Privacy policy

This policy applies to the digiwings.net website and the Digiwings application (app.digiwings.net), operated by Burak Dağlı (“Digiwings”, “we”), a sole proprietorship registered in Türkiye. Under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), the data controller is Burak Dağlı, Gökçek Mah. 360. Sk. Ak Toprak Apt. No:10 İç Kapı No:8, Sincan / Ankara, Türkiye (Sincan Tax Office, tax ID 2670596040). Users in the European Economic Area also have their rights under the GDPR.

What we process

Early access applications: full name, work email, company, website, agency/brand type, number of clients, ad budget band, channels you use, your note, application language, IP address and time of application.

Account and security: name, email, an irreversible hash of your password (never the password itself), role and permissions, session records, sign-in attempts (IP address, browser information, time) and an audit log of administrative actions.

Data from accounts you connect: campaign, ad group, product and page names; performance metrics such as spend, impressions, clicks, conversions, revenue and sessions; and account IDs from Google Ads, Google Analytics 4, Google Search Console, Google Merchant Center and, later, Meta Ads. This is mostly business data and is not expected to contain personal data.

Google connection: your Google account’s email address and ID, the list of permissions you granted and the access token (refresh token) Google issues. The token is stored encrypted.

Why we process it

• To review your application and contact you (pre-contractual steps, your consent).
• To open your account, manage your session and provide the service (performance of a contract).
• To protect your account and our systems against abuse (legitimate interest, legal obligation).
• To produce reports and checklists from the accounts you connect (performance of a contract).

We don’t use your data for advertising, we don’t sell it, and we don’t use it to build personal profiles.

Google API data

Digiwings’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This means:

• We use Google data only to provide Digiwings’ reporting and checking features to you.
• We don’t use Google data to serve ads, and we don’t sell it or transfer it to data brokers.
• We don’t use Google data to develop, improve or train generalized artificial intelligence or machine learning models.
• Our staff may only see your Google data with your explicit permission, for security purposes, to comply with the law, or for internal operations once the data has been aggregated and anonymized.

You can remove the Google connection at any time from the sources page in the app or from your Google account permissions.

Who we share it with

We share your data only with service providers that help us run the service, and only as much as needed:

• OVHcloud — server hosting (data center in Canada).
• Cloudflare — domain, security, bot protection (Turnstile) and cookieless visitor statistics.
• Google Workspace — sending email.
• Windsor.ai — as a data-fetching tool for some accounts, until they move to a direct Google connection.
• Have I Been Pwned — to check whether a new password appears in known breaches; only the first 5 characters of its hash are sent, never the password.

We don’t share your data with anyone else unless the law requires it.

International transfers

Our servers are in Canada and some of our service providers process data outside Türkiye. These transfers are made under Article 9 of the KVKK and the relevant GDPR provisions. The basis for these transfers is the explicit consent you give when applying for early access and opening your account; if you withdraw it, we close your account and delete your data.

How long we keep it

• Early access applications: up to 12 months after a decision; for the life of the account if one is opened.
• Account data: as long as your account is open.
• Sign-in attempts: 90 days. Application error logs: 30 days. Raw platform responses: 90 days.
• Connected account data and the Google access token: until the connection or account is removed; deleted within 30 days afterwards. Removal from backups can take as long as the backup cycle.

Security

All connections are encrypted (HTTPS). Passwords are stored irreversibly, access tokens are encrypted, the server is closed to the internet and only reachable through Cloudflare. Accounts are locked after repeated failed sign-ins.

Your rights

Under Article 11 of the KVKK and the GDPR you have the right to access your data, ask for it to be corrected, deleted, restricted or transferred, object to processing and withdraw consent. Send requests to burak@digiwings.net; we reply within 30 days. You may also complain to the Turkish Personal Data Protection Authority or your local supervisory authority.

To have your data deleted, see the data deletion page.

Cookies

The site uses only strictly necessary cookies. See the cookie policy.

Changes

If we change this policy we update the date on this page and email account owners about significant changes.

Contact

Burak Dağlı (Digiwings), Gökçek Mah. 360. Sk. Ak Toprak Apt. No:10 İç Kapı No:8, Sincan / Ankara, Türkiye — burak@digiwings.net