Home
TürkçeSeoGeo

Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains how personal data is processed when you use the SeoGeo software service offered at seogeo.com.tr (the “Service”). It also serves as the information notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”). Türkçe sürüm.

1. Data controller

  • Data controller: Saliha Şenol Yurtsever – Kio Yazılım (sole proprietorship)
  • Address: Cumhuriyet Mah. 1951 Sok. No:4/4 Efeler / Aydın, Türkiye (Turkey)
  • Email: info@seogeo.com.tr
  • Tax office / no: Efeler / 8080316499

2. Data we process and why

2.1 Account and identity data

When you register we collect your first name, last name, email address and password. Passwords are never stored in plain text; only a one-way hash is kept. A session token (JWT) is stored in your browser. Purpose: creating your account, authenticating you, providing the Service and contacting you. If you invite team members, the invitee’s email address is also processed.

2.2 Website, content and SEO data

We process the URLs of websites you add, keywords, competitor domains, the articles and social media content you generate or edit, schedules and automation rules, reports, and the connection details you enter for WordPress or custom CMS integrations. CMS credentials and any AI provider API key you supply are stored encrypted (AES) in our database. Purpose: content generation, publishing, site audits and SEO analysis.

2.3 Instagram / Facebook (Meta) data

If you choose to connect your Instagram account through Meta (Facebook Login), the following data is processed via the Meta Graph API:

  • Your Instagram username and profile information, and the IDs of the connected Facebook Page and Instagram business account;
  • Access tokens issued by Meta — stored encrypted in our database;
  • Posts you schedule and publish through the Service (images, videos, captions) and their publishing results;
  • Instagram direct messages (DMs) and post comments received by your account and delivered to us via webhooks, including the sender’s Instagram user ID and username;
  • Customer relationship (CRM) records derived from those interactions: contact, tags, lead status, first/last interaction dates; replies you send from the panel, the auto-reply rules you define and the automatic replies sent under them.

Permissions requested: instagram_basic, instagram_content_publish, instagram_manage_messages, instagram_manage_comments, pages_show_list, pages_read_engagement, pages_manage_metadata, pages_messaging, business_management. Purpose: solely to provide the features you enable (publishing, inbox, replying to comments/messages, CRM).

2.4 Google Search Console and Google Analytics data

If you connect your Google account via OAuth, we request read-only scopes only (webmasters.readonly, analytics.readonly). We read your site’s search performance (queries, pages, clicks, impressions, positions) and traffic metrics; Google access/refresh tokens are stored in an access-restricted database. Purpose: reporting in your panel and content and keyword recommendations.

2.5 Payment and subscription data

We process your subscription plan, credit balance, payment references and the information needed for invoicing. SeoGeo does not collect or store card details; payments are completed on the secure page of a licensed payment service provider. Purpose: performance of the contract, invoicing and legal obligations.

2.6 QR code scan logs

When a trackable QR code you created with the Service is scanned, the scanner’s IP address, browser/device information, approximate location (country/city) and referrer are logged. Purpose: providing you with scan statistics.

2.7 Cookies and analytics

We use strictly necessary browser storage to keep you signed in and remember your preferences (language, cookie choice). Google Analytics 4 (GA4) is loaded only if you click “Accept” in the cookie banner; if you decline, no analytics cookies are set. You can change your decision by clearing your browser’s site data.

2.8 Communications and logs

Your email address is used for notifications and scheduled report emails. Server logs (IP address, request time) and AI usage logs are kept for security, debugging and abuse prevention.

3. Legal bases (KVKK Article 5)

  • Formation and performance of a contract (Art. 5/2-c): account, content, integration, payment and subscription data.
  • Compliance with legal obligations (Art. 5/2-ç): invoicing, tax and Law No. 5651 records.
  • Establishment, exercise or defence of a right (Art. 5/2-e): dispute and security records.
  • Legitimate interest (Art. 5/2-f): service security, debugging, abuse prevention.
  • Explicit consent (Art. 5/1): analytics cookies and transfers of personal data abroad (see section 5).

