Privacy Policy
This policy explains which personal data we process when you use Mecrio, for which purposes and on which legal bases, who we share it with, and how long we keep it. It is written to meet our transparency duties under Turkey's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
1. At a glance
- We never sell or rent your personal data and we build no advertising profiles about you.
- We access your ad accounts only as far as you authorise us to. When you disconnect, we try to revoke the token at the network and then delete our record of it.
- AI generation and analysis run on our own provider accounts; we never ask you for a key. Content goes only to the provider that does the work.
- There are no advertising or tracking cookies. The one third-party measurement tool is Google Analytics, and we explain below how to turn it off.
- We do not collect personal data about the people who see your ads: from the networks we only pull aggregate figures that cannot be traced to an individual.
This section is a summary only; the full text below is what binds us.
2. Scope, controller and our roles
This policy covers the Mecrio web application and related services offered at mecrio.com (together, the “Service”). The party acting as data controller under both KVKK and GDPR is Mecrio (“we”). Contact details are in the last section.
We act in two different roles. For your account, your business profile, security and the operation of the Service, we determine the purposes and means — there we are the controller. For the content you put into your projects, your ad copy and creatives, your targeting choices and the data pulled from your connected ad accounts, you determine the purpose; we process that data on your instructions in order to provide the Service to you. You remain responsible for the lawfulness of that content and for any information duties you owe to third parties.
The rules of use are set out separately in the Terms of Service.
3. Personal data we process
We process only what is needed to run the Service, keep it secure and meet our legal obligations:
| Category | Content | Source |
|---|---|---|
| Account and identity | Email address, password (stored irreversibly by Supabase Auth — we cannot read it), name, profile picture, interface language and currency preference | From you at sign-up; name and picture come from Google if you sign in with Google |
| Business profile | Business name, sector, business size, phone number in international format and where you heard about us. Collected in the mandatory setup step after sign-up; the phone number is unique per account | From you |
| Project and brand data | Project name and description, sector, website address, brand voice and tone, words to avoid; plus the brand profile derived from analysis (summary, audience, products, colour palette, design language, keywords, competitors) | From you + automated analysis of your website |
| Campaign data | Campaign names, objectives, budget and currency, targeting choices, status, the campaign identifiers held by the platform, and performance figures | From you + your connected ad accounts |
| Creatives and media | Ad headlines, body copy and calls to action; images and videos you upload or generate, with their dimensions, format and duration | From you + AI generation |
| AI records | The prompts you send, analysis inputs and outputs, agent chat messages, the model and prompt version used, and per-request token / image / second counts with estimated cost | While you use the Service |
| Platform connections | The connected ad account's id and name, the list of accounts available to you, the permissions you granted, platform-specific settings (for example the page used for publishing), and OAuth access/refresh tokens with their expiry | From the platform when you connect |
| Subscription record | Your plan, billing period, trial and renewal dates, subscription status and the transaction id returned by the payment provider (card data never reaches us) | From the payment provider when a subscription starts |
| Team data | Email addresses of the people you invite, their roles, and the scope and status of the invitation | From you |
| Activity log | Which user did what in which project (publish, analyse, generate), the model and prompt version used, the timestamp and the user's email address | Automatic |
| Feedback | The message you send, its type and the page it was sent from | From the feedback form |
| Early access request | Name, email, company and website, monthly ad budget range, how you heard about us, your note and the form language; plus browser information and the referring address if present | From the early access form |
| Account security records | When your account was created and when you last signed in, how many times you have signed in, which method you used (email or Google) and your email confirmation status; the IP address used at sign-up and at your last sign-in, the approximate location derived from it (country, region, city, time zone) and your browser signature | Automatic |
| Technical records | Request logs and error traces produced by our hosting provider; an irreversible hash of your IP address used to enforce abuse limits (the address itself is not stored in those counters); and the verification result produced by the bot protection on the sign-in, sign-up and password reset pages | Automatic |
What we do not collect. We neither process nor store card data: subscription payments are collected by the payment provider and card details never reach us. We do not pull personal data about the people who see your ads or fill in your forms: for lead forms we read only the form’s name and id, never the submitted records. We do not ask for special categories of personal data (health, beliefs, biometrics and the like) and we expect you not to enter them into the Service.
