KVKK Information Notice

Version and validity

• Version and effective date: 30 October 2026
• Last updated: 30 October 2026
• Data controller: CS Digital Wonders LLC ("CS Digital Wonders", "we"), a limited liability company organized under the laws of the State of Wyoming, USA, which operates SemPost. Address: 30 N Gould St Ste N, Sheridan, WY 82801, USA.
• How we announce changes: when we change this notice, we publish the current text on this page. Material changes that alter the purposes or legal grounds of processing are announced by email before the new processing starts . Changes are listed in the "Changes" section at the end of this page.
• Language: the original of this notice is in Turkish (/tr/legal/kvkk-notice). This English edition has the same content and is provided for readers who do not read Turkish.

1. About this notice

• This notice informs you how your personal data is processed, as required by Article 10 of Turkey's Personal Data Protection Law No. 6698 ("KVKK") and by the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ).
• This notice is not a contract. You do not need to accept or approve it; it is for your information.
• None of the processing described here is based on your explicit consent (açık rıza). If we ever want to carry out processing that requires explicit consent (for example sending commercial electronic messages, using non-essential cookies, or offering a feature that uses faces or voices), we will ask for your explicit consent with a separate text and a separate declaration. Not giving consent will not stop you from using the service, and you can withdraw consent at any time.
• Please read this notice together with our Privacy Policy, which gives the details.
• Scope: the SemPost app at app.sempost.ai, the Shopify app that runs inside Shopify admin from embed.sempost.ai, the websites www.sempost.ai and docs.sempost.ai, and the emails we send.

2. Data controller and contact

• Data controller: CS Digital Wonders LLC, a limited liability company organized under the laws of the State of Wyoming, USA
• Contact: [email protected]
• Postal address: CS Digital Wonders LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA
• Applications: directly to us, through the channels on our KVKK Application Form page.
• Data Controllers' Registry (VERBİS): if we register, this notice will be kept consistent with the information given to the registry.

3. Whose personal data we process

• Users: people who open an account in SemPost, belong to a workspace or own one.
• Invitees: people who are invited to a workspace.
• Shopify store owners and staff: people who open SemPost from Shopify admin.
• Form users: people who type an email address into our sign-up, sign-in or password forms (even if no account uses that address).
• Visitors: people who visit www.sempost.ai and docs.sempost.ai.
• Applicants: people who write to us, apply to us or complain.
• Payers: their payment data is processed by Link (Stripe) or Shopify on their own behalf (section 6).
• People whose data is in our customers' content: for their data we act as a processor on behalf of our customer (section 8).

4. Processing by purpose

For each purpose below we state the categories of personal data processed, the legal ground for the processing (KVKK Article 5(2)), how the data is collected, and to which groups of recipients it is transferred and why. The names of the data categories follow the categories used in the Data Controllers' Registry. We do not aim to process special categories of personal data (KVKK Article 6); SemPost has no feature that recognises people by their face or voice.

4.1 Opening and managing your account

• People concerned: users; Shopify store owners and staff.
• Data categories: identity (first and last name); contact (email address); customer transaction (interface language, theme, account status, last sign-in time, when you accepted the Terms of Service and which version, which announced change to the Terms we last emailed you about); transaction security (the Argon2id hash of the password, when the email address was verified).
• Legal ground: necessary for the conclusion and performance of a contract (Art. 5(2)(c)).
• Collection method: through the sign-up form, the acceptance of an invitation and the identity token given by Shopify, electronically and by automatic means.
• Transfers: to our hosting and email service providers, to provide the service; to Cloudflare for the bot check (sections 6 and 7).

4.2 Information security, account security and prevention of abuse

• People concerned: users; form users; visitors.
• Data categories: transaction security (IP address, browser information, session records, login attempts, hashes of email link tokens, the two-factor authentication secret and hashes of recovery codes, audit log entries, server logs); contact (the email address typed in a sign-in attempt).
• Legal ground: our legitimate interests, provided your fundamental rights and freedoms are not harmed (protecting accounts and the service against unauthorised access and abuse) (Art. 5(2)(f)); necessary to fulfil our data security obligation (KVKK Art. 12) and any obligation to keep traffic data (Art. 5(2)(ç)); for sessions, the performance of the contract (Art. 5(2)(c)).
• Collection method: from your browser and our servers, electronically and by automatic means.
• Transfers: to Cloudflare for network security and the bot check; to our hosting provider; to public authorities that are entitled by law, when they request it, to fulfil our legal obligations.

