Privacy Notice

1. Who we are

The controller of your personal data is SALT KREATİF REKLAM TİC. LTD. ŞTİ., trading as Vibe to Brands, Çınarlı Mah. 1572 Sok. No:33, 35170 Konak / İzmir. You can reach us at info@vibetobrands.com or +90 232 462 10 55.

2. What we collect

• Account details: name, e-mail, phone and billing address; for company accounts the trade name and tax details.
• Order details: packages purchased, amounts, order notes and history. With your order (and with a basket you leave on the checkout page) we also record which ad or link brought you to the site that day (the campaign tag) and the first page you opened, to see whether our ads work. No cookie is used for this, and the pseudonymous visitor ID is not written to the order.
• Files you upload: logos, brand assets, product and location photos, video footage and documents.
• Your brand brief: the answers you give in the brief conversation and the document built from them.
• Website orders: the copy, images and details such as team members or branches that will appear on your site; the blog posts and cover images you publish from your panel; your stage approvals and approval notes; the access you grant so we can point your domain at the site. We never ask for the password to your domain account. If you want us to upload the site to your own hosting, we use the access you give us for that upload only and delete it from our records once it is done.
• Social account authorisation: the access you grant so we can manage your accounts. We never ask for or store your passwords — access is granted through the platform's own partner or admin invitation, and you remove it when the service ends.
• Consent records: which tick boxes you accepted at checkout, with the time, IP address and browser, kept as proof of what you agreed to and when.
• Technical data: IP address, browser type and page views, for security and error tracking.
• Site visit statistics: the page you view, time on page, which ad or link brought you (the campaign tag; for an ad click ID only whether one was present, not its value), whether you use a mobile device or an in-app browser, and your cookie choice. Your IP address is not stored in this record; visitors are told apart by a pseudonymous ID that changes every day. Nothing is written to your browser.
• Contact form: name, e-mail, phone and your message.
• Free account analysis request: your business name, the name or link of the public social media account you want reviewed, the platform you choose and an optional note about what you expect. We never sign in to your account; we only look at what anyone can see from the outside. The analysis we prepare and any messages about it stay attached to your account. With your request we also record which ad or link brought you to the site that day (the campaign tag) and the first page you opened, to see whether our ads work.
• Quota reminder address: if the free analysis quota is full and you ask to be told when it reopens, we take your e-mail address only. It is kept for that single notification, is not used for anything else afterwards, and is never added to a marketing list.

We never see or store your full card number or security code. Payments happen on the PCI-DSS compliant payment provider's own page. What stays with us is limited to the first six and last four digits, the card type and scheme, and a token issued by the payment provider — the token only means something inside their system, cannot be turned back into a card number, and exists so subscription renewals can be charged from their vault. You can delete it by removing the card from your account.

3. Why we process it, and on what basis

We do not sell your data, and we do not use it to build profiles for third parties.

4. Who processes it, and where

Your brief answers and assistant conversations are not used to train AI models.

International transfers. Türkiye is not covered by a European Commission adequacy decision, and some of our providers sit outside Türkiye — the database in the EU, customer websites with our hosting provider in the EU, storage and e-mail on Google infrastructure, the AI provider in the United States. Transfers are limited to what each provider needs in order to do its job, and are necessary for the service you asked for. Write to info@vibetobrands.com if you want the detail of which provider touches which data.

5. Content you upload about other people

Photos, video and documents you send us may contain other people's data — your staff, your customers, people appearing in a shoot. For that data you are the controller and we act as your processor: informing those people and obtaining any permissions needed is your responsibility, as clause 5a of the Distance Sales Agreement also states.

We process it only on your instructions and only to deliver the service, never for our own purposes, and it falls under the retention period below. If someone who appears in the content contacts us, we refer the request to you and take the material down where required.

6. How long we keep it

• Invoices and order records: 10 years (Turkish tax law).
• Your uploads, brief and delivered work: downloadable from your account for 6 months after the job closes, then deleted. Six months is also the maximum retention — please keep your own copies.
• Your website: its files, content and blog posts are kept for as long as hosting runs. When hosting ends they are deleted at the end of the period in clause 5f.3 of the Distance Sales Agreement. On a website job the stage outputs (wireframe, design, test site) appear in your account as links with a note, not as files; they are not covered by the 6-month download period and may be closed as the work moves on. Stage approvals are part of the order record and kept with it. For the data of people who visit your site or fill in its forms, you are the controller and we process it on your behalf under the Data Processing Addendum attached to the agreement.
• Contact form messages: up to 2 years.
• Site visit statistics: 12 months.
• Site assistant conversations: up to 12 months; your IP address is not stored with them.
• Free account analysis requests, the report and the messages about it: 12 months. A quota reminder address is deleted 30 days after the notification is sent.
• If you close your account, anything not under a statutory retention duty is deleted.

7. Marketing

We currently send no newsletters or promotional e-mail. Our e-mails are about your own order: confirmation, delivery, billing, a reminder for an unpaid order, and support replies. If we ever start marketing e-mail, consent will be asked for in a separate tick box, will never be a condition of buying, and every message will carry a one-click unsubscribe.

8. Security

The site is encrypted end to end with TLS (HTTPS). Passwords are stored irreversibly (bcrypt) — nobody, including our own staff, can read them. Access to the admin panel is restricted and authenticated.

9. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, and receive it in a portable form. You can withdraw consent for advertising measurement at any time from the cookie settings. Write to info@vibetobrands.com; we answer within 30 days.

If you are in the European Union and believe we have handled your data wrongly, you may complain to your national supervisory authority. In Türkiye the competent authority is the Personal Data Protection Board (KVKK).