4. Data from your connected ad accounts
Mecrio can currently connect to these ad networks: Meta Ads, Google Ads, Microsoft Ads, TikTok Ads, LinkedIn Ads, X Ads, Reddit Ads, Pinterest Ads, and Snapchat Ads. The connection is made through the platform’s own consent screen (via OAuth): your platform password never reaches us.
The platform itself shows you which permissions you are granting. Broadly, the access we ask for covers:
- Listing the ad accounts you can reach so you can pick one,
- Reading campaigns, ad sets and ads, and — on your instruction — creating, updating, pausing or removing them,
- Reading performance reports (aggregate figures such as impressions, clicks, spend and conversions),
- Listing targeting options, conversion tracking assets and lead forms,
- On some networks, reading and publishing the organisational assets an ad technically needs in order to run (such as a page, an organisation account, a board or a post).
How tokens are protected. Access and refresh tokens are held server-side only, are never sent to your browser, and are refreshed in the background when they expire. When you disconnect, we attempt to revoke the token at the platform and then delete the record. Campaign and report data already pulled remains in your project; you can remove it by deleting the campaign or the project.
We do not sell data obtained from ad platforms, do not combine it with other users’ data, and do not use it for any purpose beyond the reports and AI suggestions we show you. Each platform’s developer terms require the same.
5. Google Analytics and Search Console data
When you connect Google Analytics or Google Search Console to a project, the connection is made on Google’s own consent screen and we ask for read-only access: viewing and downloading your data for Google Analytics, and viewing the data of your verified sites for Google Search Console. Mecrio never changes any setting in these services.
What we read and store:
- The list of properties and sites you can access (so you can pick one), and the selected property’s name, time zone, currency, key event names and Google Ads link information,
- Google Search Console: your site’s daily clicks, impressions and average position in Google Search (broken down by device and country), and the most-clicked search queries, pages, countries and devices of the last 28 days,
- Google Analytics: your site’s daily sessions, engaged sessions, key events and revenue (broken down by traffic channel), the rows that match the tracking tags of campaigns you published from Mecrio, and the most-visited landing pages of the last 28 days.
These are aggregate numbers provided by Google; we don’t request or store data that identifies your visitors individually, or demographic information.
How we use it. We use this data to show it to you in Reports, Overview and the “Results on your site” section of a campaign, and — when you ask Mecrio AI a question or prepare a campaign — to give the answer your project’s context; in that case the relevant summary is sent to the provider listed in the AI section above. We don’t sell the data we receive from Google, use it to show ads, blend it with other users’ data, or use it to train AI models; we use it only within your project, for the features we show you.
Retention and deletion. Daily numbers are kept for up to 400 days, the last-28-day lists for up to 120 days and sync records for 30 days; anything older is deleted automatically every night. When you disconnect, all Google Analytics or Google Search Console data of that project and its access credentials are deleted immediately. You can also remove Mecrio’s access from your Google Account’s linked apps page; this also turns off the Google Ads connection made with the same Google account.
6. AI: inputs, outputs and providers
AI work in the Service runs on Mecrio’s own provider accounts; we never ask you for an API key and never store one. Data reaches a provider in two places:
- Generation and suggestions. During copy, image and video generation and the agent chat, your prompts, brand context, chosen reference images, relevant campaign data and chat history are sent to the model of the provider doing that work.
- Project analysis. In the deep analysis that runs when you first set up a project, the website address you give is opened in a real browser; the page text and a screenshot, together with the logo and images you uploaded, are sent to a multimodal model in order to derive your brand profile.
The providers in use today: Anthropic, Higgsfield, OpenAI, and Google.
The provider contracts are ours. We aim to run with these providers on API terms under which inputs and outputs are not used for model training. If a provider’s terms change, we update the list and this text; no separate contract is formed between you and a provider.
