nekna 360
Sign in

Privacy Policy

Last updated: 26 October 2026

This policy explains how [Company name] ("Nekna360", "we") collects, uses, stores and deletes personal data in the multi-channel customer messaging and social media management service provided at nekna360.com (the "Service").

1. Who we are

  • Company: [Company name]
  • Address: [Address]
  • Tax office / number: [Tax office] / [Tax number]
  • Email: [Email]

2. Our roles

We are the data controller for the account and billing data of the businesses that sign up ("Customers"). For the data we process on a Customer's behalf from the channels they connect (their conversations with their own customers, contact lists, comments, etc.) we act as a data processor; the Customer is the controller of that data.

3. Data we collect

  • Account data: name, email, a one-way hash of the password (the password itself is never stored), company name, role, session and activity logs (IP address, browser).
  • Connected account data: identifiers, names, profile details and access tokens of the WhatsApp Business, Instagram, Facebook, Google Business Profile, YouTube, TikTok, LinkedIn, X, Meta Ads and Google Ads accounts a Customer authorises.
  • Communication content: incoming and outgoing messages, media files, comments, reviews and posts from connected channels, with their delivery status.
  • Contact data: name, phone number, email address, platform id, tags and marketing consent (opt-in / İYS) records of people the Customer uploads or who write through a channel.
  • Ads and insights data: campaign, spend and performance data of connected ad accounts and page/account statistics.
  • Payment data: billing details. Card data is processed by the payment provider and never stored on our servers.

4. How we use data

  • To provide the Service: showing messages in the shared inbox, sending messages and posts on the Customer's instruction, reporting on campaigns and insights.
  • To pass the relevant content to an AI provider for AI features the Customer explicitly enables (reply suggestions, classification, writing assistance).
  • Security, abuse prevention, troubleshooting and legal compliance.
  • Billing and communication with Customers.

We do not sell data, do not use it to build advertising profiles, and do not share it with third parties except on the Customer's instruction.

5. Google user data

Nekna360's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the user-facing features the user sees and requests in the Service (managing Business Profile reviews, publishing posts and videos, showing ad reports). It is not used for advertising, not sold, not used to train general AI models, and is read by humans only with the user's consent, for security purposes, or where required by law.

6. Meta (WhatsApp, Instagram, Facebook) data

Data received from Meta platforms is processed in line with the Meta Platform Terms, only to provide the Service to the owner of the connected account. When a Customer disconnects an account, or removes our app's access on Meta, the access tokens are deleted immediately.

7. Who we share data with

  • Connected platforms: messages and posts sent on the Customer's instruction are delivered to the relevant platform (Meta, Google, TikTok, LinkedIn, X).
  • AI providers: only when an AI feature is used, limited to the content needed (e.g. Anthropic, OpenAI, Google). If the Customer connects their own key, that provider is used.
  • Infrastructure and payment providers: hosting and the payment institution, to the extent the Service requires.
  • Authorities: where required by law.

Transfers to platforms and providers located outside Türkiye are made in accordance with Article 9 of the Turkish Personal Data Protection Law (KVKK).

8. Retention and security

  • Data is stored on servers located in Türkiye. Access tokens and secrets are encrypted with AES-256; connections are protected with TLS.
  • Data is kept while the account is active. When an account is closed, data is deleted within 30 days; invoices are kept for the legally required period.
  • Raw platform notifications (webhooks) are kept for 30 days; sessions are deleted when they expire.

9. Cookies

We use one essential cookie to keep you signed in and one to remember your language. We do not use advertising or tracking cookies.

10. Your rights and data deletion

To exercise your rights under Article 11 of KVKK (and, where applicable, the GDPR) — access, rectification, erasure, objection and more — write to [Email]. If you have corresponded with one of our Customers and want your data deleted, you may contact that business or us. See Data Deletion for instructions.

11. Children

The Service is not intended for people under 18 and we do not knowingly collect their data.

12. Changes

When we update this policy we change the date on this page and notify Customers of material changes.