Privacy Policy & Data Protection Notice

Acting as data controller under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"): E²S Studio (Sole Proprietorship · Davutpaşa Tax Office · Tax ID: 7960782593), Istanbul, Türkiye. Contact: info@e2sstudio.com

This notice covers three groups at once: visitors to e2sstudio.com, clients using our social media management service, and third parties whose data is processed during that service (people who comment on or message our clients’ accounts).

E²S Studio designs and builds digital products. We also offer clients a social media management service: with the client’s explicit authorisation we prepare and publish content for their business accounts and draft replies to incoming comments and messages.

No content, post or reply is ever published or sent without human approval. Nothing is published automatically.

• Site visitors: the name, email address and message you submit through the contact form.
• Client representatives: name, business name, email address, contact details and billing information.
• Connected social media accounts: account identifier, page or profile name, and access tokens issued by the platform.
• Third parties: comments on and messages sent to our client’s account, including the username, content and timestamp.
• Commercial contact lists: business email address, business name and consent status in the Turkish Message Management System (İYS).
• Technical records: error and operation logs relating to how the service runs.

We never collect special categories of personal data (health, religion, biometric data, etc.). Personal data is not written to application logs.

• Receiving and answering contact requests.
• Entering into and performing the service agreement.
• Producing content on a client’s behalf, submitting it for approval and publishing it once approved.
• Preparing human-approved replies to incoming comments and messages.
• Sending commercial electronic messages only to recipients with explicit consent and İYS approval.
• Maintaining service security and fixing errors.
• Complying with legal obligations.

• Performance of a contract (Art. 5/2-c): client and representative data, account authorisations.
• Legitimate interest (Art. 5/2-f): service security, error logging, abuse prevention.
• Legal obligation (Art. 5/2-ç): retention duties arising from tax and commercial legislation.
• Explicit consent (Art. 5/1 and Art. 9): sending commercial electronic messages and transfers abroad.

We use Meta’s official APIs to manage our clients’ Instagram and Facebook business accounts. Access begins only with the account owner’s explicit authorisation and is used solely to serve that client.

• We request only the permissions the service requires: basic business account information, content publishing, and viewing and replying to comments and messages.
• We do not sell, rent or transfer Meta-sourced data to third parties for marketing purposes.
• We do not use Meta-sourced data for ad targeting, profiling, or eligibility decisions such as credit or insurance.
• Access tokens are stored encrypted and are never held in plaintext in the application database.
• When authorisation is withdrawn, the related access tokens are deleted and our access to the account ends.

Meta’s own privacy policy governs Meta’s data processing practices.

We use a limited number of service providers to deliver the service. Your data is shared with them only to the extent the service requires:

• Meta Platforms — social media publishing and messaging.
• Resend — email delivery.
• Anthropic — content draft generation. Drafts are always submitted for human approval.
• Railway — application hosting.
• Vercel — website hosting.

Some of these providers are located outside Türkiye. Transfers abroad are made under Article 9 of the KVKK, based on your explicit consent or another condition provided by law.

• Contact form messages: 2 years from resolution of the request.
• Client and contract data: for the duration of the relationship and 10 years thereafter (Turkish Commercial Code Art. 82).
• Access tokens: until authorisation is withdrawn, then deleted immediately.
• Comment and message records: for the duration of the relationship and at most 1 year.
• Commercial messaging consent records: 3 years from the date consent ceases to be valid.

Once a period expires, personal data is deleted, destroyed or anonymised.

• Access tokens are stored encrypted with AES-256-GCM.
• Access to production systems is authenticated and limited by the principle of least privilege.
• Personal data and secrets are never written to application logs.
• Only the minimum data the service requires is collected.

In relation to your personal data you have the right to:

• Learn whether your personal data is being processed.
• Request information about such processing.
• Learn the purpose of processing and whether the data is used accordingly.
• Know the third parties to whom the data is transferred, in Türkiye or abroad.
• Request correction if the data is incomplete or inaccurate.
• Request erasure or destruction of the data.
• Request that such actions be notified to third parties to whom the data was transferred.
• Object to an adverse outcome produced solely by automated analysis.
• Claim compensation for damage caused by unlawful processing.

To exercise your rights, write to info@e2sstudio.com with the subject line "KVKK Request". Your request must clearly state your name, contact details and the subject of your request.

Requests are resolved free of charge within 30 days at the latest, depending on their nature. Detailed instructions for erasure requests are on the Data Deletion Request page.

e2sstudio.com uses only cookies strictly necessary for the site to work — for example the cookie that remembers your language preference. No advertising, tracking or analytics cookies are used.

This notice may be updated. The effective date is shown at the top of the page; we notify clients by email of any material change.