No automated decision-making. Copy, images, targeting and budget suggestions produced by AI are suggestions; none of them is applied or published without your approval. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of KVKK art. 11(g) and GDPR art. 22.
7. Purposes and legal bases
We determine a legal basis for each processing activity separately; we do not fall back on consent for everything.
| Purpose | Example | Legal basis |
|---|---|---|
| Opening your account and providing the Service | Sign-up and sessions, creating projects and campaigns, generating creatives, publishing and reporting on connected accounts | Formation and performance of a contract — KVKK art. 5/2-c · GDPR art. 6(1)(b) |
| Mandatory business setup | Collecting business details and a phone number; keeping accounts unique | Performance of a contract — KVKK art. 5/2-c · GDPR art. 6(1)(b) |
| AI generation and project analysis | Passing your prompts to the provider, reviewing your website, deriving the brand profile | Performance of a contract — KVKK art. 5/2-c · GDPR art. 6(1)(b) |
| Transactional email | Verification, password reset, team invitations, welcome and application confirmation messages | Performance of a contract — KVKK art. 5/2-c · GDPR art. 6(1)(b) |
| Handling early access requests | Recording your request, getting back to you, sending an invitation | Steps taken at your request prior to a contract — KVKK art. 5/2-c · GDPR art. 6(1)(b) |
| Security and abuse prevention | Session validation, access control, bot protection on sign-in pages, daily usage limits, rate limiting via a hashed IP, keeping account sign-in records, activity logging | Legitimate interests — KVKK art. 5/2-f · GDPR art. 6(1)(f) |
| Improving the Service and fixing faults | Reviewing feedback and error records | Legitimate interests — KVKK art. 5/2-f · GDPR art. 6(1)(f) |
| Measurement | Measuring how many visitors arrive and where they drop off (Google Analytics) | Requires consent — KVKK art. 5/1 · GDPR art. 6(1)(a). See the Cookies section |
| Legal obligations and protecting rights | Responding to lawful requests from authorities, preserving evidence in a dispute | Legal obligation — KVKK art. 5/2-ç · GDPR art. 6(1)(c); establishment and defence of legal claims — KVKK art. 5/2-e · GDPR art. 6(1)(f) |
Where we rely on legitimate interests we balance them against your rights and freedoms, and you have the right to object to that processing.
8. Cookies, local storage and measurement
We use no advertising, retargeting or behavioural profiling cookies. The cookies used on the site are:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sb-…-auth-token | Strictly necessary (first party) | Authenticating and keeping your session open | Until the session is renewed or you sign out |
| mecrio-lang | Strictly necessary / preference (first party) | Your interface language, so the page renders in the right language on the server | 1 year |
| sidebar_state | Preference (first party) | Whether the dashboard sidebar is open or collapsed | 7 days |
| _ga, _ga_… | Measurement (third party — Google Analytics) | Distinguishing visitors and sessions; page views and a few sign-up funnel steps | Set by Google; up to two years by default |
Being straight about measurement. We use Google Analytics 4, in the production environment only. What we measure is page views and whether a handful of steps — sign-in, sign-up and the early access form — were completed. Measurement cookies are not strictly necessary and the law requires prior consent for them; we are building a cookie preference panel to collect that consent. Until it ships, you can block measurement through your browser’s cookie settings or with Google’s official opt-out add-on; blocking it does not affect how the Service works. For how Google processes this data, see Google’s own explanation.
Bot protection. The security check that runs on the sign-in, sign-up and password reset pages may place a short-lived technical cookie depending on how it is used. That cookie serves security and is strictly necessary; it is not used for measurement or advertising.
Local storage. What we keep in your browser’s local storage is never sent to our servers and stays on your device: theme preference, currency preference, the open project and your project list, the project id created during setup, a pending team invitation, and the autosaved draft in the ad editor. You can remove these by clearing your browser data.
