App Privacy Policy

1. Who We Are and What This Policy Covers

This policy applies to data obtained through “Vonasis”, the app Vevona Digital (“Vevona”, “we”) uses to connect to Meta platforms (Meta App ID: 1590068918338235).

Vonasis lets Vevona products connect securely to the Facebook Pages, Instagram professional accounts and WhatsApp Business accounts of our customers. Vevona products that offer a Meta account connection, VonaHub (social media management) first among them, use this app. This policy applies as soon as you connect a Facebook, Instagram or WhatsApp account in a Vevona product.

Visitor data of the vevona.com website is covered by a separate notice, not by this policy: Privacy Policy.

Company

Vevona Digital

Address

Folkart Towers Tower A, Floor 35, No:3509, Bayraklı, İzmir

Email

info@vevona.com

Telephone

+90 506 843 94 96

The business using our products is the data controller for data relating to its own followers, customers and the people it messages; Vevona processes that data on the business’s behalf and on its instructions (data processor). For the business’s own account information, Vevona is the data controller.

2. What Data We Access

We access data on Meta platforms only when you connect your business account yourself through Meta’s own login and permission screen, and only within the permissions you approve on that screen. We do not access accounts you have not connected, posts on your personal Facebook profile, your friends list or your personal messages.

Depending on the accounts you connect and the permissions you grant, we may process the following data:

• Account and profile information — the name and Meta user ID of the person who makes the connection; the name, ID, username, profile picture and basic information of the Facebook Page, Instagram professional account and WhatsApp Business account.
• Posts and media — posts, stories, reels, images, videos and captions published on your accounts or published by you through our products.
• Comments — comments and replies on your posts, together with the public name and username of the account that wrote them.
• Direct messages — messages received by your Facebook Page and Instagram account, the replies you send, and the name, username and profile picture of the person you are messaging with.
• Insights — aggregated performance data such as reach, impressions, engagement, follower count and follower demographics.
• Ads data — ad account, campaign, ad set, ad, budget, spend and performance information.
• Lead forms — information shared by people who fill in forms in Meta lead ads (e.g. name, email, phone).
• WhatsApp Business messages — messages received by and sent from your WhatsApp Business account, the phone number and profile name of the person you are messaging with, message templates and delivery statuses.
• Access tokens — the tokens Meta issues during connection, which allow us to access your account on your behalf.

Each product requests only the permissions needed for the features it offers. You can always review and revoke the permissions you have granted in your Facebook and Instagram settings.

3. How We Use the Data

• Publishing content — publishing posts you have prepared or approved on your accounts at the time you choose. We never publish content on your behalf without your approval.
• Inbox and replies — showing comments and messages in a single panel so that you and your team can reply.
• AI-assisted replies — when you turn this feature on, drafting suggested replies to incoming messages and comments or replying automatically within the rules you set. While the feature is off, no data is processed for this purpose.
• Reporting — reporting on your account and ad performance and offering suggestions for your content plan.
• Ads management — creating, editing and pausing campaigns on your instructions, showing their results and delivering lead form submissions to you.
• WhatsApp messaging — enabling you to message your customers through WhatsApp Business.
• Security and support — detecting connection problems, preventing abuse and answering your support requests.

We do not sell or rent data obtained from Meta platforms, and we do not transfer it to data brokers. We do not use this data for targeting or profiling for our own advertising or for the advertising of unrelated third parties. Nor do we use it to make eligibility decisions about people, such as for credit, insurance, employment or housing.

4. Legal Basis

Turkish Law No. 6698 on the Protection of Personal Data (KVKK) applies in Turkey, and the GDPR / UK GDPR applies in the European Union and the United Kingdom. We process data on the following legal grounds:

• Entering into and performing our service contract with you (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)).
• Our legitimate interests, such as keeping the service secure and preventing abuse (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)).
• Compliance with our legal obligations (KVKK Art. 5/2-ç, GDPR Art. 6(1)(c)).

