/
Log in

At AdsLuma (ADSERA Bilişim ve Yazılım Hizmetleri Limited Şirketi), we take our users' privacy extremely seriously. This Privacy Policy explains what data is collected when you use the AdsLuma platform, how it is stored, who it is shared with, and what rights you have.

1. Data We Collect

When you use AdsLuma, we collect data in the following categories:

  • Account information: First and last name, email address, phone number, company name, password (stored hashed).
  • Platform integration data: Campaign, performance and analytics data retrieved from your Google Ads, Meta Marketing, Google Analytics 4, Search Console and Google Merchant Center accounts; content, engagement and message data from the Facebook Pages and Instagram accounts you connect.
  • Usage data: In-platform activity such as navigation, clicks, report generation and AI queries.
  • Technical data: IP address, browser type, device information, session identifiers (via cookies).
  • Content data: Your brand brief, content drafts, AI chat history, and images you upload.

2. How We Use Your Data

  • To provide the platform's core services (dashboard, analytics, AI Copilot, content generation),
  • To manage your user account and secure your sessions,
  • To calculate and visualise your performance metrics,
  • To generate AI-based recommendations, insights and content (your data is not used for model training),
  • To improve service quality and detect errors,
  • To meet our legal obligations (KVKK, GDPR, tax legislation, etc.).

3. Data Sharing

We never sell your data. Your data is shared with third parties only in the following cases:

  • AI providers: Anthropic (Claude), Google (Gemini), FAL (image generation) — only the context specific to that query; no model training is performed.
  • Payment provider: Stripe (subscription information only).
  • Infrastructure providers: Cloudflare (CDN/DNS), Cloudflare R2 (file storage), hosting provider.
  • External AI clients you connect (MCP):If you enable the AdsLuma connector in an external AI client such as ChatGPT or Claude, the data returned by the queries you make is transmitted to that client's provider and is then subject to that provider's own privacy policy. This connection is off by default, is enabled per workspace and per member, is read-only (no campaign or setting is changed), and can be revoked at any time from Settings.
  • Legal obligation: Where required by a court order or a request from a competent authority.

4. Google API Services User Data Policy

AdsLuma integrates with Google services (Google Analytics 4, Google Search Console and Google Ads) through Google's official APIs. This section explains how we handle data obtained from Google APIs.

What we access. When you connect your Google account to AdsLuma, we request the following permissions, each only with your explicit OAuth consent:

  • Google Analytics (analytics.readonly): read-only access to the Google Analytics 4 properties you select, in order to retrieve reporting and performance data.
  • Google Search Console (webmasters.readonly): read-only access to the verified sites you select, in order to retrieve search performance data (queries, clicks, impressions, positions).
  • Google Ads (adwords): access to the Google Ads accounts you select, used solely to retrieve campaign structure, ad spend, performance and conversion metrics for the accounts you connect.
  • Google Merchant Center: access to account information, product listings, product feed status and disapproved product records.

How we use it.Data obtained from Google APIs is used exclusively to provide AdsLuma's core features to you: displaying your dashboards, producing reports, detecting errors, and generating AI-powered insights about your own accounts. Our Google integrations are read-only; they do not create, edit or delete any campaigns, product data or account settings. We do not use Google user data for advertising or ad targeting, we do not sell it, and we do not use it to build profiles unrelated to the service you requested.

Limited Use disclosure.AdsLuma's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We do not use this data for serving advertisements,
  • We do not sell or transfer this data to third parties,
  • We do not allow humans to read this data, except with the user's explicit consent, for security purposes, to comply with applicable law, or as part of aggregated and anonymised internal operations,
  • We delete the relevant data when a user disconnects their account.

AI processing.When you use AdsLuma's AI-powered features, relevant portions of your Google user data may be processed by our AI service providers on a strictly per-request basis, solely to produce the analysis or insight you requested. Google user data is not used to train AI models, either ours or our providers'. Humans do not access this data except with your explicit consent, for security purposes, to comply with applicable law, or as part of aggregated and anonymised internal operations.

Storage and security. OAuth tokens received from Google are stored encrypted (AES-256-GCM) and are never logged in plain text. All Google user data is stored in tenant-isolated form and retained only for as long as your integration remains connected.

Revoking access and deletion.You may disconnect your Google account from AdsLuma at any time from your integration settings, or revoke AdsLuma's access directly from your Google Account permissions page at myaccount.google.com/permissions. Upon disconnection or account deletion, the associated Google user data is deleted from our systems within 30 days, except where retention is required by law.

5. Advertising Data from Meta Platforms

AdsLuma integrates with Meta's advertising services (Facebook and Instagram) through Meta's official Marketing API. This section explains how we handle advertising data obtained from Meta Platforms. For the additional permissions requested when you use our Page and Instagram management features, and their scope, see Section 6.

What we access. When you connect your Meta ad accounts to AdsLuma, we request access permissions (for example ads_read) only with the explicit authorization you grant through Meta's login and consent flow. We access advertising data for the ad accounts you select — including campaign structure, performance metrics, spend, and audience-level aggregated statistics. This section covers advertising data only; we do not access data belonging to accounts you have not connected.

How we use it.Advertising data obtained from Meta Platforms is used exclusively to provide AdsLuma's core features to you: displaying your dashboards, producing reports, and generating AI-powered insights about your own ad accounts. We do not sell Meta platform data, we do not share it with third parties for their own purposes, and we do not use it for advertising or ad targeting outside the service you requested.

AI processing.When you use AdsLuma's AI-powered features, relevant portions of your Meta advertising data may be processed by our AI service providers on a strictly per-request basis, solely to produce the analysis or insight you requested. Meta platform data is not used to train AI models, either ours or our providers'.

