Privacy Policy
Last updated: 3 November 2026
This English version is a translation provided for convenience. For users in Türkiye, the Turkish version prevails in case of any conflict.
1. Parties and Scope
1.1. This Privacy Policy (the "Policy") applies to the wesociallab.com marketing site and the WeSocialLab application (together, the "Service") operated by WE1TOWN LIMITED (the "Company").
1.2. The Company is registered in the United Kingdom (England and Wales) under company number 13784988, with its address at 160 City Road, London, EC1V 2NX, United Kingdom. The Company is the data controller for personal data processed in the Service under Law No. 6698 on the Protection of Personal Data ("KVKK") and the UK General Data Protection Regulation ("UK GDPR").
1.3. Natural persons who visit or use the Service are referred to in this Policy as the "User". By using the Service, the User acknowledges having been informed that their personal data will be processed as described in this Policy.
1.4. The detailed notice required by KVKK Article 10, including data categories, legal bases, transfer tables and the application procedure, is set out on the KVKK Privacy Notice page. This Policy supplements that notice.
2. Definitions
- Service: the wesociallab.com marketing site and the WeSocialLab application.
- Account: the WeSocialLab account created by the User with an email address and password.
- X Account: a social media account that the User connects to the application by granting authorisation on X (Twitter).
- Persona: the content settings the User defines for each X Account, such as topics, tone, language, posting hours and sources.
- Content: post text and images generated by AI or written by the User.
- Package: the service package bought for a thirty (30) day period of use, which sets the number of X Accounts that can be connected and the usage limits.
- Processor: a service provider that processes personal data on behalf of and on the instructions of the Company.
3. Personal Data We Process
3.1. The Company processes the following personal data to the extent required by the nature of the Service. Which data is processed depends on the features the User uses.
| Data group | Examples |
|---|---|
| Account data | Full name, email address, password hash, language preference, email verification status, Package and subscription period details |
| X Account connection data | X user ID, username, display name, profile image link; OAuth access and refresh tokens stored encrypted with AES-256-GCM |
| Persona and content data | Persona settings, custom instructions, RSS sources and source text taken from them, generated and published posts and images, scheduling, post engagement counts received from X |
| Payment and transaction records | Package purchased, payment amount, currency, date, payment method, payment provider transaction reference (card numbers are not processed or stored by us; for cryptocurrency payments, wallet transactions are handled by Plisio) |
| Usage logs | Records of AI text and image generation and of publishing through the X API (provider, model, usage amount, date) |
| Support correspondence | Content of requests, complaints and correspondence the User sends through support channels |
| Security and action logs | IP address, session details, sign-in and action logs, audit logs, browser and device information |
| Cookies | Session, security and preference cookies described in the Cookie Policy |
4. Purposes of Processing
4.1. Personal data is processed for the following purposes and only to the extent needed for them:
- Creating the Account, verifying the email address, authenticating the User and managing the Account,
- Connecting X Accounts and publishing posts on those accounts on the User's instruction,
- Generating original text and images with AI according to Persona settings, presenting Content for approval and scheduling it,
- Processing Package purchases, activating subscription periods, sending payment receipts and end-of-period reminders, and meeting accounting obligations,
- Enforcing Package limits (number of X Accounts, daily posts and monthly image quota),
- Answering support requests and evaluating refund applications,
- Keeping the Service secure, preventing unauthorised access, spam and abuse, and detecting breaches of the Terms of Use,
- Monitoring Service performance and costs, fixing errors and improving the Service,
- Meeting legal obligations and responding to requests from competent authorities,
- Establishing, exercising and protecting the Company's rights.
5. Legal Bases
5.1. Personal data is processed on the legal bases in KVKK Article 5/2-c (directly related to the formation or performance of a contract), 5/2-ç (necessary for the controller to meet a legal obligation), 5/2-e (necessary to establish, exercise or protect a right) and 5/2-f (the controller's legitimate interest, provided it does not harm the data subject's fundamental rights and freedoms). Under the UK GDPR the corresponding legal bases are performance of a contract, legal obligation and legitimate interests.
5.2. An X Account is connected only with the authorisation the User grants on X and the User's explicit consent (KVKK Art. 5/1). The User can delete an X Account at any time from the Accounts page in the application or revoke the application's access in X's account settings.
5.3. The breakdown of legal bases by data category is set out in a table in the KVKK Privacy Notice.
6. Sharing of Personal Data
6.1. The Company does not sell personal data and does not share it with third parties for advertising.
6.2. Personal data is shared only as far as needed to provide the Service and, as a rule, with the following recipient groups acting as processors:
- Hosting and infrastructure provider (server, database, file storage and backup services),
- Anthropic (Claude), and OpenRouter and the model providers it routes to (only the Persona settings, instructions and source text needed to generate Content are sent; the User's email address and payment details are not),
- X Corp. (connecting X Accounts, publishing posts and images and retrieving post statistics through the X API),
- Resend (delivering verification, password reset, payment receipt and reminder emails),
- Payment providers iyzico (card payments in Turkish lira) and Plisio (cryptocurrency payments priced in US dollars),
- Competent public authorities and courts, where required by law.
