KVKK Privacy Notice
Last updated: 3 November 2026
This English version is a translation provided for convenience. For data subjects in Türkiye, the Turkish version prevails in case of any conflict.
1. Data Controller
1.1. This Privacy Notice has been prepared by WE1TOWN LIMITED (the "Company") as data controller, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
1.2. The Company is registered in the United Kingdom (England and Wales) under company number 13784988. Address: 160 City Road, London, EC1V 2NX, United Kingdom. Personal data contact: [email protected].
1.3. This notice concerns the processing of personal data of natural persons who visit the WeSocialLab marketing site at wesociallab.com, create and use an account in the WeSocialLab application, connect an X (Twitter) account to it, or contact the Company through its support channels (together, the "Data Subject").
2. Data Categories and Example Data Types
2.1. The personal data processed by the Company is shown below using the categories applied by the Personal Data Protection Authority.
| Data category | Example data types |
|---|---|
| Identity | Full name |
| Contact | Email address |
| Membership and account | User ID, password hash, language preference, email verification status, account creation and last sign-in dates, package and subscription period details |
| Connections and authorisation | Username, display name, X user ID and profile image link of connected X accounts; X OAuth access and refresh tokens stored encrypted |
| Customer transactions | Persona settings (topics, tone, bio, hashtags, banned words, posting hours, RSS sources, custom instructions), generated and published posts and images, scheduling, post engagement counts, credit movements |
| Finance | Package purchased, payment amount, currency and date, payment method, payment provider transaction reference (card numbers are not processed by the Company) |
| Transaction security | IP address, session details, sign-in and action logs, AI and X API usage logs, browser and device information, cookie records |
| Requests and complaints | Content of requests, complaints and refund applications sent through support channels, and related records |
3. Purposes of Processing and Legal Bases
3.1. Personal data is processed in line with the general principles in KVKK Article 4, for the purposes below and on the legal bases stated against each.
| Data categories processed | Purpose | Legal basis |
|---|---|---|
| Identity, contact, membership and account, transaction security | Creating the account, verifying the email address, managing the account and delivering account notifications | Formation and performance of a contract (KVKK Art. 5/2-c) |
| Connections and authorisation | Connecting the Data Subject's X account to the application and publishing posts on that account's behalf through the X API | Explicit consent (KVKK Art. 5/1); performance of a contract (KVKK Art. 5/2-c) |
| Customer transactions, connections and authorisation | Generating text and images with AI according to persona settings, presenting posts for approval, scheduling and publishing them, enforcing package limits | Performance of a contract (KVKK Art. 5/2-c) |
| Identity, contact, finance, customer transactions | Processing package purchases, activating subscription periods, sending payment receipts and keeping accounting records | Performance of a contract (KVKK Art. 5/2-c); legal obligation (KVKK Art. 5/2-ç) |
| Identity, contact, finance, customer transactions, requests and complaints | Answering support requests, evaluating and concluding refund applications | Performance of a contract (KVKK Art. 5/2-c); establishing, exercising or protecting a right (KVKK Art. 5/2-e) |
| Transaction security, customer transactions | Keeping the Service secure, preventing unauthorised access, spam and abuse, enforcing request limits, detecting errors | Legitimate interest (KVKK Art. 5/2-f); legal obligation (KVKK Art. 5/2-ç) |
| Customer transactions, transaction security (aggregated) | Monitoring Service performance and costs and improving the Service | Legitimate interest (KVKK Art. 5/2-f) |
| All categories | Responding to requests from competent authorities and meeting statutory retention and reporting obligations | Expressly provided for by law (KVKK Art. 5/2-a); legal obligation (KVKK Art. 5/2-ç) |
| All categories | Establishing, exercising and protecting the Company's rights in potential disputes | Establishing, exercising or protecting a right (KVKK Art. 5/2-e) |
4. Methods of Collecting Personal Data
4.1. Personal data is collected electronically, by fully or partly automated means, through sign-up and sign-in forms, email verification links, the X account connection (OAuth) flow, in-app persona, post and settings screens, transaction notifications returned from the payment providers' payment pages, account and post information received from the X API, email and support channels, and server and security logs.
4.2. Information about third parties that the Data Subject adds to persona settings, custom instructions or RSS sources is processed solely on the Data Subject's instruction and for the purpose of generating content. The Data Subject confirms they are entitled to share that information.