9. Who we share data with
Our infrastructure and service providers — they process your data only on our instructions, to provide services to us:
- Supabase — authentication, database, file storage and a single edge function. Privacy policy
- Cloudflare — hosting, content delivery, image optimisation, sending transactional email, rate-limit counters, the bot protection on our sign-in pages (Turnstile), and the browser service that opens your website during project analysis. Privacy policy
- Resend — fallback email provider used when sending through Cloudflare fails. Privacy policy
- Google — measurement (Google Analytics) and, if you use Sign in with Google, authentication. Privacy policy
- Our payment provider — collecting subscription payments and issuing invoices. Your card details go straight to the payment provider; only the subscription status and a transaction id come back to us. You can request the provider’s identity and privacy policy at info@mecrio.com.
Through actions you start, data is passed to:
- Ad platforms (Meta Ads, Google Ads, Microsoft Ads, TikTok Ads, LinkedIn Ads, X Ads, Reddit Ads, Pinterest Ads, and Snapchat Ads) — when you build or publish a campaign, its structure, targeting choices, ad copy and media files are sent to your connected ad account. From that point on, the relevant platform’s own terms and privacy policy apply.
- AI providers (Anthropic, Higgsfield, OpenAI, and Google) — when you start a generation or analysis, your prompts and the relevant context are sent to the provider used for that job. You do not choose the provider: which one runs is decided by the kind of work.
Other cases. We may share the minimum data required to respond to lawful requests from competent public authorities, to protect our rights, or to keep users safe. In a merger, acquisition or similar corporate transaction, data may pass to the acquirer provided the protections in this policy continue to apply; we would tell you beforehand.
We do not sell your personal data, do not disclose it to third parties for marketing, and do not operate as an ad network.
10. International transfers
The servers of our infrastructure providers, the ad platforms and the AI providers are located outside Türkiye. Your data is therefore transferred abroad.
Under KVKK. Article 9, as amended by Law No. 7499 and in force since 1 June 2024, sets a tiered order: first an adequacy decision by the Board; if there is none, appropriate safeguards provided by the parties (the standard contract published by the Board, binding corporate rules, a written undertaking, or an international agreement); and only if neither is available, the narrowly interpreted exceptional cases that may be relied on incidentally. The Board has not issued an adequacy decision for any country or sector to date. We therefore base our transfers on the appropriate safeguards in art. 9(2); where a standard contract is used, it is notified to the Board within five business days of signature.
Under GDPR. Chapter V applies to transfers outside the EU/EEA: we rely on a European Commission adequacy decision where one exists and otherwise on appropriate safeguards such as the Standard Contractual Clauses (SCCs).
Transfers to ad platforms and AI providers happen on your instruction and are largely governed by your own relationship with that provider; we recommend checking their policies for the transfer mechanisms they use.
11. Retention periods
We keep personal data for as long as it is needed for the purpose it was processed for, and afterwards only where a legal obligation or the establishment, exercise or defence of a legal claim requires it. In practice:
| Data | Retention |
|---|---|
| Account, business profile, projects, campaigns, creatives, media and AI records | For as long as your account is open. Deleted on your request; you can also delete individual projects, campaigns and creatives yourself |
| Platform connections and OAuth tokens | For as long as the connection lasts. When you disconnect we attempt to revoke the token at the platform and delete the record; tokens are in any case subject to the validity period the platform sets |
| Google Analytics and Google Search Console data | Daily numbers for up to 400 days, the last-28-day lists for up to 120 days, sync records for 30 days; when you disconnect, that project's data and access credentials are deleted immediately |
| Subscription record | For as long as the subscription lasts; after it ends, kept for the period required by commercial bookkeeping and tax law |
| Team invitations | Expire after 14 days if not accepted; the invitation record remains with its outcome and you can cancel it |
| Usage counters | Kept in daily windows so that daily limits can be enforced |
| Hashed IP address (rate limiting) | Only for the length of the counter window — at most 24 hours. The address itself is not stored |
| Account security records | Kept while your account is open; only the sign-up moment and your LATEST sign-in are stored — no sign-in history is accumulated. Deleted when your account is deleted |
| Server logs and error traces | Subject to our hosting provider's maximum 7-day log retention window |
| Activity log | Kept for account security and accountability; when your account is deleted, the identifying information in these records is removed as well |
| Early access requests | For as long as the early access programme runs; deleted earlier on your request |
| Feedback messages | Until reviewed and closed; may be kept briefly afterwards as a product development record |
Backups. Deleted data may remain in backups for a short period until our providers’ routine backup cycle completes. Those backups exist for disaster recovery only; we do not restore a deleted record from a backup.
