Privacy Policy
Last updated: 13 November 2026
This page explains which personal data U2 AI Social (u2aisocial.com and its application at app.u2aisocial.com) processes, for what purpose and on what legal basis, where the data is kept and for how long. U2 AI Social is a software service that lets you prepare content for the social media accounts you connect, adapt it to each platform, schedule it and publish it. The service is in development and is currently open to invited users only.
1. Scope and data controller
This notice covers u2aisocial.com, its subdomains and the U2 AI Social application. It is based on the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the GDPR.
| Legal name | U2 AI Studio Teknoloji Anonim Şirketi |
| Registered office | Ahi Evran OSB Mah. Erkunt Cad. No: 3 İç Kapı No: 41, Sincan / Ankara, Türkiye |
| MERSIS · Trade registry · Tax | 0883124471000001 · Ankara 434199 · Sincan / 8831244710 |
| Email · Registered email (KEP) | info@u2aistudio.com · u2aistudio@hs01.kep.tr |
| Phone | +90 850 346 82 82 · +1 415 712 78 82 |
U2 AI Studio processes data in two separate roles:
- As data controller: for your account, your team memberships, billing, security and the operation of the service.
- As data processor: for the content our customers (agencies and businesses) upload to the service and for third-party data contained in that content. The customer using the service is the controller of this data; we process it only on the customer's instructions and only to provide the service.
The U2 Account (id.u2aistudio.com) is also described in the KVKK Information Notice on the main site.
2. What we collect, why, and for how long
The table below is the complete picture; no other data is collected.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account and workspace: name, email, company, role, workspace and team memberships, session records | Opening the account, signing in, managing team and client workspaces | KVKK Art. 5/2-c and 5/2-f; GDPR Art. 6(1)(b) and 6(1)(f) | While the account is open; 30 days after the account is closed |
| Connected social media accounts: account ID on the platform, username, display name, profile picture, the list of pages and accounts you manage, the scope of permissions you granted, access and refresh tokens (encrypted) | Publishing content only on your instruction, showing publishing status and post statistics, keeping the connection valid | KVKK Art. 5/2-c; GDPR Art. 6(1)(b) | Until you disconnect or close your account; tokens are deleted the moment you disconnect |
| Content: images, videos and texts you upload, the platform versions generated from them, drafts, the publishing schedule, approval records and team notes | Preparing, adapting, approving and publishing content on the platforms you choose | As processor on behalf of the customer; for the customer, KVKK Art. 5/2-c | Until you delete it; 30 days after the account is closed |
| Publishing and statistics records: the post ID and link returned by the platform, publishing time, status and error records; aggregate counts per post (views, reach, likes, comments and shares) | Showing the publishing result, reporting errors, providing performance reports | KVKK Art. 5/2-c and 5/2-f; GDPR Art. 6(1)(b) and 6(1)(f) | Until the connection is removed or the account is closed; deleted within 30 days after that |
| AI suggestions: the text and image to be adapted and the text and image suggestions generated from them | Generating text and image suggestions for each platform; a suggestion is never published without your approval | As processor on behalf of the customer | Kept with the content, not stored separately; your content is not used to train AI models |
| Technical and security data: IP address, browser information, request and error logs; an activity log (who prepared, approved or published what, and when) | Service security, abuse prevention, troubleshooting, accountability within your team | KVKK Art. 5/2-f; GDPR Art. 6(1)(f) | Technical logs up to 12 months; the activity log while the account is open |
| Payment and invoicing: order, plan, subscription status, billing details | Opening and managing the subscription, accounting obligations | KVKK Art. 5/2-c and 5/2-ç; GDPR Art. 6(1)(b) and 6(1)(c) | Ten years (commercial records) |
We do not collect the text of comments on your posts, follower lists or private messages. No decisions are made about you by automated means, and no profile or score is created from your data.
Payment. Online orders are processed by Polar Software, Inc. (polar.sh), which acts as seller (Merchant of Record) and independent controller for payments; your card details go to Polar and its payment provider Stripe and never reach us. Bank transfer orders are taken through payments.u2aistudio.com.
3. Our relationship with social media platforms
- We connect your accounts through each platform's official authorization flow (OAuth). We never see or store your platform password.
