Privacy Policy

3.1. Business (Customer) Data

Data relating to businesses that use Madset and their authorised users:

• Identity and contact details (name, e-mail, phone, business name).
• Account and authentication data (hashed password, session data; if you sign in with Google, the name, e-mail and profile picture Google passes to us).
• Connected account data (Meta Page/ad account ID, WhatsApp Business account details, and (if you connect one) your Google Ads customer ID).
• Brand and product information (brand brain content, product/service catalogue, website addresses you submit for analysis).
• Usage and system logs (activity records, IP address, device/browser information).
• Billing and subscription information (if any).

3.2. Lead (End User) Data

Data processed on behalf of a business about people who submit a Meta Instant Form or contact the business through a supported messaging integration, such as WhatsApp where connected. For businesses that enable the WhatsApp connection, this also includes chat history they choose to share during Meta onboarding, new incoming messages, messages sent from the WhatsApp Business app, attachments and delivery/read statuses:

• Instant Form answers, including the name, e-mail, phone number and other answers requested by the business, together with form, submission and ad identifiers and submission time.
• Messaging identifier and profile name (e.g. WhatsApp phone number or platform user ID).
• Where a messaging integration is enabled, message content and associated webhook event data received through that integration.
• Ad attribution (referral) data: which ad or creative the message originated from.
• The outcome marked by the sales side (e.g. contacted → interested → appointment → sale) and, where entered, the sale amount.
• The relevant consent record, where one exists.

3.3. Ad Performance Data

Campaign data received from Meta and (if you connect it) Google Ads, which is largely aggregate/statistical: impressions, clicks, conversations started, conversions and spend.

3.4. Conversion Measurement Data

For businesses that choose the Google Ads channel, we may process click identifiers (e.g. GCLID) and, only where the individual has consented, hashed matching keys such as e-mail or phone, in order to connect an ad click to a real sale. This data is held in a separate, access-restricted store, is encrypted, and is used only for conversion measurement.

Data We Access

Depending on the permissions granted and the features used, Madset may access:

• Meta user identifiers and information required for account authorization.
• Business Portfolio identifiers and associated business assets.
• Advertising account identifiers, campaigns, ad sets, ads, advertising creatives, and campaign configuration.
• Advertising performance information, including impressions, clicks, reach, conversions, advertising spend, and other available reporting metrics.
• Facebook Page identifiers and Page information required to select and use authorized business assets.
• Instagram professional account identifiers, username, media, captions, media links and publication information for connected-account features.
• Catalog and product-set identifiers and product information used to select a catalog, synchronize products and create catalog ads.
• Instant Form definitions and submitted answers, including contact details and other fields provided by the person completing the form.
• Access tokens and related authorization information required to maintain a connection with Meta.

How We Use Meta Platform Data

• Connect and identify the Meta business assets authorized by the user.
• Display advertising account and campaign information in the Madset dashboard.
• Create and manage advertising campaigns according to the Customer's instructions.
• Analyze advertising performance and generate AI-assisted recommendations.
• Support the advertising creative and optimization workflows available in the service.
• Display Instant Form responses to the authorized business, manage its selected catalog and products, and publish an Instagram post when the user explicitly requests it.
• Maintain account security, troubleshoot integration issues, and comply with applicable legal and platform requirements.

Access and User Control

Madset accesses Meta business assets only through the authorization and access rights available to the connected user. Customers may disconnect their Meta integration in Madset or revoke authorization through the applicable Meta account or business integration settings.

Disconnecting in Madset removes the stored authorization credentials for that connection and stops future access through it. Disconnection does not automatically erase previously stored information; customers may request its deletion by following the instructions below.

AI-Assisted Processing

For AI-assisted recommendations, Madset may send AI service providers aggregated advertising performance metrics, limited campaign context (such as the campaign objective, destination and identifiers of the ads or campaigns being analyzed), relevant creative labels and style information, and business or brand information. Audience suggestions may also use Meta targeting catalogue descriptions and estimated audience sizes.

These recommendation inputs exclude Meta access tokens, personal Meta user identifiers, lead contact details, lead form responses and the content of customer conversations. Creative-generation features may separately process the prompts and media you provide, as explained in the data-sharing section.

Transfers to AI service providers are limited to the information necessary for the relevant functionality and follow the data-sharing practices described in this policy. Madset does not use Meta Platform Data to train or fine-tune AI models.

Meta Platform Data Retention and Deletion

Madset retains Meta Platform Data only for as long as necessary to provide the authorized service and in accordance with applicable Meta Platform Terms and legal requirements. These requirements take precedence over the general retention periods below.

When a customer disconnects a Meta account, the associated stored authorization credentials are removed. Following disconnection, account closure or a verified deletion request, previously obtained Meta Platform Data is deleted when required by applicable platform policies and law. Information subject to a mandatory legal retention obligation may be retained only to the extent and for the period required by law.

Users can request deletion by contacting info@pursula.com or following Madset's Data Deletion Instructions. Madset does not sell Meta Platform Data.

Data Deletion Instructions

info@pursula.com

6.1. Use of Google User Data (Limited Use)

When you sign in with your Google account or connect your Google Ads account to Madset, information obtained from Google APIs is used only on your instructions, to manage your own ad account and report back to you.

• Data received from Google APIs is never sold, and is never used for ad targeting or ad personalisation.
• It is not transferred to third parties other than the suppliers strictly required to provide the service, and is never used for credit scoring or similar purposes.
• No humans read this data. The only exceptions are your explicit permission, a review necessary for security purposes, where the law requires it, and where the data has been aggregated or anonymised.
• Access is limited to the narrowest scope the operation you requested requires.
• You can revoke the connection at any time from Madset settings or from your Google Account security settings; on revocation, the stored authorisation tokens are deleted.

Madset's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

On the Google Ads channel, ad spend is owed directly to Google and is charged to your own Google Ads account; Madset does not collect that spend. See the Terms of Service for detail.

6.2. International Transfers

Some of the suppliers above may process data outside Türkiye (e.g. in the EU or the USA). Such transfers are made under KVKK art. 9 with appropriate safeguards in place (standard contractual clauses, an adequacy decision, or explicit consent where required). Primary data storage is configured in the EU region.

The primary database project is in Frankfurt, Germany. Vercel server functions and Railway workers process application data in the US. Service providers may also use infrastructure, subprocessors or remote support in other countries under their published processing arrangements.