12. Security
- All traffic is encrypted with TLS.
- The database enforces row level security: each user can reach only the data of projects they own or are a member of. Team access is role-based (owner, admin, editor, viewer).
- OAuth tokens are held server-side only; the client layer has no read permission on them and they are never sent to the browser.
- Media files you upload or generate are stored in a non-public area; access is granted only through short-lived signed links.
- Passwords are stored irreversibly by our authentication provider; we can neither read nor change them.
- The activity log is kept in a form that cannot be altered or deleted afterwards.
- The sign-in, sign-up and password reset pages are protected by bot protection (Cloudflare Turnstile). During verification your IP address and basic browser signals are sent to Cloudflare; per the provider’s own statement this data is processed for security only and is not used for advertising or user tracking. This step is necessary to stop brute-force attempts and automated account creation.
No system is completely secure. If we detect a personal data breach we notify the Turkish Data Protection Board under KVKK art. 12(5) as soon as possible (as a rule within 72 hours, per the Board’s decision) and inform the affected individuals; under GDPR we notify the competent supervisory authority under art. 33 and, where required, the affected individuals under art. 34.
13. Your rights and how to use them
Under KVKK art. 11, by applying to the data controller you have the right to:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether the data is used accordingly,
- Know the third parties in Türkiye or abroad to whom your data is transferred,
- Request correction of incomplete or inaccurate data, and that this be notified to the third parties it was transferred to,
- Request erasure or destruction under the conditions in KVKK art. 7, and that this be notified to the third parties it was transferred to,
- Object to an adverse outcome produced solely by automated analysis,
- Claim compensation for damage suffered because of unlawful processing.
If you are in the EU/EEA, under GDPR you additionally have the rights of access (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20), objection to processing based on legitimate interests (art. 21), and withdrawal of consent where processing is based on it. Data portability is not separately listed in KVKK; we apply it for our users covered by GDPR.
What you can do yourself. You can update your name, language and currency preference in Settings; change your password; cancel your subscription; disconnect platform connections; and delete projects, campaigns and creatives. To have your whole account deleted or your data exported, you need to send us a request at the address below — there is not yet a one-step account deletion control in the dashboard.
Send requests to info@mecrio.com. Once we have verified your identity we reply free of charge within 30 days at the latest under KVKK art. 13, and as a rule within one month under GDPR (extendable by two further months, with notice to you). None of these rights is absolute; if the rights of others or our legal obligations mean we cannot meet a request in whole or in part, we will explain why in writing.
Complaints. You can complain to the Turkish Data Protection Authority or, in the EU/EEA, to the supervisory authority of your country.
14. Email communications
We send you transactional email only: email verification, password reset, team invitations, the welcome message and confirmation of an early access request. These messages are part of how the Service works and carry no marketing content.
We do not send newsletters or promotional electronic messages. If we start to, we will obtain your prior consent as required by Turkish Law No. 6563 on the Regulation of Electronic Commerce and the Commercial Electronic Message Regulation, manage that consent through the national Message Management System (İYS), and include an easy opt-out in every message.
15. Children's privacy
The Service is intended for business use and is not offered to people under 18. We do not knowingly collect children’s data; if we learn that we have, we delete it without delay. If you believe we process data about your child, please contact us.
16. Changes to this policy
We may update this policy as the Service evolves or the law changes. The date of the current version is shown at the top of the page. We announce changes that materially affect you, in the app or by email, before they take effect. Continuing to use the Service after a change means you have read the current policy; where new processing requires your consent, that consent is obtained separately.
17. Contact
For any privacy question, request or application: info@mecrio.com
For the rules of use, see the Terms of Service.