Privacy Policy
Version 1.0 · Effective date: 2026-09-30
This policy explains how the PREVED platform (preved.heyvaql.com and the brand store domains hosted on PREVED) processes personal data under the Turkish Personal Data Protection Law No. 6698 (KVKK). PREVED is operated by HeyvAql. The Turkish version is the governing text; this English version is provided for convenience.
1. Data controller and contact
Data controller: HeyvAql.
Privacy and data requests: privacy@heyvaql.com
2. Whose data do we process?
- Shoppers: people who buy from a brand's store on PREVED.
- Creators: people who voluntarily connect their Instagram professional account (Business or Creator) to PREVED using “Connect with Instagram”.
3. Data we receive from Instagram
When you connect your Instagram account, Instagram (Meta) shows you the permissions you grant. We only access data you have authorized. We never see your Instagram password.
| Permission | Data we receive | What we use it for |
|---|---|---|
instagram_business_basic | Instagram account ID, username, account type, follower count, media count; list of your posts (link, type, date) | Connecting your account to PREVED, showing you your connected account, matching your posts to your sales links |
instagram_business_manage_insights | Account and post insights (views, reach, engagement) and aggregated audience demographics (age range, gender, city, country) | Building your performance reports; showing brands you work with only the aggregated summary you approve |
instagram_business_manage_comments | Comments on your posts (comment text and the commenter's Instagram username) | Letting you view and reply to comments in one place and surface product questions |
instagram_business_manage_messages | Instagram messages received by and sent from your account | Letting you view and reply to your messages in one place |
What we do not do: we do not collect follower or liker lists (Instagram does not provide them). We do not sell Instagram data, do not build advertising profiles, and do not automatically match people who comment or message with shopper accounts. We process Instagram Platform Data in accordance with the Meta Platform Terms and only for the purposes described here.
4. Data we collect from shoppers
- Phone number (account and verification code), full name and delivery address, order details.
- Consent record: version of the text you accepted, time, brand and IP address (as proof).
- Verification code: we store only a hash of the code, not the code itself; a code is valid for 5 minutes.
- Cookies: a session cookie (sign-in and checkout) and the
pv_vidvisit cookie.pv_vidis a random ID kept for 90 days to measure which source (ad, creator link, etc.) brought you to a store. IP address and browser details are not stored for this measurement.
5. Legal bases (KVKK Art. 5)
- Performance of a contract/service (Art. 5/2-c): connecting accounts, orders, delivery.
- Legal obligation (Art. 5/2-ç): keeping order and invoice records for the statutory periods.
- Legitimate interest (Art. 5/2-f): security, abuse prevention, source measurement.
- Explicit consent (Art. 5/1): asked separately where required and can be withdrawn at any time.
6. Retention
| Data | Retention |
|---|---|
| Instagram access token | While connected. Deleted immediately when you disconnect or remove PREVED's access from Instagram. |
| Instagram profile data and insights | While connected; deleted within 30 days after you disconnect. Deleted immediately on a deletion request. |
| Comment and message content | At most 90 days, then deleted or anonymized. |
| Shopper account and addresses | Until the account is deleted. |
| Order records | For the period required by law (up to 10 years for commercial/tax records). |
pv_vid visit cookie | 90 days. |
| Data deletion request record | A confirmation code and date are kept permanently as proof; your Instagram ID is not kept in plain form in this record. |
7. Who do we share data with?
- Brands: the brand you buy from sees your order and delivery details to fulfil the order. Brands see a creator's Instagram data only as an aggregated summary approved by the creator.
- Service providers: hosting, encrypted backups, verification code delivery (WhatsApp/Meta), and an AI service that may be used to suggest replies to comments/messages. They process data only on our behalf and instructions. Some providers may host data outside Türkiye; such transfers follow KVKK Art. 9.
- Competent public authorities where required by law.
We do not sell personal data.
8. Security
Instagram access tokens are stored encrypted in our database and are never displayed on any screen or written to logs. Token exchange with Instagram happens only on our server. Verification codes are stored as hashes. Backups are encrypted.
9. Your rights (KVKK Art. 11)
You may ask whether your data is processed, request information, learn the purpose and recipients, request correction or deletion, ask that recipients be notified, object to outcomes of automated analysis and claim compensation for damages. Contact privacy@heyvaql.com; we respond within 30 days.
10. How do I delete my data?
Step-by-step instructions: Data Deletion.
11. Changes
When we change this policy we update the version and date at the top of this page and ask for consent again where required.