4.3 Managing the workspace, the team and invitations

• People concerned: users; invitees.
• Data categories: identity (name); contact (email address); customer transaction (the workspace's name, language, time zone and country, roles, the role offered in an invitation, who sent it, a hash of the invitation token and its expiry).
• Legal ground: performance of the contract (Art. 5(2)(c)); for invitees, legitimate interests (letting a workspace invite the people it works with) (Art. 5(2)(f)).
• Collection method: through the app; the invitee's email address from the inviting member; electronically and by automatic means.
• Transfers: to our email service provider, to send the invitation email. Members of a workspace see each other's name, email address and two-factor authentication status; owners and admins see members' IP addresses in shortened form in the audit log .

4.4 Providing the service: store connections, product data, content creation, scheduling, publishing and analytics

• People concerned: users; people whose data is in content (section 8).
• Data categories: customer transaction (store connection details, product data, posts and their options, comment-to-DM message text, brand settings, automation rules and their history, the username, display name and profile picture link of social accounts, post analytics and daily follower counts); visual and audio records (uploaded and AI-generated images, videos and voiceovers).
• Legal ground: performance of the contract (Art. 5(2)(c)). For the data of third parties in content, we act as a processor on behalf of our customer.
• Collection method: the app; stores' interfaces for apps; public product pages whose address you give us; social networks (through Zernio); outputs of AI providers; electronically and by automatic means.
• Transfers: to Zernio, to connect to social networks and publish; to AI providers (Anthropic, Google, and fal.ai with the developers of the models it offers), to create content; to Cloudflare, to store media; to the social networks you choose, to publish (as independent controllers).

4.5 Billing, plan and credit management; fulfilling financial obligations

• People concerned: users; payers.
• Data categories: finance (Stripe customer and subscription IDs, subscription status and period, the records of cancellations and the yearly renewal last reminded of, the amount and currency in billing alerts and, for a withdrawal, the refund due and the credits taken back, Shopify subscription and usage charge details, the credit ledger); customer transaction (plan, trial dates, billing channel). We do not process card data, billing addresses or tax IDs; Link collects them.
• Legal ground: performance of the contract (Art. 5(2)(c)); fulfilling our legal obligations under accounting and tax law (Art. 5(2)(ç)); our legitimate interests (controlling costs and preventing misuse of the free trial) (Art. 5(2)(f)).
• Collection method: the app; notifications and interfaces of Stripe and Shopify; electronically and by automatic means.
• Transfers: to Link (Stripe) and Shopify, for payment and billing (as independent controllers); if you ask for a refund after using credits, a summary of credit use to Stripe, so that it can assess the request.

4.6 Sending service emails

• People concerned: users; invitees.
• Data categories: identity (name); contact (email address); customer transaction (workspace name, links in the email; in billing emails, what was bought, renews, was withdrawn from or cancelled, with dates and amounts).
• Legal ground: performance of the contract (Art. 5(2)(c)); for security notices, legitimate interests (Art. 5(2)(f)).
• Collection method: the app; electronically and by automatic means.
• Transfers: to our email service provider Resend, to send the emails.
• We do not send commercial electronic messages (marketing emails). If this ever changes, we will first ask for your separate consent.

4.7 Keeping consent and acceptance records

• People concerned: users; Shopify store owners and staff.
• Data categories: legal transaction (when you accepted the Terms of Service, which version and where: at sign-up, when accepting an invitation or, for accounts opened from Shopify, through Shopify when the account was first opened , and again in the app after a material change to the Terms; before a purchase on our website (a plan, a credit pack or an extra social account), that you asked for the service to start at once and accepted what this means for your right of withdrawal and, where the purchase may be a consumer's in Turkey, that you confirmed reading the pre-contract information form and the distance service contract, with their version; a withdrawal made in the app: the name given, the purchase, the email address the acknowledgement went to, when it was confirmed and what followed; who gave permission for automatic YouTube uploads, when and with which text version; who gave permission for automatic Google Business Profile posts, when and with which text version; who confirmed that a YouTube channel does not publish content made for kids, and when; the choices made for direct posting to TikTok and that TikTok's declaration was seen); transaction security (the IP address and browser information recorded with each acceptance of the Terms, each confirmation given before a purchase and each withdrawal made in the app).
• Legal ground: fulfilling our legal obligations (Art. 5(2)(ç)); establishing, exercising or protecting a right (Art. 5(2)(e)); our legitimate interests (being able to prove consent, acceptance and withdrawal) (Art. 5(2)(f)).
• Collection method: the app; electronically and by automatic means.
• Transfers: none; in a dispute, to the competent courts.

