1. Who is responsible
The data controller is Spacescaping Studio, which operates BrandManager ("BrandManager", "we", "us"). You can reach us at hello@brandmanager.pro.
2. What we process
- Demo requests: first and last name, email address, job title, team, the day and time you would like a call, your time zone, your note and your language.
- Contact form: name, email address, topic and message.
- Customer and team accounts: name, email address, a one-way hash of your password (never the password itself), role and permissions, sign-in times.
- Workspace content: the text, images, videos, presentations, website and social media content and files you or your team add to the service.
- Commercial records: plan, the price agreed with you, invoices and correspondence.
- Security records: IP address, browser information, sign-in attempts and server logs.
- The AI assistant: the instructions you give it and the content you select for it.
We do not ask for identity numbers, card details or special categories of personal data (health, beliefs, biometrics and the like), and we ask you not to upload them to the service.
3. Why, and on what legal basis
- To answer your demo request and arrange the call — necessary to enter into a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
- To open your account, provide the service and support it — performance of the contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
- Invoicing, tax and commercial record-keeping — legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
- Keeping accounts and systems secure, preventing misuse, and establishing or defending legal claims — our legitimate interests and the establishment, exercise or protection of a right (KVKK Art. 5(2)(e) and (f); GDPR Art. 6(1)(f)).
- Service emails (invitations, passwords, security, invoices) — performance of the contract. We send marketing messages only if you separately agree to receive them, as Law No. 6563 requires.
4. How we collect it
Electronically: through the forms on our website, what you enter in the app, email correspondence, and the automatic records our servers keep.
5. Who we share it with
Only with the service providers we need to run BrandManager, and only as much as each of them needs:
- Hosting and storage: Supabase (database and files, Seoul, South Korea) and Vercel (the app and the website, Seoul and Frankfurt regions, with a global network edge).
- Email delivery: Resend.
- The AI assistant: Anthropic, which receives only the instructions and content you send to the assistant; under its commercial API terms these are not used to train its models.
- Public authorities, when the law requires it, and our legal and financial advisers under their duty of confidentiality.
We do not sell, rent or share your personal data for advertising.
6. Transfers outside Türkiye
Because our infrastructure is hosted abroad, personal data is transferred outside Türkiye. We make these transfers under Article 9 of the KVKK with the appropriate safeguards it provides, in particular the standard contracts published by the Personal Data Protection Board, notified to the Authority as the law requires. For people in the EU and EEA, transfers to the Republic of Korea rely on the European Commission's adequacy decision, and transfers elsewhere on the EU Standard Contractual Clauses.
7. How long we keep it
- Demo requests and contact messages: two years from the last contact, unless you become a customer.
- Account and workspace content: for as long as the agreement runs; deleted within 30 days after it ends, once you have had the chance to export it.
- Invoices and commercial records: ten years, as the Turkish Commercial Code and tax law require.
- Security and server logs: up to two years, or as long as Law No. 5651 requires for traffic data.
At the end of these periods data is deleted, destroyed or anonymised.
8. How we protect it
Encryption in transit (HTTPS/TLS), passwords stored only as one-way hashes, role-based access, two-factor authentication for administrator accounts, limits on sign-in attempts, and logged access. If a breach occurs we notify the Personal Data Protection Board and the people affected within the time the law sets (KVKK Art. 12; GDPR Arts. 33–34).
9. Our customers' websites
For personal data collected on websites our customers publish with BrandManager — messages sent through their contact forms, for example — the customer is the data controller and we are the data processor, acting on their instructions. Requests about that data should go to the business that runs the site. Traffic counting on those sites sets no cookie and stores no identifier.
10. Your rights
Under Article 11 of the KVKK (and Articles 15–22 of the GDPR where it applies) you may ask whether we process your data; ask for information about it; learn the purpose and whether it is used for that purpose; learn who it is shared with in Türkiye or abroad; have it corrected if it is incomplete or wrong; have it deleted or destroyed; have third parties it was shared with told of these steps; object to a result against you produced solely by automated analysis; and claim compensation for damage caused by unlawful processing. Under the GDPR you may also ask for restriction, object to processing based on legitimate interests, and receive your data in a portable format.
11. How to apply
Write to hello@brandmanager.pro from the email address registered to your account, or in another way that lets us verify it is you. We answer within 30 days and free of charge; if an answer involves an additional cost, the fee set by the Board may apply. If you are not satisfied, you may complain to the Personal Data Protection Board — or, in the EU, to your local supervisory authority.
12. Children
BrandManager is a business service and is not intended for anyone under 18.
13. Changes
We may update this policy. We tell customers about material changes by email before they take effect; the current version is always on this page, with its date at the top.
Contact
hello@brandmanager.pro