Storage and security. Access tokens received from Meta are stored encrypted (AES-256-GCM) and are never logged in plain text. All Meta platform data is stored in tenant-isolated form and retained only for as long as your integration remains connected.

Platform Terms compliance.AdsLuma's use and transfer of information received from Meta APIs will adhere to the Meta Platform Terms and applicable Meta Developer Policies.

Revoking access and deletion.You may disconnect your Meta account from AdsLuma at any time from your integration settings, or remove AdsLuma's access directly from your Facebook account settings under Business Integrations. Upon disconnection or account deletion, the associated Meta platform data is deleted from our systems within 30 days, except where retention is required by law. You may also request deletion of your data at the address in the Contact section; deletion requests are honored within 30 days.

6. Data from Facebook Pages and Instagram Accounts

In addition to the advertising data described above, AdsLuma may request additional permissions from Meta to provide Page and Instagram management features. This section explains what these permissions allow us to access and how we use that data.

What we access.With your explicit authorization through Meta's login and consent flow, we may request the following permissions:

  • pages_show_list — to display the list of Facebook Pages you manage, so you can select which Page(s) to connect.
  • pages_read_engagement — to read content and engagement data (posts, comments, reactions) on the Pages you connect, in order to display performance metrics.
  • business_management — to access and manage assets (Pages, ad accounts, Instagram accounts) associated with the Meta Business Manager account you connect.
  • instagram_basic — to read basic profile information and media from the Instagram professional accounts you connect.
  • instagram_manage_comments — to read, reply to, and moderate comments on your Instagram posts on your behalf.
  • instagram_content_publish — to publish photos, videos, and other content to your connected Instagram account when you use our publishing/scheduling feature.
  • instagram_manage_messages — to access, read, and respond to Instagram Direct messages on your behalf when you use our inbox feature.

We request each permission only at the point you use the corresponding feature, and only for the Pages and Instagram accounts you explicitly select and connect. We do not access Pages or Instagram accounts you have not connected.

How we use it.Data obtained through these permissions is used exclusively to provide AdsLuma's core features to you — displaying and managing your connected Pages and Instagram accounts, showing engagement and performance data, publishing content you create, and enabling you to manage comments and Direct messages from within our platform. We do not use this data for advertising or ad targeting outside the service you requested, and we do not sell or share it with third parties for their own purposes.

Messaging data.Where you use our Instagram Direct messaging feature, message content is used solely to display your conversations and to send replies you compose or explicitly trigger. Our handling of this data complies with Meta's Platform Terms, Developer Policies, and the Instagram Platform Policy governing messaging, including applicable restrictions on response windows and message content.

Storage and security. Access tokens and any content, messages, or engagement data obtained through these permissions are stored encrypted (AES-256-GCM) and are never logged in plain text. Data is stored in tenant-isolated form and retained only for as long as your integration remains connected.

Platform Terms compliance.AdsLuma's use and transfer of information received via these Meta permissions will adhere to the Meta Platform Terms and applicable Meta Developer Policies.

Revoking access and deletion.You may disconnect your connected Pages and Instagram accounts at any time from your integration settings, or remove AdsLuma's access directly through your Facebook or Instagram account settings under Business Integrations. Upon disconnection or account deletion, associated data obtained via these permissions is deleted from our systems within 30 days, except where retention is required by law. To request deletion of your data, you may also contact us at the address in the Contact section; deletion requests are honored within 30 days.

7. Cookies

AdsLuma uses only strictly necessary and functional cookies:

  • Session cookie (adsluma_session) — to keep you signed in after login.
  • CSRF token — for form security.
  • Preference cookies — your preferences such as language, date range and saved views.

We do not use marketing or third-party advertising cookies.

8. Data Retention Periods

  • Account data: For as long as the account is active + 90 days (following a deletion request).
  • Platform integration data: For as long as your account remains connected; deleted within 30 days once the account is removed.
  • Page/Instagram content, engagement and message data: For as long as the integration remains connected; deleted within 30 days after disconnection.
  • AI chat history: Until you delete it (automatically archived after 12 months by default).
  • Audit logs: 6 months (records subject to legal requirements are kept longer).

9. Our Security Measures

  • All traffic is encrypted over HTTPS (TLS 1.3).
  • Passwords are hashed with bcrypt and never stored in plain text.
  • Platform OAuth tokens are held in the database encrypted with AES-256-GCM.
  • Multi-tenant isolation: every query is scoped to the user's tenant (no cross-tenant access).
  • AI responses are scanned by a post-filter against cross-tenant data leakage.
  • Regular security audits (OWASP Top 10 + LLM Top 10).

10. Your Rights (KVKK Article 11)

You may exercise the following rights regarding your personal data at any time:

  • Access your data and obtain a copy of it,
  • Request correction of inaccurate or incomplete data,
  • Request erasure or destruction of your data (account closure),
  • Object to the processing of your data,
  • Request restriction of processing,
  • Request transfer of your data to another service provider (portability).

To exercise these rights, contact [email protected]. Your request will be answered within 30 days at the latest.

11. Children's Privacy

AdsLuma is not a service directed at persons under the age of 18. We do not knowingly collect personal data from individuals under 18.

12. Policy Updates

This Privacy Policy may be updated from time to time. Material changes are announced by email or via an in-platform notification. The date of the last update is shown above.

13. Contact

For any questions or requests regarding privacy:

  • Email: [email protected]
  • Address: Maslak Mah. AOS 55. Sk. 42 Maslak B Blok No:4 İç Kapı No: 542 Sarıyer / İstanbul, Türkiye
  • Phone: +90 850 304 37 10

For the detailed KVKK disclosure text, please visit our KVKK page.