When businesses process the data of their followers and customers through our products, they are responsible for informing those people and for having their own legal basis.

5. Who We Share Data With

We share data only to the extent necessary to provide the service, and only with service providers acting on our behalf and on our instructions:

• Hosting and infrastructure providers — server, database, backup and network security services where the data is stored.
• AI service providers abroad (US and EU) — when you use AI-assisted reply, content and reporting features, only the content needed for that task (e.g. the relevant message or comment text, post text or image) is sent.

These providers are bound by contract; they may process the data only on our instructions and for the purposes in this policy, and may not use it for their own purposes. We do not use Meta platform data to train AI models, and we work with service providers on terms that do not allow them to use this data to train their own models.

Because the AI service providers are located in the US and the EU, this sharing is an international transfer. Transfers rely on the safeguards set out in Article 9 of KVKK (e.g. standard contracts) and, under the GDPR, on the European Commission’s standard contractual clauses.

Content you publish and replies you send are, by their nature, transmitted to Meta platforms. Beyond that, we share data with competent public authorities only where the law requires it.

6. Compliance with Meta Platform Terms

We process data obtained from Meta platforms in accordance with the Meta Platform Terms and Developer Policies. We use the data only for the purposes described in this policy and, if Meta requests it, we provide information showing that we comply with these terms.

Data collected by Meta itself is subject to Meta’s own privacy policy: Meta Privacy Policy · Meta Platform Terms

7. Retention and Deletion

• We keep data obtained from Meta platforms for as long as your account remains connected and you use the service.
• When you disconnect an account, the access tokens for that account are deleted; other data obtained from the account is deleted or anonymised within 30 days at the latest.
• The same process applies when you delete your product account or remove the Vonasis app in your Facebook or Instagram settings.
• Records we are legally required to keep (e.g. invoices and accounting records) are kept for the period required by law and deleted when that period ends.

Posts already published on Meta platforms remain on Meta; you can delete them directly on Facebook or Instagram. Step-by-step deletion instructions: Data Deletion Instructions.

8. Data Security

• Meta access tokens are stored encrypted in our database.
• All traffic between our products, our servers and Meta is encrypted with HTTPS/TLS.
• Access to the data is limited to authorised staff who need it for their work and is controlled on a role basis.
• We request from Meta only the permissions our features need to work.
• The server and application layers are updated and backed up regularly.

In the event of a data breach, we notify the relevant authorities, the affected businesses and, where required, Meta within the time limits set by KVKK and the GDPR.

9. Your Rights

Depending on where you are located you have the following rights — under Article 11 of the KVKK in Türkiye and Articles 15-22 of the GDPR in the EU and the UK:

• Access — to request a copy of the data we hold about you.
• Rectification — to have incorrect or incomplete data corrected.
• Erasure — to request deletion of your data (right to be forgotten).
• Restriction of processing — to have processing stopped in certain circumstances.
• Data portability — to receive your data in a structured format.
• Objection — to object to processing based on legitimate interest.

For your requests, write to info@vevona.com — we reply within 30 days at the latest. If you are not satisfied with the outcome, you retain the right to lodge a complaint with the Turkish Personal Data Protection Authority or, in the EU or UK, with the competent supervisory authority.

If your data is processed through our products by a business you follow or message, we recommend sending your request to that business first. If you write to us, we will forward your request to the business concerned and help fulfil it.

10. Children's Data

Our products are intended for businesses and are not designed for use by anyone under 18. We do not knowingly collect data from children; if we become aware of such data, it is deleted without delay.

11. Changes

This policy may be updated. When it is, the date at the top of the page changes; we also announce significant changes in the product or by email.

12. Contact

For any question about this policy or your data, write to info@vevona.com or send a letter to Folkart Towers Tower A, Floor 35, No:3509, Bayraklı, İzmir, Türkiye.