4.8 Fulfilling legal obligations; answering requests from authorities and applications from data subjects

• People concerned: applicants; users.
• Data categories: identity; contact; legal transaction (applications, correspondence, our answers).
• Legal ground: expressly provided for by law (Art. 5(2)(a)); fulfilling our legal obligations (Art. 5(2)(ç)).
• Collection method: electronically by email and through the app; written applications sent by post are received by non-automatic means and filed.
• Transfers: to public authorities and courts that are entitled by law, when they request it.

4.9 Establishing, exercising and protecting rights

• People concerned: users.
• Data categories: transaction security (the audit log); finance (the credit ledger, billing alerts); customer transaction (post events). After deletion these records name the workspace only by its ID, and the deleted person's IP address and browser information are cleared .
• Legal ground: necessary to establish, exercise or protect a right (Art. 5(2)(e)); for accounting records, legal obligation (Art. 5(2)(ç)).
• Collection method: the app and our servers; electronically and by automatic means.
• Transfers: in a dispute, to the competent courts.

4.10 Operating the Shopify app

• People concerned: Shopify store owners and staff.
• Data categories: identity (first and last name); contact (the email address verified by Shopify); customer transaction (language, whether the person is the store owner, the store's address, name, time zone and Shopify ID, records of Shopify's privacy requests, a one-way digest of the store ID so that the trial is given only once per store).
• Legal ground: performance of the contract (Art. 5(2)(c)); our legitimate interests (preventing misuse of the free trial and proving that Shopify's privacy requests were answered) (Art. 5(2)(f)).
• Collection method: through Shopify's identity token and app notifications, electronically and by automatic means.
• Transfers: to Shopify, for the installation and billing of the app and to answer privacy requests. The app has no permission to read your stores' customer or order data.

4.11 Monitoring costs and service continuity

• People concerned: users.
• Data categories: customer transaction (cost records of AI operations with the provider's request ID); transaction security (application logs).
• Legal ground: our legitimate interests (controlling costs, finding faults and keeping the service running) (Art. 5(2)(f)).
• Collection method: our servers; electronically and by automatic means.
• Transfers: to our hosting provider.

4.12 Providing our websites

• People concerned: visitors.
• Data categories: transaction security (IP address, browser information); visit counts from Cloudflare Web Analytics, which does not use cookies.
• Legal ground: our legitimate interests (providing and improving our websites securely) (Art. 5(2)(f)).
• Collection method: from your browser, electronically and by automatic means.
• Transfers: to Cloudflare, to deliver and protect the sites and count visits.

4.13 Remembering your preferences

• People concerned: users.
• Data categories: customer transaction (preferences such as interface language, your browser's time zone, whether the sidebar is open, and your choices in forms).
• Legal ground: performance of the contract, to provide the service the way you chose (Art. 5(2)(c)).
• Collection method: cookies and browser storage; electronically and by automatic means. Details are in our Cookie Policy.
• Transfers: none.

5. Collection method and when you are informed

• We collect your personal data electronically and by automatic means, through the app, our websites, email, cookies, server logs and the interfaces of our service providers. Written applications sent by post are received by non-automatic means and filed.
• When we collect data directly from you, you can read this notice at the time of collection: the sign-up form has a separate information line that links to it .
• When we get your data from another source rather than from you (for example from the member who invites you, or from Shopify), you can read this notice at the first contact: through the link in the invitation email , and through the link at the bottom of every page of SemPost, which you see when you first open SemPost in Shopify admin .

6. Groups of recipients and purposes of transfer

• The current name of each provider, its country and the transfer safeguard are on our Sub-processors page.
• Have I Been Pwned receives only the first five characters of a one-way hash of a password; no password or personal data is sent.
• Members of a workspace see each other's name, email address and two-factor authentication status. This is part of the service within the team.
• If our company merges with another company, is acquired, or sells all or part of its assets, personal data may be transferred to the new owner as part of that transaction. We will inform you before this happens.

