PDPL Information Notice

Last updated: October 3, 2026

This notice is given under article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the “PDPL”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It explains how the personal data of people who use Creobee (https://www.creobee.com) is processed. Our Privacy Policy covers the same processing in more detail.

1. Data controller

The data controller is Creobee, based in Türkiye. Contact: support@creobee.com.

2. Personal data processed and the purposes

• Identity and contact data: your email address; if you sign in with Google, the name and profile picture Google shares with us; your account id. Purpose: opening and running your account, signing you in, and contacting you about your account.
• Brand and preference data: your business name and description, audience, voice, content mix, goal, weekly target and time zone. Purpose: writing and planning your posts, and sending emails at your local time.
• Content: the logos, background images and photos to schedule that you upload, the text and settings of the posts you save, and the days you made or published posts. Purpose: providing the Service.
• Social publishing data (only if you connect accounts): each connected account's platform, name, handle, picture and identifier; each scheduled post's text, image, time, status and platform link. The access to your accounts is held by Post For Me, not by Creobee. Purpose: publishing posts on your behalf.
• Customer transaction data: customer, order and subscription ids, plan, status, dates and refunds received from Lemon Squeezy; credit and usage figures. Your card details never reach us. Purpose: payments, subscriptions and credits, and our accounting and tax obligations.
• Email records: which emails were sent to you, whether you clicked a link, whether you unsubscribed, and addresses that bounced or reported spam. We do not track opens or use tracking pixels. Purpose: delivering account emails, managing tips and reminders, and respecting your choices.
• Analytics data: pages viewed, reading time and depth, clicks on sign-up buttons and outgoing links, features used, errors, page speed, browser and device type, the site or campaign that brought you, and an approximate location (country and city) derived from your IP address, which is not stored. Linked to a random id, and to your account id after you sign up; never to your email or your content. Purpose: improving the Service.
• Transaction security data: IP address, browser details and request logs, and the bot check on the sign-in form. Purpose: keeping the Service secure and preventing abuse.
• Requests and complaints: the emails you send us. Purpose: answering support requests.

We do not sell personal data, share it for advertising, or use your content to train AI models. We make no automated decisions with legal effects; the AI only writes post text.

3. Method of collection and legal grounds

Personal data is collected electronically and by automated means: through the forms on the website and in the app, cookies and similar technologies, Google sign-in, and our service providers (Lemon Squeezy, Post For Me). The legal grounds, under PDPL article 5(2), are:

• Performance of a contract: account, brand, content, publishing, payment and credit data, and account emails.
• Compliance with a legal obligation: accounting and tax records, and requests from authorised public bodies.
• Establishing, exercising or protecting a right: records used as evidence in a dispute.
• Legitimate interest: security, analytics and answering support requests, provided this does not harm your fundamental rights and freedoms.

4. Recipients and transfers abroad

Personal data is shared only with the service providers that help us run Creobee (hosting, storage, payments, email, analytics, AI and publishing), some of which are located abroad, only as far as each one needs it, and with public authorities where the law requires it or to report illegal use.

5. Retention periods

• Account, brand data, uploads and saved posts: while your account exists. When you ask us to delete your account, it is deleted within 30 days.
• Images of scheduled posts: deleted 30 days after the post is finished.
• Invoice and accounting records: as long as tax and commercial law require (up to 10 years).
• Unsubscribe and bounce records: as long as needed to keep respecting your choice.
• Security logs: a few days to a few weeks, depending on the provider.

6. Your rights under PDPL article 11

You can ask us whether and how your data is processed and who it was shared with, have it corrected or deleted, object to a result produced solely by automated processing, and claim compensation if it was processed unlawfully.

7. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request to support@creobee.com from the email address registered to your account, stating your full name, your contact details and your request. To apply in writing, ask us for our postal address at the same email address. We answer within 30 days, free of charge; if answering involves a separate cost, the fee set by the Personal Data Protection Board may be charged. If your request is refused, you find the answer insufficient, or we do not answer in time, you may complain to the Personal Data Protection Authority.