Privacy Policy

Last updated: 9 October 2026 · Version: v2.0

This English version is provided for convenience. In case of any discrepancy, the Turkish version prevails.

DemiraySoft ("we", "us", "our company") is a software and digital product studio operating at demiraysoft.com. This Privacy Policy covers the demiraysoft.com website, the software products we offer through demiraysoft.com (e.g. Periyodik Kontrol), the third-party integrations we use for these products' social media account management and content publishing features (Meta/Facebook, Instagram, TikTok, YouTube, LinkedIn, X), and payments collected through demiraysoft.com.

Some of our products publish separate privacy notices on their own domains. If you use a product through its own domain, the notice published on that domain takes precedence; this policy applies to the shared processes carried out through demiraysoft.com (the social media publishing infrastructure and centralised payment collection).

1. Data Controller

Trade name: DemiraySoft
Address: Çalca OSB 1. Cad. Tasarım Teknokent A.Ş. No: 1/3 İç Kapı No: 204 Demiray Technology — Merkez / Kütahya, Türkiye
Tax office: Çinili V.D.
Tax ID number: 4820868313
Trade registry number: 13985
MERSİS number: 5875314481600001
Website: https://demiraysoft.com
Email: [email protected]
Phone: +90 543 969 43 47

2. Data We Collect

2.1 When you visit our website

When you contact us through the contact form or via WhatsApp/email, we process your name, contact details and the content of your message. In addition, technical records (log records) such as IP address, browser/device information and request time are kept to secure the website and prevent misuse; Cloudflare Turnstile is used on the contact form for bot protection.

2.2 When you connect your social media account (OAuth)

When you connect your Instagram, Facebook, TikTok, YouTube or LinkedIn account through our products, we may access the following types of data within the scope you authorise on the relevant platform:

Basic account/profile information (username, display name, profile photo, account ID)
The list of pages/channels/accounts you manage (e.g. the Facebook Pages or YouTube channels you manage)
The content you create and ask us to publish (text, images, video) and its publishing schedule
Access and refresh tokens
Basic engagement/statistics data (only if the relevant permission has been granted)

This access is used only when you explicitly connect a social media account and instruct us to publish content. We do not access any user data other than the account you connect, we do not share your account's content outside the platform you connected, and we do not sell it to third parties.

2.3 When you make a payment

Some payments for our products are collected centrally through demiraysoft.com. At the payment step, your full name, email address, phone number, billing/address details, order amount, currency and order number are processed.

Contract acceptance record: When you accept the Distance Sales Agreement and the Pre-Information Form at the payment step, the date and time of acceptance, your IP address, the version of the text you accepted and the order number are recorded. This record is retained together with the order and payment records to prove that the contract was concluded. For automatically renewing subscriptions, the record of your explicit consent to the storage of your card details on the PayTR infrastructure is kept in the same way.

Your card details are not seen, processed or stored by DemiraySoft. Card data is processed directly through the secure payment page and 3D Secure infrastructure provided by PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., a payment institution licensed by the BDDK (Banking Regulation and Supervision Agency of Türkiye). We keep only the outcome of the transaction (successful/failed), the order number, amount, date and masked reference information such as the last 4 digits of the card, where available. PayTR's own privacy notice governs its data processing. For the full sales and refund processes, please see the Distance Sales Agreement and the Cancellation and Refund Policy.

3. How We Use Data

To publish content to, or create it as a draft on, the social media account you have connected, as you request
To show you in the interface which account is connected (account selector)
To collect payment for the service you purchase, issue invoices, manage your subscription and resolve refund/cancellation requests
To respond to your support requests and communicate with you about the service
To keep the service running, fix errors, prevent fraud and maintain security
To fulfil our legal obligations

We do not use your data for advertising, we do not transfer it to third parties for marketing purposes, and we do not sell it. We do not use data obtained from your social media account for profiling, ad targeting or model training.

4. Legal Grounds

Your personal data is processed under Article 5 of the KVKK (Turkish Personal Data Protection Law No. 6698) and Article 6 of the GDPR on the following grounds: the conclusion or performance of a contract (providing the service, payment), explicit consent (connecting a social media account), legal obligation (invoicing and financial legislation, retention obligations) and legitimate interest (security, fraud prevention).

5. Data Retention and Security

Access tokens and connected account information are stored on our encrypted, access-controlled servers only for as long as necessary to provide the service. You can remove your account connection from the product dashboard at any time; in that case, the relevant access token is revoked and deleted.

Retention periods:

Social media access tokens and connected account information: deleted when you remove the connection or delete your account.
Contact form / support correspondence: up to 2 years from the resolution of the request.
Payment and invoice records, and contract acceptance records (date, time, IP, version): 10 years, as required by tax and commercial legislation.
Technical log records: up to 12 months.

6. Third-Party Service Providers

Social media publishing infrastructure: Content planning and publishing are carried out through our own management tool, which is hosted on our own servers and operated solely by us. Your data is not transferred to any external third party in this process.
Payment: PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (only the data necessary for the payment transaction).
Social media platforms: Meta (Facebook, Instagram), TikTok, Google (YouTube), LinkedIn, X — solely to send content to the account you have connected, within the scope of the permissions you have granted.
Hosting and infrastructure: Our services are hosted on access-controlled servers.

Some of these providers are located outside Türkiye. If you connect your social media account, the content you ask us to publish is transferred to the servers of the relevant platform (abroad); this transfer is necessary to carry out your instruction and is based on your explicit consent.

7. YouTube API Services

Our products use YouTube API Services for the YouTube integration. By using this integration, you agree to the YouTube Terms of Service. You can review how Google processes your data in the Google Privacy Policy, and you can revoke our application's access to your account at any time from the Google security settings page.

8. Cookies

Our website and products use only strictly necessary cookies required for the service to work (session management, security, bot protection, remembering preferences). We do not use advertising or third-party tracking cookies. You can block cookies in your browser settings; in that case, some functions such as signing in may not work.

9. Deletion of Your Data

You can request the deletion of your account and data in the following ways:

Removing the social media connection: Remove the account from the "Connected Accounts" section of the relevant product's dashboard. The access token is revoked and deleted immediately.
Revocation on the platform side: You can remove our access via Settings > Apps and Websites for Facebook/Instagram, via the Google security settings for Google/YouTube, and via the relevant app permissions section for TikTok and LinkedIn.
Deletion of all data: Fill in the Data Deletion Request form or send an email to [email protected] with the subject "Data Deletion Request". Your request will be resolved within 30 days at the latest and you will be informed. Only records that must be retained under financial legislation (invoices, etc.) continue to be kept for the statutory period.

10. Your Rights (under the KVKK and the GDPR)

Under Law No. 6698 on the Protection of Personal Data (KVKK) and related legislation, you have the right to access your data, to request its correction/deletion, to object to its processing, to request the portability of your data and to withdraw your consent (by removing the social media connection). You can send your requests to [email protected]. Applications are answered within 30 days at the latest.

11. Children's Privacy

Our services are not directed at persons under the age of 18, and we do not knowingly collect data from them.

12. Data Breach Notification

If we detect a breach affecting the security of your personal data, we will notify the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) and the affected users within the period prescribed by the applicable legislation.

13. Changes to This Policy

We may update this policy from time to time. In the event of significant changes, notice will be given on this page. The current version is always published on this page.

14. Contact

For questions: [email protected] — +90 543 969 43 47