Privacy Policy

1. Who we are

Vitrin Ustası is a product of DocPlant Doküman ve Yazılım Hizmetleri Ltd. Şti. (“DocPlant”, “we”). DocPlant is the data controller for your personal data. This policy covers the Vitrin Ustası application and the vitrinustasi.com website. The legal details are in the KVKK Privacy Notice.

2. The information we collect

• Your email address and your name, if you give it — to open your account, send you your sign-in code and get in touch with you.
• Your shop profile — shop name, type, city, brand colours and your logo; to prepare images and descriptions that suit your shop.
• Your photos and instructions — the product photos you send, the instructions you write, the images we prepare, the descriptions and the tags.
• Instagram connection — the ID, username and access token of your Instagram business account; so that we can publish the post you approve on your account. We also store the link to the published post.
• Team information — the email addresses and roles of the staff you invite to your shop.
• Subscription and billing information — your plan, the number of posts you use, and the title, address and tax details needed for invoicing. We do not see or store your card details; the payment provider processes the payment.
• Technical logs — sign-in times, IP address, device and app version, error logs; to protect your account and fix problems.

We do not ask for your national ID number, your location or your contacts. We do not collect sensitive (special category) personal data; please make sure your photos do not contain information of that kind.

3. Why we collect it

• To provide the service: preparing images, writing descriptions and tags, and publishing the post you approve (performance of the contract).
• To manage your account, your team and your subscription, to invoice you and to support you (performance of the contract, legal obligation).
• To protect your account and our systems against misuse, to find errors and to improve the service (legitimate interest).
• To meet our legal obligations and protect our rights (legal obligation, establishment and protection of a right).

We do not use your photos for advertising, we do not sell them and we do not use them for any other work. We send you marketing emails only if you give your permission.

4. Artificial intelligence and your photos

Artificial intelligence models prepare the images, the descriptions and the checks. These models run on DocPlant’s own servers in Türkiye; your photo is not sent to a foreign artificial intelligence company for this work. We do not use your photos to train artificial intelligence models. Artificial intelligence does not make a decision about you that affects you: you always decide what gets published.

5. Where we store it

Your account information, your photos and the prepared images are stored with redundancy on servers in data centres in Türkiye (Dehost and Verisunucu) that only we manage. This website and our support mailboxes, on the other hand, are hosted on hosting.com infrastructure in Germany.

6. How long we keep it

• The original photos you send and the intermediate files: deleted automatically after 30 days.
• Approved images, descriptions and post history: for as long as your account is open.
• Sign-in codes: valid for 10 minutes, and invalid once used.
• Technical and security logs: 2 years.
• When you delete your account: your data is deleted within 30 days, including backups. Invoice and accounting records are kept for the statutory period (10 years).

7. Who we share it with

We do not sell your data. We share it only when it is necessary for the service, and only as much as is needed:

• Instagram (Meta) — only when you approve a post: the image and description you chose are published on your account. Meta’s servers are abroad; this transfer is made at your request and for the performance of the service.
• Email delivery service (SMTP2GO) — to deliver your sign-in code and invitations to your email address.
• Payment — the payment provider iyzico for payments over the web; the Apple App Store or Google Play for in-app purchases.
• Hosting and accounting — our data centres, our website host and our accountant, only to the extent needed for their own work and under a duty of confidentiality.
• Official authorities — only where the law requires it.

Transfers abroad are made in accordance with Article 9 of the KVKK. The video (Reels) feature that may be added later is optional: if you choose it, your photo is sent to an external provider for the video; we tell you this in advance and ask for your consent.

8. This website and cookies

There are no cookies, advertising or visitor tracking tools on this site. Only your language preference is kept in your own browser (in local storage). Our hosting provider keeps standard server logs (IP address, date, requested page, browser information) for security purposes.

9. Security

Connections are encrypted (HTTPS). Each shop’s data is separated from the others at the database level. We do not use passwords: signing in is done with a one-time code sent to your email. Instagram access tokens are stored encrypted and are revoked immediately when you delete your account. If there is a breach, we inform you and the Personal Data Protection Board as the law requires.

10. Your rights

You can see, correct and delete your data, object to its processing, and exercise your other rights under Article 11 of the KVKK. For details, see the KVKK Privacy Notice; to delete your account, see the Data Deletion page. The service is for businesses; people under 18 cannot open an account.

11. Changes

When we update this policy, we change its date. We announce important changes in the app or by email before they take effect.

12. Contact us

For any question about privacy: kvkk@vitrinustasi.com
Data controller: DocPlant Doküman ve Yazılım Hizmetleri Ltd. Şti., Süleymanbey Sok. No: 6A/10, 34349 Gayrettepe, Beşiktaş / İstanbul