7. International Transfers
7.1. The Company is established in the United Kingdom, and most of the service providers listed above have servers in the United States and Europe. Personal data of Users in Türkiye is transferred abroad under KVKK Article 9: on the basis of an adequacy decision, the standard contract published by the Personal Data Protection Board, another appropriate safeguard listed in Article 9, or the exceptions for incidental transfers.
7.2. For transfers outside the United Kingdom, the adequacy regulations under the UK GDPR or safeguards such as the International Data Transfer Agreement (IDTA) or standard contractual clauses with the UK Addendum apply.
7.3. The Company enters into a data processing agreement with, or accepts the data processing terms of, every provider that receives data and requires the provider to apply adequate technical and organisational measures.
8. Retention Periods
8.1. Personal data is kept for as long as the processing purpose requires and in any case within the limitation and retention periods required by applicable law.
| Data group | Retention period |
|---|---|
| Account data | While the Account is open; erased or anonymised within a reasonable technical period after the Account is deleted |
| X Account connection data and OAuth tokens | Until the X Account is deleted from the application or the Account is deleted |
| Persona and content data | Until the related X Account or the Account is deleted; posts published on X are subject to X's rules |
| Payment and transaction records | For the statutory retention periods under tax, commercial and accounting law (even if the Account is deleted) |
| Usage logs | While the Account is open; after deletion they may be kept in aggregated form, no longer linked to the person |
| Support correspondence | For the limitation period for potential disputes, from the conclusion of the request |
| Security and action logs | For as long as the security purpose requires and for the periods required by applicable law |
9. Data Security
9.1. Under KVKK Article 12 the Company takes technical and organisational measures to ensure an appropriate level of security, prevent unlawful processing of and access to personal data and safeguard it.
9.2. These measures include encrypting communications with TLS, storing passwords only as hashes, storing X access tokens and service provider keys encrypted, keeping only hashes of one-time links, limiting access rights by role, applying request limits and keeping audit logs.
9.3. Card details are never entered into the Company's systems; payment pages are provided by the payment provider and card data is processed only by iyzico. Cryptocurrency payments are made on Plisio's payment page; the Company has no access to wallet private keys.
10. Cookies and Similar Technologies
10.1. The Service uses essential and functional cookies to keep the session secure, complete the X Account connection securely and remember preferences such as language. No analytics or advertising cookies are used at present; if they are added, they will be used only with the permission the User gives in the cookie banner. The cookies used, their purposes and durations are described in the Cookie Policy.
11. Third-Party Services
11.1. When the User connects an X Account, X's own privacy policy, terms of service and developer policy also apply. The Company uses data obtained from the X API only to provide the Service to the User; it does not sell this data or use it for advertising.
11.2. Data sent to AI providers is subject to those providers' commercial API terms. The Company prefers to use these providers under terms stating that API data is not used to train models; the terms of model providers accessed through OpenRouter may vary.
11.3. The Company is not responsible for third-party sites linked from the Service.
12. Children's Privacy
12.1. The Service is not intended for persons under 18. If the Company finds that an Account belongs to a person under 18, it closes the Account and deletes the related data.
13. Your Rights
13.1. Under KVKK Article 11 the User has the right to learn whether their personal data is processed; to request information about it; to learn the purpose of processing and whether data is used accordingly; to know the third parties it is transferred to; to request correction of incomplete or inaccurate data; to request erasure or destruction; to request that these actions be notified to recipients; to object to a result against them produced solely by automated analysis; and to claim compensation for damage caused by unlawful processing.
13.2. Users covered by the UK GDPR also have the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests, and may complain to the UK Information Commissioner's Office (ICO).
13.3. The User may exercise these rights by emailing [email protected] from the email address registered to the Account, or by writing to 160 City Road, London, EC1V 2NX, United Kingdom with documents proving their identity. Applications are concluded within thirty days at the latest under the Communiqué on the Procedures and Principles of Application to the Data Controller.
13.4. The User may request deletion of the Account by writing to [email protected]; when the Account is deleted, X Account connections, Persona and content data are deleted, while payment records subject to statutory retention are kept for the relevant period. Posts already published on X are not removed from X when the Account is deleted; the User can delete them on X.
14. Changes to This Policy
14.1. The Company may update this Policy to reflect changes in the law or developments in the Service. The current text is published at wesociallab.com and takes effect on publication. Material changes are announced to Users by email to the address registered to the Account or by in-app notice.
15. Contact
15.1. For any question or request about privacy and personal data: [email protected]. For general support: [email protected]. Postal address: WE1TOWN LIMITED, 160 City Road, London, EC1V 2NX, United Kingdom.