For as long as the account is open | Providing the service |
| Session records | At most 30 days after the session ends | Security review |
| Audit log | 2 years from the date of the record | Accountability and disputes |
| Invoices and payment records | 10 years | Tax and commercial legislation |
| Advertising and metric data | Until the connection is severed; at most 90 days after | Continuity of reporting |
| Creative content | Until you delete it; at most 90 days after the account closes | Your access to your own work |
| Support correspondence | 3 years after the ticket closes | Limitation periods |
When a period expires the data is deleted or irreversibly anonymised. Copies in backups disappear as the backup cycle completes.
9. Security
The principal technical and organisational measures we take:
- All traffic is encrypted with TLS. Session cookies are written HttpOnly and Secure; JavaScript cannot read them.
- Passwords are stored as irreversible hashes; no plaintext password exists in the database.
- Ad platform access tokens are encrypted with AES-256-GCM.
- Workspace isolation is enforced in the database access layer: a query without a workspace identifier does not run.
- Access to the management panel is protected by IP restriction, second-factor authentication and a separate session layer.
- Every administrative intervention is written to the audit log.
No system offers absolute security. If we detect a breach affecting your personal data we will notify you and the Turkish Personal Data Protection Authority within the periods the law prescribes.
10. Your rights
You have the right to access your personal data, to have it corrected or erased, to have processing restricted, to receive your data in a portable format, and to object to processing.
The scope of these rights, how to exercise them and how quickly a request is answered are set out in the Data Protection Notice.
11. Cookies
We use only cookies strictly necessary for the service to work; we use no advertising or analytics cookies. The full list, with durations and purposes, is in the Cookie Policy.
12. Children
The service is not directed at people under 18 and we do not knowingly collect data from them. If we learn that we hold a child's data we delete it without delay.
13. Changes to this policy
We may update this policy. Material changes are announced by email and inside the dashboard before they take effect. The version number and effective date appear at the top of this page.
14. Contact
For privacy questions and requests write to info@mekjoy.com. For formal requests concerning your personal data, follow the application procedure in the Data Protection Notice.