Data Protection Notice

Last updated: September 21, 2026

This Data Protection Notice explains, in practical terms, how Sepetbayım protects your personal data and how you can exercise your privacy rights when using https://sepetbayim.com.

Data controller: Sepetbayım, Türkiye

If you have any questions about privacy or data protection, you can contact us at [email protected].

What this notice covers

This notice complements our Privacy Policy by focusing on:

• The limited data we process when you use our free social media tools
• How we protect this data and how long we keep it
• Your rights under applicable data protection laws (including GDPR, UK-GDPR, CCPA/CPRA and Türkiye KVKK)
• How to contact us or a supervisory authority

For full details of our processing activities, please also read our Privacy Policy.

What data we process and for what purposes

When you use Sepetbayım, we do not ask for or collect your name, email, phone number, passwords, payment details or social media login credentials.

We process only a small set of technical and usage data so our free tools and advertising-supported model can function, including:

• IP address (hashed with SHA-256)
• Device fingerprint (a SHA-256 hash generated from your IP address and browser User-Agent)
• Submitted public profile or post link (hashed)
• Order timestamp and tool usage (e.g., 1 use per day)

We use this information to:

• Run and secure the site (via Cloudflare and Turnstile bot protection)
• Prevent abuse and fairly apply our 1-use-per-day limits
• Fulfil free orders through our SMM API partner (daosmm.com)
• Measure basic, aggregated usage via Google Analytics 4 and support advertising via Google AdSense and Google Tag Manager

Order records used for anti-abuse and rate limiting are purged after 90 days. Aggregated analytics data may be kept according to Google Analytics’ default retention settings.

Your privacy rights

The privacy rights available to you depend on where you live. Regardless of your location, Sepetbayım aims to honor reasonable requests consistent with applicable law.

Rights that generally apply to all users

Subject to legal limitations, you may have the right to:

• Access: Ask whether we process your data and receive a copy of relevant personal data we hold about you (where identifiable).
• Correction: Request that we correct inaccurate personal data, if any.
• Deletion: Request deletion of personal data, particularly where we no longer need it for our legitimate purposes.
• Restriction/objection: Object to certain processing or ask us to restrict how we use your data, especially for profiling or where we rely on legitimate interests.
• Portability: Where technically feasible and legally required, receive data you provided to us in a structured, commonly used format.

Because we store core identifiers only as hashes (not directly identifiable data), we may ask you for technical details (for example, the exact link and time of use) to locate any data related to your use.

GDPR / UK-GDPR (EU/EEA and UK users)

If you are in the EU/EEA or the UK, additional rights under the GDPR or UK-GDPR may apply, including:

• Right to withdraw consent where we rely on consent
• Right to lodge a complaint with a supervisory authority

You can contact:

• In the UK: the Information Commissioner’s Office (ICO)
• In the EU/EEA: the supervisory authority of your country of residence or workplace

CCPA/CPRA (California residents)

If you are a California resident, the CCPA/CPRA may grant you specific rights, including:

• Right to know the categories of personal information we collect, use, disclose and, where applicable, “sell” or “share”
• Right to access and obtain a copy of personal information, where it is reasonably linkable to you
• Right to deletion of personal information, subject to statutory exceptions
• Right to correct inaccurate personal information
• Right to limit the use and disclosure of sensitive personal information (where applicable)
• Right to opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising, where our use of advertising and analytics cookies is interpreted as such

Sepetbayım does not collect traditional identity data (such as names or accounts), but advertising and analytics data may, under California law, be treated as a “sale” or “sharing” of personal information. You can contact us to exercise these rights, and you may also manage interest-based advertising preferences via your browser or ad settings.

You also have the right not to be discriminated against for exercising your CCPA/CPRA rights.

Türkiye KVKK (Türkiye residents)

If you are resident in Türkiye, you have rights under Law No. 6698 on the Protection of Personal Data (KVKK), including:

• Learning whether your personal data is processed
• Requesting information about processing
• Learning the purposes of processing and whether data is used in line with those purposes
• Knowing third parties to whom data is transferred, at home or abroad
• Requesting correction, deletion, or destruction of personal data in the circumstances defined in KVKK
• Objecting to results arising from automated processing

You can also lodge a complaint with the Kişisel Verileri Koruma Kurumu (KVKK Board).

How to exercise your rights

To exercise any privacy rights or ask a question about this notice, contact us at:

Email: [email protected]

Please describe your request in sufficient detail (for example, the tool you used and approximate date and time). We may request additional information solely to verify and process your request, in line with applicable law.

We will respond within the timeframes required by the laws that apply to you (for example, GDPR, UK-GDPR, CCPA/CPRA, KVKK), and in all cases as promptly as we reasonably can.

Supervisory authorities

You have the right to lodge a complaint with a data protection or consumer authority in your region. This may include, for example:

• California (USA): California Attorney General (for CCPA/CPRA)
• United Kingdom: Information Commissioner’s Office (ICO)
• EU/EEA: The data protection authority of your EU/EEA member state
• Türkiye: Kişisel Verileri Koruma Kurumu (KVKK Board)

We encourage you to contact us first so we can try to resolve your concerns directly.

International scope and applicable law

Sepetbayım is based in Türkiye and operates internationally online. When you use our services, your data may be processed in or transferred to Türkiye and other countries where our service providers (such as Cloudflare and Google) operate. We rely on appropriate contractual and technical safeguards consistent with applicable data protection laws.

This notice is governed by the laws of the Republic of Turkey, and disputes are subject to the jurisdiction of the courts of Istanbul, except where mandatory local consumer-protection or data-protection law in your country of residence provides otherwise.

Changes to this notice

We may update this Data Protection Notice from time to time, for example to reflect legal or technical changes. When we do, we will revise the “Last updated” date at the top of this page. Continued use of https://sepetbayim.com after an update means you acknowledge the revised notice.