Merkuva

Version 1

Privacy Policy

Last updated: 18 September 2026 · Version: 1

This policy explains how — ("Merkuva") collects, uses and protects personal data on the https://merkuva.com website and the https://app.merkuva.com platform. The Turkish version of this policy is the binding one; this translation is provided for convenience.

1. Whose data we process

  • Visitors of our website.
  • Members and team members who sign up to the platform and work in organizations.
  • End users who message our members through channels such as Instagram and WhatsApp. For this data the member is the data controller; we process it only on the member's instructions and to provide the service.

2. Data we collect

  • Account data: name, email, password (stored irreversibly hashed), language and theme preferences.
  • Organization data: business name, billing details, subscription and order records.
  • Usage and security logs: IP address, browser information, session and activity logs.
  • Connected channel data: profile information, messages, comments and interactions of the Instagram, Facebook and WhatsApp accounts the member authorizes.
  • Cookies as described in our Cookie Policy.

3. How we use Meta platform data

Data obtained through Instagram, Facebook and WhatsApp (profiles, messages, comments, interactions) is used only to provide the automation, inbox and reporting features requested by the member. This data:

  • is never sold, rented or used for ad targeting;
  • is not shared with third parties beyond what is needed to provide the service;
  • is deleted when the member disconnects the channel or closes the account, as described in our Data Deletion Instructions.

4. AI services

When a member uses an AI step in an automation, the relevant conversation content is sent to an AI service provider to generate a reply. Our agreements with these providers do not allow them to use this data to train their own models.

5. Sharing

We share data only with service providers necessary to run the service: hosting and content delivery, email delivery, payment institutions, AI providers and the channel provider Meta. Data may be disclosed to authorities where required by law. International transfers are made with safeguards compliant with Article 9 of the Turkish Personal Data Protection Law (KVKK).

6. Retention

Data is kept while the account is open and afterwards for legally required periods. When an account is closed, data is deleted or anonymized within 30 days; records that must be kept by law (invoices, traffic logs) are retained with restricted access until those periods expire.

7. Security

Data is encrypted in transit with TLS; sensitive items such as access tokens are additionally encrypted in the database. Access is limited by role-based permissions, activity is logged and two-step verification is supported.

8. Children

The platform is not intended for anyone under 18 and we do not knowingly collect their data.

9. Your rights and contact

To exercise your rights under Article 11 of KVKK, request deletion or ask a question, write to [email protected].

— · —