4. Service providers (processors)

We do not sell your personal data. Data is shared only to the extent necessary to provide the Service with the following providers acting as processors:

  • Google Cloud (Cloud Run, europe-west1 – Belgium): application hosting.
  • Neon (PostgreSQL, AWS eu-central-1 – Frankfurt, Germany): database hosting.
  • Cloudinary: storage and delivery of images and videos.
  • Meta Platforms (Facebook/Instagram Graph API): Instagram connection, publishing, messages and comments.
  • Google (Search Console, Analytics Data, PageSpeed Insights, OAuth, Google Analytics 4): reporting and site measurement.
  • AI providers — OpenAI, Anthropic, OpenRouter, Google (Vertex AI / Gemini): content and text generation; the topics, keywords, site and content information you submit for generation are sent to these providers.
  • Image/video generation — fal.ai, Replicate, Pollinations: generating images and videos for content (prompts are sent).
  • DataForSEO: keyword, SERP and competitor data (keywords and domains are sent).
  • Email (SMTP) provider: sending notification and report emails.
  • Payment service provider: processing payments.
  • Competent public authorities: where required by law.

5. International transfers (KVKK Article 9)

The servers of the providers above are located outside Türkiye, in the European Union (Belgium, Germany) and the United States. Your data is therefore transferred abroad. Such transfers are made under KVKK Article 9 on the basis of standard contractual clauses announced by the Turkish Personal Data Protection Board where applicable, and otherwise on the basis of the explicit consent you give when using the Service and enabling the relevant integration. Withdrawing consent may mean the related features can no longer be provided.

6. Meta Platform data

  • Data received from Meta is never sold, rented, or shared with ad networks or data brokers.
  • It is used only to provide the features you have enabled, and is not used for profiling or to train AI models.
  • Access tokens are stored encrypted and used only to act on your behalf.
  • You can disconnect at any time from the Social Media section of your panel, and revoke SeoGeo’s access on Facebook under Settings & privacy → Settings → Business Integrations.
  • To have your data deleted, follow the steps on our Data Deletion Instructions page.

7. Google user data — Limited Use

SeoGeo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to show you reports and recommendations in your panel; it is not used for advertising, not sold, not used to train AI models, and not read by humans except with your explicit permission, for security purposes or to comply with applicable law. You can revoke access at Google Account permissions.

8. Retention

  • Account, website and content data: while your account is active; deleted within 30 days after account deletion.
  • Instagram/Meta and Google data and access tokens: while the connection is active. When you disconnect, the account is deactivated and no further actions are taken on your behalf; this data and the tokens are deleted within 30 days of your deletion request.
  • Invoices and accounting records: 10 years, as required by Turkish tax and commercial law.
  • Server and security logs: for the period required by law (up to 2 years under Law No. 5651).

9. Security

Data is transmitted over TLS-encrypted connections. Passwords are stored as hashes; Instagram/Meta access tokens, CMS credentials and API keys are encrypted with AES. Data is segregated per tenant (account) and accessible only to authorised persons.

10. Your rights (KVKK Article 11)

You have the right to:

  • learn whether your personal data is processed,
  • request information about such processing,
  • learn the purpose of processing and whether data is used accordingly,
  • know the third parties in Türkiye or abroad to whom data is transferred,
  • request rectification of incomplete or inaccurate data,
  • request erasure or destruction of data under the conditions of KVKK Article 7,
  • request that rectification and erasure be notified to third parties to whom data was transferred,
  • object to an outcome against you arising exclusively from automated analysis,
  • claim compensation for damages arising from unlawful processing.

11. How to apply

Send your request from the email address registered to your account to info@seogeo.com.tr, or in writing to the address above. Requests are answered free of charge within 30 days at the latest. If your request is rejected or you find the answer insufficient, you may lodge a complaint with the Turkish Personal Data Protection Board (KVKK).

12. Changes

We may update this policy. Material changes will be published on this site and, where appropriate, notified by email. The current version is always on this page. See also our Terms of Service.