5. Recipients and Purposes of Transfers
5.1. Personal data is transferred under the conditions in KVKK Articles 8 and 9 and only for the purposes stated below.
| Data transferred | Purpose | Recipient group | Legal basis |
|---|---|---|---|
| All categories (tokens encrypted) | Hosting the Service, providing database, file storage and backup services | Hosting and infrastructure provider | Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Customer transactions (persona settings, source texts, generation instructions) | Generating post text and image descriptions with AI | Anthropic (Claude) | Performance of a contract (Art. 5/2-c) |
| Customer transactions (persona settings, source texts, image instructions) | Generating text and images through AI models | OpenRouter and the model providers it routes to | Performance of a contract (Art. 5/2-c) |
| Connections and authorisation, customer transactions (posts and images to publish) | Connecting the X account, publishing posts on the Data Subject's behalf and retrieving post statistics | X Corp. (X API) | Explicit consent (Art. 5/1); performance of a contract (Art. 5/2-c) |
| Contact (email address), notification content | Sending verification, password reset, payment receipt and subscription reminder emails | Resend (email delivery provider) | Performance of a contract (Art. 5/2-c) |
| Identity, contact, finance | Collecting card payments in Turkish lira, issuing refunds | iyzico (payment institution) | Performance of a contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| Contact, finance | Collecting cryptocurrency payments priced in US dollars | Plisio (cryptocurrency payment provider) | Performance of a contract (Art. 5/2-c) |
| Data within the scope of the request | Responding to lawful requests and meeting reporting obligations | Competent public authorities, courts | Expressly provided for by law (Art. 5/2-a); legal obligation (Art. 5/2-ç) |
6. Transfers Abroad
6.1. The Company, as data controller, is established in the United Kingdom, and almost all of the service providers listed above are established outside Türkiye (mainly in the United States and Europe) or process data on servers abroad. Personal data of Data Subjects in Türkiye is therefore transferred abroad.
6.2. These transfers are carried out under KVKK Article 9: on the basis of an adequacy decision for the relevant country, sector or international organisation, the standard contract published by the Personal Data Protection Board signed by the parties and notified to the Board, or another appropriate safeguard listed in Article 9; or, where none of these is available, under the exceptions in Article 9/6 (such as the transfer being necessary for the performance of a contract), provided the transfer is incidental.
6.3. The Company enters into an agreement containing data processing terms with every provider that receives data abroad, or accepts the data processing terms published by that provider, and makes the notifications required by law.
7. Retention Period
7.1. Personal data is kept for the period necessary for the purpose for which it is processed and for the minimum periods required by applicable law; at the end of those periods it is erased, destroyed or anonymised under KVKK Article 7 and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. Retention periods per data group are shown in the Privacy Policy.
8. Rights of the Data Subject
8.1. Under KVKK Article 11 the Data Subject may apply to the Company to exercise the following rights:
- To learn whether their personal data is processed,
- To request information if their personal data has been processed,
- To learn the purpose of processing and whether the data is used in line with that purpose,
- To know the third parties in Türkiye or abroad to whom their personal data is transferred,
- To request correction of personal data that is incomplete or inaccurately processed,
- To request erasure or destruction of personal data under the conditions in KVKK Article 7,
- To request that correction, erasure and destruction be notified to the third parties to whom the data was transferred,
- To object to a result against them produced by analysing the processed data exclusively through automated systems,
- To claim compensation for damage suffered as a result of unlawful processing of their personal data.
9. Application Methods
9.1. The Data Subject may submit requests concerning the rights above to the Company by the following methods, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- By emailing [email protected] from the email address registered in the Company's systems,
- In writing, with identity documents attached, to WE1TOWN LIMITED, 160 City Road, London, EC1V 2NX, United Kingdom (by a signed letter),
- By the other methods stated in the Communiqué (secure electronic signature, mobile signature or registered electronic mail address).
10. Handling of Applications
10.1. The application must include the applicant's full name; the Turkish ID number for Turkish citizens, or nationality and passport or ID number for foreign nationals; a residential or business address for service; an email address and phone number for notifications, if any; and the subject of the request.
10.2. The Company concludes the application free of charge as soon as possible according to its nature and within thirty days at the latest. Where the process involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
10.3. If the application is refused, the response is found insufficient or no response is given in time, the Data Subject may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the application date.
10.4. The Data Subject may delete an X account at any time from the Accounts page in the application; its access tokens, persona settings and posts are then deleted. The application's access to the X account can also be revoked from X's own account settings. Full deletion of the account can be requested by writing to [email protected]; when the account is deleted, account, persona, post and connection data are deleted, while finance records subject to statutory retention are kept for the relevant period.
11. Changes to This Notice
11.1. The Company may update this Privacy Notice to reflect changes in the law, decisions of the Personal Data Protection Board or developments in the Service (such as the use of a new service provider). The current text is published at wesociallab.com and takes effect on publication.