Privacy Policy

SlideBase (slidebase.net) is operated by Mehmet Tuna Arıkaya, a sole proprietor ("SlideBase", "we", "us"), Kepeci Mah. 1217 Sk. No: 8-10 İç Kapı No: 17, Merkez/Isparta, Turkey. We are the data controller for the personal data described in this policy.

Contact for all privacy matters: smartify04@gmail.com. This policy applies together with our Terms of Service. A Turkish version prepared under the Turkish Personal Data Protection Law (KVKK) is available here; if the two differ, the Turkish text prevails for users in Turkey.

We do not intentionally collect special categories of personal data. Please do not enter such data into the service.

We do not sell your personal data and do not use it for third-party advertising.

All orders are processed by our online reseller FastSpring, the Merchant of Record, which handles payment, billing, subscriptions and taxes such as VAT. You enter card details on FastSpring's checkout; they do not reach our servers and we cannot see or store them. We receive only order details and transaction references.

FastSpring may act as an independent controller for its own purposes under the FastSpring Privacy Policy.

SlideBase generates content with third-party AI models. When you create slides, we send the following to the provider handling that step: your app's public store listing (name, description, screenshots), the brand text you entered, and the text and image prompts we build from them.

AI output is generated automatically and may be inaccurate. You are responsible for reviewing it before publishing, and for submitting only content you have the right to use.

We share personal data only with the providers below, limited to what each needs. We will update this list before adding a new AI sub-processor.

Many recipients are located outside Turkey and the EEA, mainly in the USA, so your data is transferred internationally. Transfers are made in accordance with KVKK Art. 9 and, where GDPR applies, Chapter V, relying on adequacy decisions, appropriate safeguards such as standard contractual clauses, or another lawful transfer mechanism, and, where the law requires, your explicit consent.

You are responsible for the legality of the data and third-party material you upload or enter (images, text, trademarks, and photos of people included). If you upload a photo or personal data of another person, you must have the right to upload and process it, and that person's consent or another lawful basis.

We may disclose data to public authorities and courts where the law or a valid legal request requires it, and where necessary to protect our rights, the security of the service and other users. Disclosure is limited to what the request or purpose requires.

Content that violates our Terms of Service may be removed, and depending on the violation, the account may be suspended or terminated.

Connecting an account is optional and done through the platform's own authorization screen (OAuth); we never see your password.

Permissions requested: TikTok user.info.basic, video.upload, video.publish; Instagram instagram_business_basic, instagram_business_content_publish.

We store your account ID, username, display name, avatar and the access and refresh tokens. Tokens are encrypted at rest with AES-256-GCM and used only on our server.

We only upload or publish content that you created and scheduled in SlideBase, with the caption, privacy and disclosure settings you chose. We do not read your messages, followers or other posts, and never post anything without your action: TikTok posts are published only after you confirm them in our share dialog, and automations you turn on only send drafts to your TikTok inbox, which you review and post yourself in TikTok. Platform data is not sold or used for advertising.

You can disconnect the account in SlideBase, which deletes the stored tokens, or revoke SlideBase in your TikTok / Instagram settings. Instagram deauthorization and data-deletion requests are processed automatically. Your use of these platforms is also governed by their own terms and privacy policies.

We keep account data and projects while your account is active. Social tokens are deleted when you disconnect the account.

When you delete your account or ask us to, we delete, destroy or anonymize your personal data within 30 days, except records we must keep by law (such as order and invoice records), which are retained for the legally required period and then deleted or anonymized, and data needed to establish or defend legal claims for the applicable limitation period. Backups and logs are purged in their normal cycle.

We apply reasonable technical and organizational measures: all traffic is encrypted with TLS; access tokens and API keys are stored encrypted and server-side only; social tokens use AES-256-GCM; user data is access-controlled per account through authentication and authorization rules; and access to production data is limited to authorized personnel.

No system is perfectly secure, and you are responsible for keeping your account credentials confidential. If a breach affects your data, we will notify you and the competent authority as required by law.

We use strictly necessary cookies and browser local storage for sign-in sessions and security, and to remember your language, selected app and referral code. We may use basic usage analytics (Firebase / Google Analytics) to measure and improve the service. We do not use advertising cookies or cross-site tracking.

If you choose to enter your own AI provider keys, they are kept in your browser's local storage. You can clear or block cookies and site data in your browser settings, though sign-in may then stop working.

Under KVKK Art. 11 you may:

• learn whether your data is processed and request information about it;
• learn the purposes of processing and whether data is used accordingly;
• know the third parties to whom data is transferred in Turkey or abroad;
• request correction of incomplete or inaccurate data;
• request deletion or destruction under KVKK Art. 7, and ask that these actions be notified to recipients;
• object to a result against you arising from exclusively automated analysis;
• claim compensation for damage caused by unlawful processing.

Where the GDPR applies, you additionally have the right to access, rectification, erasure, restriction, data portability and objection (including to processing based on legitimate interests), and to withdraw consent at any time without affecting prior processing. You may lodge a complaint with the Turkish Personal Data Protection Board (KVKK) or your local supervisory authority.

To exercise your rights, email smartify04@gmail.com from the address registered on your account, stating the right and request clearly, or write to the address above. We reply free of charge within 30 days; a fee set by the Board may apply if the request requires extra cost. We may need to verify your identity first.

SlideBase is intended for people aged 18 and over. We do not allow accounts for anyone under 18 and do not knowingly collect their personal data. If you believe a minor has provided data, contact us and we will delete it within a reasonable time.

The service links to or integrates with third-party sites and services such as app stores, our payment provider, TikTok and Instagram. We are not responsible for their privacy practices; please review their policies.

We may update this policy to reflect changes in law, the service or our providers. The current version is posted on this page with the date above, and significant changes will be announced by email or in the app. Continued use after an update means you accept the updated policy.

Mehmet Tuna Arıkaya, Kepeci Mah. 1217 Sk. No: 8-10 İç Kapı No: 17, Merkez/Isparta, Turkey; smartify04@gmail.com. See also our Terms of Service.