7. Transfers abroad

• Our servers are in the United States. All traffic passes through Cloudflare's network. Media files are stored in Cloudflare R2 without a fixed region, so Cloudflare chooses where to keep them, which may be outside Turkey and the European Union; database backups are also stored in Cloudflare R2, encrypted. Our service providers are also abroad. Your personal data listed in section 4 is therefore transferred abroad. The security cookies that Cloudflare uses on our sites are part of this transfer.
• We transfer data abroad under Article 9 of the KVKK, as amended by Law No. 7499, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad:
  • where the Personal Data Protection Board has made an adequacy decision for the country, the sector within the country or the international organisation, on the basis of one of the conditions in Articles 5 and 6 and that adequacy decision (Art. 9(1));
  • where there is no adequacy decision, provided that one of the conditions in Articles 5 and 6 exists, that you can also exercise your rights and seek effective legal remedies in the destination country, and that the standard contract announced by the Board is signed (Art. 9(4)(c)). The standard contract must be notified to the Authority within 5 business days of signature (Art. 9(5));
  • where there is neither an adequacy decision nor an appropriate safeguard, only occasionally and only in one of the cases listed in Article 9(6).

8. Data we process on behalf of our customers

• Content that our customers process in SemPost can contain other people's personal data: for example people on imported product pages, models in product photos, people named in a voiceover text, holders of connected social accounts, people in posts made outside SemPost, and people who receive a comment-to-DM message. Only Zernio keeps the list of people who received a comment-to-DM message; SemPost stores no data about commenters.
• For this data the data controller is our customer; we act as a processor on its behalf and on its instructions. Informing these people and having a legal ground for the processing are our customer's obligations.
• If you are one of these people, apply to the customer concerned to use your rights. If you apply to us ([email protected]), we will pass your request on to the customer.

9. Retention and destruction

• We keep your personal data only as long as is necessary for the purpose for which it is processed or as set out in the applicable legislation. When the period ends, a job that runs every day deletes, destroys or anonymises the data under Article 7 of the KVKK .
• Main periods: sessions that expired or were ended 30 days ; login attempts 90 days ; the audit log 2 years, with the IP address and browser information in it 1 year ; server logs until the server deletes them as it rotates its log files ; for a social account you disconnect, data received from LinkedIn at once and, for the other networks, the account's name, picture and analytics 7 days ; analytics from YouTube and Google Business Profile never older than 30 days ; backups about 4 weeks; acceptances of the Terms while your account exists; the confirmations given before a purchase, the withdrawals made in the app and the records of cancellations three years, and after your account is deleted without your name, email address, IP address and browser information. Account and workspace data are kept until you delete them .
• If a workspace has no open plan, for whatever reason (for example, the trial ended, the subscription was cancelled or a payment failed), and no member signs in or does anything in it for 150 days, we email its owners; if that is still the case on day 180, we delete the workspace .
• All periods are in section 16 of our Privacy Policy.

10. Explicit consent

• None of the processing described in this notice is based on explicit consent; therefore we do not ask you for explicit consent.
• If we start processing that requires explicit consent, such as commercial electronic messages, non-essential cookies or features that use faces or voices, we will ask for your explicit consent with a separate text and a separate declaration. Explicit consent is not a condition of the service, and you can withdraw it at any time.

11. Your rights

Under Article 11 of the KVKK, by applying to us as the data controller, you have the right to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of the processing and whether the data is used in line with that purpose,
• know the third parties in Turkey or abroad to whom your personal data is transferred,
• request correction if your personal data is incomplete or inaccurate,
• request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
• request that correction, deletion or destruction be notified to the third parties to whom your personal data was transferred,
• object to a result against you that arises from the analysis of your data exclusively by automated systems,
• claim compensation for damage you suffer because your personal data was processed unlawfully.

SemPost does not make decisions about you that are based solely on automated processing and have legal or similarly significant effects. You can use some of your rights directly in the app: you can delete your account and workspace and download your data ; you can correct your name, interface language and theme in your profile.

12. Applying to us

• You can apply in Turkish, through the channels listed in the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ). The channels, the information an application must contain and a form you can fill in are on our KVKK Application Form page.
• We conclude your application as soon as possible according to its nature, and within 30 days at the latest. We charge no fee for any application, even where the Board's tariff would allow one.
• We may ask for additional information to verify your identity.

13. Complaint to the Board

If your application is rejected, if you find our answer insufficient, or if we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days after you learn our answer, and in any case within 60 days after the date of your application (kvkk.gov.tr). You cannot complain to the Board without first applying to us.

Changes