Privacy Policy

Data we collect

• Account data: name, email address, a hash of your password (never the password itself), language and theme preferences.
• Workspace content: post text, images and videos, calendar, reports, brand memory (brand description, products, contact details), team and client memberships.
• Connected accounts: for your social accounts (Instagram, Facebook, LinkedIn, TikTok, YouTube, Pinterest, Threads, X) and Canva, the access tokens issued by that platform, plus the account name and id.
• Platform data: follower, reach, impression and engagement statistics of connected accounts; incoming comments and messages.
• Usage and technical data: session cookies, IP address, browser details and error logs.

Why we use it

• To provide the Service: prepare, schedule and publish your posts on your behalf; show statistics and the inbox; create reports.
• AI features: when you ask, we send your brand memory and topic to our AI provider to generate captions, titles and hashtags.
• Security: protect your account, prevent abuse, fix errors.
• Communication: send essential service notices (for example when an account disconnects).

Who we share it with

We do not sell your data. We share it only as needed to run the Service with:

• The social platforms you connect: the content you choose to publish and what the action requires.
• Canva: once connected, to list and export your designs and to open new designs.
• Our AI provider (Google Gemini): topic and brand memory when you use “write with AI”.
• Infrastructure providers: hosting, database and email.
• Authorities, where the law requires it.

Canva integration

• When you connect Canva we request only: reading your profile name, listing your designs, exporting a design you pick as an image or video, and creating a new blank design when you ask.
• We only fetch exports of designs you select and store them in your workspace media. We never modify or delete your designs in Canva.
• Your Canva tokens are received over an encrypted connection and used only for these actions.
• You can remove the connection at any time with “Disconnect” on the Accounts page, which deletes the tokens; you can also revoke access in your Canva account settings.

YouTube integration (YouTube API Services)

• IZY Social uses YouTube API Services to publish videos to your YouTube channel. By connecting YouTube you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). How Google handles your data is described in the Google Privacy Policy (https://policies.google.com/privacy).
• We request only: uploading videos you choose to your channel (youtube.upload), and reading your channel name and id plus the view, like and comment counts of videos we uploaded and your channel's YouTube Analytics reports (watch time, subscriber changes, traffic source, country, device, age and gender split) (youtube.readonly).
• YouTube data we store: channel name, channel id, profile picture link, the refresh token issued by Google, and the ids and statistics of videos we uploaded. We re-read statistics from YouTube at least every 30 days and delete data we can no longer refresh.
• Use: we use YouTube data only to upload the videos you choose to your channel and to show those videos' results in your panel and reports.
• Sharing: we never sell your YouTube data, use it for advertising or use it to train AI models. We share it with no one except the infrastructure providers needed to run the Service (server hosting), and only as much as the law requires when we are legally obliged to.
• Protection: the refresh token issued by Google is stored encrypted with AES-256-GCM in our database, and all traffic between your browser and our servers is encrypted with HTTPS (TLS). Only authorised people can access the server and database, and the encryption key is kept separately from the database. Panel account passwords are stored hashed.
• IZY Social's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
• You can remove the connection with “Disconnect” on the Accounts page, which deletes the refresh token immediately. You can also revoke access in your Google account security settings: https://myaccount.google.com/permissions. When you disconnect or revoke access, we delete the stored YouTube data for that channel within 30 days.

Pinterest integration

• IZY Social uses the Pinterest API to add Pins to your Pinterest account. When you connect Pinterest, the Pinterest Terms of Service (https://policy.pinterest.com/en/terms-of-service) and Privacy Policy (https://policy.pinterest.com/en/privacy-policy) also apply.
• Pinterest data we store: username, account id, profile picture link, the refresh token issued by Pinterest, and the ids and impression/save statistics of Pins we create. Pins are added to the “IZY Social” board in your account, which we create if it doesn't exist.
• We never sell your Pinterest data, use it for advertising, or share it with third parties except as needed to provide the Service.
• You can remove the connection with “Disconnect” on the Accounts page, which deletes the refresh token immediately. You can also revoke access on Pinterest under Settings > Security > Apps. We delete the stored Pinterest data for that account within 30 days.

LinkedIn integration

• When you connect LinkedIn we only ask to see your name, profile photo and LinkedIn id, and to share posts on your personal profile on your behalf. The LinkedIn User Agreement and Privacy Policy (https://www.linkedin.com/legal/privacy-policy) also apply.
• LinkedIn data we store: your name, profile picture link, LinkedIn id, the access token issued by LinkedIn (encrypted) and the ids of posts we publish. We never sell your LinkedIn data or use it for advertising.
• You can remove the connection with “Disconnect” on the Accounts page, which deletes the access token immediately. You can also revoke access on LinkedIn under Settings > Data privacy > Permitted services.

TikTok integration

• When you connect TikTok we only ask to see your basic profile (username, display name, profile photo) and to post the videos and photos you choose to your account. The TikTok Terms of Service and Privacy Policy (https://www.tiktok.com/legal/privacy-policy) also apply.
• TikTok data we store: your username, profile picture link, TikTok id (open_id), the refresh token issued by TikTok (encrypted) and the ids of posts we publish. We never sell your TikTok data or use it for advertising.
• You can remove the connection with “Disconnect” on the Accounts page, which deletes the token immediately. You can also revoke access in the TikTok app under Settings > Security > Manage app permissions.

Meta (Facebook and Instagram) integration

• When you connect your Facebook Page and its linked Instagram professional account, we request permission only to list your Pages, publish posts on your behalf, and read the like, comment and share counts of posts we published.
• You can disconnect on the Accounts page or remove the app in your Facebook and Instagram settings. Details are on the Data Deletion Instructions page: https://www.izysocial.com/data-deletion

Retention

We keep your data while your account is open. When you disconnect an account we delete its tokens. When you close your account we delete your data within a reasonable period, subject to legal retention duties.

Your rights

You can access your data, ask for it to be corrected or deleted, object to processing and receive it in a portable format, under Turkey's Personal Data Protection Law No. 6698 and other data protection laws that apply to you. Send requests to info@izysocial.com.

Security

We use technical and organisational measures such as encrypted connections (HTTPS), password hashing and access controls. No system is risk-free; if we detect a breach we will notify as the law requires.

Cookies

We use essential cookies to keep you signed in and remember preferences (language, theme). We do not use advertising or tracking cookies.

We measure visits to our public pages with Umami running on our own server, without cookies and without identifying anyone; IP addresses are not stored and the data is not shared with third parties.

Changes and contact

We may update this policy and will announce material changes in the Service or by email. UDS E-Ticaret İthalat ve İhracat Limited Şirketi, Hıdırlık Mah. 61/1 Sk. No: 9 İç Kapı No: 6, Seferihisar, İzmir, Türkiye · info@izysocial.com