Privacy Policy

Dropvora is operated by [ŞİRKET ÜNVANI], [AÇIK ADRES] · [İLETİŞİM E-POSTASI]. This policy explains what personal data we process and why, under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).

• Account: your email address and password (stored only as a one-way hash).
• Subscription: your plan, subscription status and usage credits. Card details are processed by Stripe; we never see or store them.
• API keys: the Anthropic (Claude), Runway and CJ Dropshipping keys you enter are encrypted with AES-256-GCM and only decrypted on our server when you use them.
• Shopify: the domain and access token (encrypted) of the store you connect. We only request permission to create and publish products; we do not access your customers or orders.
• Meta: when you connect Meta, your access token (encrypted), the ad account and Facebook Page IDs you select, and the IDs, status and performance data of the campaigns we create for you.
• Products and content: products you add, supplier matches, your pricing assumptions, AI-generated copy and ad videos.
• Technical: session cookies and server logs used to fix errors (IP address, browser, timestamps).

• To provide the service: manage your account, generate copy and videos, publish products to your store and create ad campaigns (performance of a contract).
• Billing and legal obligations (tax and accounting records).
• Security and abuse prevention: rate limits and error logs (legitimate interest).

We do not sell your data. We share only what is needed with these service providers:

• Supabase (database, authentication, file storage; servers in the EU, Frankfurt).
• Vercel (application hosting).
• Stripe (payments and subscriptions).
• Anthropic and Runway: your product details are sent, with your own API key, to generate copy and video.
• ElevenLabs: the narration script of an ad video (hook, benefits, price) is sent to generate the voice-over.
• CJ Dropshipping: product titles are sent to find suppliers.
• Shopify and Meta: on your instruction, products are sent to your store and ads to your ad account.
• Remotion: when a video is rendered in your browser, a usage event without personal data is sent for license tracking.
• Apify: our daily product research collects public data from the Meta Ad Library and Amazon; it does not include your data.

Some of these providers are located outside Türkiye and the EU (mainly in the US). Transfers are necessary to provide the service and are covered by the providers' contractual safeguards.

Ad videos and voice-over files you create are stored at unguessable public URLs so that Meta and Shopify can fetch them. Anyone with the URL can open the video, so we recommend not putting personal information in videos.

We only use strictly necessary cookies that keep you signed in. We do not use advertising or analytics cookies.

We keep your data while your account is open. When you ask us to delete your account, your account, keys, store and Meta connections, products and videos are deleted within 30 days. Invoices we are legally required to keep are retained for the required period.

Under KVKK Article 11 and the GDPR you may request access to, correction, deletion or a copy of your data, object to processing, and lodge a complaint with a supervisory authority (in Türkiye, the Personal Data Protection Authority).

Send requests to [İLETİŞİM E-POSTASI]; we answer within 30 days. For deletion steps see Data deletion.

Connections use HTTPS, API keys and access tokens are encrypted at rest, and database access is restricted with row-level security.

Dropvora is a business tool and is not intended for anyone under 18.

When we update this policy we change the date above and notify you by email of material changes.