- We request only the permissions needed for publishing and post statistics. The permissions requested on each platform are shown on the platform's own screen before you approve the connection.
- Content you publish is sent, on your instruction, to the platform you choose. From then on it is subject to that platform's own terms and privacy policy: Meta (Facebook, Instagram, Threads), LinkedIn, X, TikTok, Google (YouTube).
- YouTube. U2 AI Social uses YouTube API Services. By connecting your YouTube account you agree to the YouTube Terms of Service; how Google processes your data is described in the Google Privacy Policy. You can revoke U2 AI Social's access at any time on the Google security settings page.
- Google API data. U2 AI Social's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We do not sell data received from the platforms, use it for advertising, share it with other customers or use it to train AI models.
- You can remove access in two ways: by disconnecting in the application, or in the platform's own settings. Details are on the Data Deletion page.
4. Where the data is kept and who sees it
- Amazon Web Services, Istanbul (Türkiye): the application, database, media files and backups are in Türkiye.
- AI processing: takes place on servers managed by U2 AI Studio, in Türkiye; your content is not sent to third-party AI services.
- Amazon CloudFront: creates short-lived, unguessable links so that platforms can download the media file during publishing.
- Amazon SES (Frankfurt, Germany): sending sign-in, notification and error emails.
- Cloudflare: domain name (DNS) service.
- Your team: people you add to your workspace see it within the permissions you grant. In agency workspaces each client sees only its own workspace.
- U2 AI Studio staff: only when your support request or a security review requires it, by named individuals, and recorded in the activity log.
We do not sell, rent or trade personal data, and we do not share it for anyone else's marketing.
5. Transfers abroad
The service's data is kept in Türkiye. Data leaves Türkiye in two cases: (a) when content you publish is sent, on your instruction, to the platform you choose (these platforms' servers are outside Türkiye), and (b) when notification emails are sent through Amazon SES (Frankfurt). These transfers are made within the framework permitted by Article 9 of the KVKK and in line with the decisions of the Personal Data Protection Board; where the GDPR applies, they rely on the transfer mechanisms in Chapter V.
6. Cookies
The website (u2aisocial.com) does not use cookies. The application uses only a strictly necessary session cookie to keep you signed in. There are no ad networks, social media tracking pixels or heat maps.
7. Security
The service is delivered over HTTPS/TLS. Platform access tokens are stored encrypted with a key management service (AWS KMS) and decrypted only during a publishing operation. Access is granted on the principle of least privilege; publishing, approval and administrative actions are written to the activity log. No system can be made completely secure; if a breach likely to put you at risk occurs, we notify the Personal Data Protection Board and the people concerned under Article 12/5 of the KVKK and, where the GDPR applies, under Articles 33 and 34.
8. Your rights and how to use them
Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether it is used accordingly, to know the third parties it is transferred to, to request correction if it is incomplete or inaccurate, to request erasure or destruction where the conditions are met and to have these actions notified to the third parties it was transferred to, to object to an outcome against you that results solely from automated analysis, and to claim compensation for damage caused by unlawful processing. Where the GDPR applies you also have the rights to restriction, objection, data portability and to lodge a complaint with a supervisory authority.
If you appear in content in one of our customers' (an agency's or business's) workspaces, please send your request to that customer first; it is the controller of that data. If you send the request to us, we will forward it to the customer and help them respond.
You can submit requests in writing under Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller: to our registered email (KEP) address, with a secure electronic or mobile signature, or from the email address registered in our system. Requests are concluded free of charge within thirty days at the latest (KVKK Art. 13). If you find the answer insufficient or receive no answer in time, you may complain to the Personal Data Protection Board under Article 14 of the KVKK.
9. Children
U2 AI Social is not intended for people under 18, and we do not knowingly collect data from this age group. If you believe such a record exists, write to info@u2aistudio.com and we will delete it.
10. Changes to this notice
When the service changes, for example when a new platform, a new type of data or a new service provider is added, we update this page. Updates apply from the date of publication onwards. We also announce significant changes in the application and by email.
11. Contact
info@u2aistudio.com · KEP u2aistudio@hs01.kep.tr · +90 850 346 82 82 · +1 415 712 78 82 · Ahi Evran OSB Mah. Erkunt Cad. No: 3 İç Kapı No: 41, Sincan / Ankara, Türkiye.