SSepetbayım

Privacy Policy

Last updated: 2026-09-21

This Privacy Policy explains how Sepetbayım processes personal data when you use our free social media tools at https://sepetbayim.com.

This Privacy Policy was last updated on September 21, 2026.

By using our website, you acknowledge that you have read this Policy. Where required by law, we will ask for your consent separately (for example, for non-essential cookies).

1. Data controller and contact details

For the purposes of applicable data protection laws, the data controller is:

Sepetbayım, Türkiye

If you have any questions or wish to exercise your privacy rights, you can contact us at:

We do not provide customer support via phone or postal mail. Please use email for all privacy-related requests and include the subject line: “Data Request”.

2. What data we collect (and what we do NOT collect)

Sepetbayım is designed to operate on minimal personal data. We intentionally avoid collecting data that is not necessary for providing and protecting our free tools.

2.1 Personal data we collect

When you use our tools, we collect and process the following information:

  • Hashed IP address
    • We receive your IP address as part of normal internet communication.
    • We store only a SHA‑256 hash of your IP, not the raw IP address.
  • Hashed device fingerprint
    • We generate a simple fingerprint by combining your IP address + browser User‑Agent string.
    • We then store only a SHA‑256 hash of this combination.
  • Submitted public profile / post link (hashed)
    • You paste a public profile or post URL (for example from Instagram, TikTok, Twitter/X, YouTube).
    • We store only a SHA‑256 hash of that URL for abuse prevention and rate limiting.
  • Order timestamp
    • The date and time when you submit a tool request.

We do not attempt to reverse these hashes, and they are used only as technical identifiers to distinguish requests, prevent abuse, and operate rate limits.

2.2 Data we do NOT collect

Sepetbayım does not collect or store:

  • No name or username
  • No email address
  • No phone number
  • No payment or financial information
  • No social media passwords or login credentials
  • No physical address or precise location data
  • No user account data (we do not have a registration or login system)
  • No direct identifiers such as national ID numbers, passport numbers, or similar

Any site that asks you for your social media passwords in connection with Sepetbayım is not operated by us and is likely a scam. We will never ask for your social media login details.

3. Why we process your data and legal bases

We process the limited personal data described above only for specific, lawful purposes. The legal basis depends on where you are located and which law applies (GDPR in the EU/EEA/UK, KVKK in Türkiye, CCPA/CPRA in California, and other applicable laws elsewhere).

3.1 Overview of purposes and legal bases

Purpose of processing Description Legal basis (GDPR / UK GDPR) Legal basis (Türkiye KVKK) Notes for CCPA/CPRA (California)
Abuse prevention and security Detecting and blocking bots, excessive or fraudulent use, and protecting the service from attacks Art. 6(1)(f) GDPR – legitimate interests in ensuring security and preventing abuse KVKK Art. 5/2(f) – legitimate interest of the controller Considered a “business purpose” (security) and not a sale; used only to protect the service
Enforcing daily rate limits Ensuring fair usage by allowing one order per tool per day per user Art. 6(1)(f) – legitimate interests in operating a fair, functional service KVKK Art. 5/2(f) – legitimate interest Business purpose for providing requested services and managing usage
Order fulfillment via SMM API partner Sending your selected public URL and quantity to our SMM API partner to deliver followers/likes/views Art. 6(1)(b) – performance of a contract (providing the service you requested) and Art. 6(1)(f) – legitimate interest KVKK Art. 5/2(c) – necessary for performance of a contract; Art. 5/2(f) – legitimate interest Business purpose for providing services requested by the user; not a sale
Aggregated statistics and analytics Understanding how tools are used, improving performance and reliability (e.g. via Google Analytics 4) Art. 6(1)(a) – consent (where required for cookies/identifiers); Art. 6(1)(f) – legitimate interests in analytics using privacy-friendly settings KVKK Art. 5/1 (consent) where required or Art. 5/2(f) (legitimate interest) May constitute “analytics”/“advertising” business purposes; we do not sell data
Advertising (Google AdSense) Showing ads to fund the free service; limiting frequency and measuring effectiveness Art. 6(1)(a) – consent for non-essential advertising cookies/identifiers; where consent is not required, Art. 6(1)(f) – legitimate interests in funding the service KVKK Art. 5/1 – explicit consent for advertising cookies where required May be treated as “sharing” for cross-context behavioral advertising; we do not sell personal information

Where we rely on legitimate interests, we always balance our interests against your rights and expectations and limit data to what is strictly necessary.

4. Cookies, analytics, and advertising

Sepetbayım is funded entirely by advertising and uses several third-party services that may place or read cookies or similar technologies in your browser.

4.1 Google Analytics 4 and Google Tag Manager

We use Google Analytics 4 (GA4) and Google Tag Manager to understand how visitors use our website in aggregate. GA4 may collect information such as:

  • Pages visited and actions taken
  • Browser and device type
  • Approximate region (based on Google’s own methods)
  • Referring website or campaign

Where required by law (for example, under GDPR/UK GDPR in the EEA/UK), we will only use non-essential analytics cookies with your consent. You can withdraw consent at any time via your browser or device settings, and we configure GA4 to use privacy-friendly settings where possible.

Google acts primarily as our processor for analytics, but may also act as an independent controller for its own purposes. Please see Google’s own privacy documentation for details.

4.2 Google AdSense

We use Google AdSense to display advertisements that fund our free tools. AdSense and related Google advertising products may:

  • Use cookies or mobile identifiers to deliver and measure ads
  • Perform interest-based or contextual advertising, depending on settings and legal requirements in your region

For EU/EEA/UK visitors, we rely on your consent for non-essential advertising cookies and identifiers where this is required by law.

For California residents, Google’s advertising technology may be considered “cross-context behavioral advertising” under the CCPA/CPRA. We do not intentionally sell or share your personal information as those terms are defined in the CCPA/CPRA, but Google may collect information as an independent business when ads are displayed. You can manage Google advertising personalization via your Google account and browser settings.

4.3 Cloudflare Turnstile and CDN

We use Cloudflare for content delivery (CDN) and Cloudflare Turnstile for bot protection. Cloudflare may set technical cookies or similar identifiers strictly necessary for:

  • Security and bot detection
  • Efficient content delivery

These are treated as essential and generally do not require consent under applicable laws.

5. Third-party recipients

We share limited data with the following third parties to operate the service:

  • Cloudflare – CDN and security/bot protection (including Turnstile). Receives IP addresses and technical request data as part of standard web delivery and security operations.
  • daosmm.com (SMM API partner) – Order fulfillment. Receives:
    • The public profile or post link you submitted (in plain form where required to fulfill your order)
    • The requested quantity (e.g. number of followers/likes/views)
    • We do not send your name, email, phone, payment information, or passwords, because we do not collect them.
  • Google Analytics 4 – Aggregated analytics about site usage. Receives pseudonymous usage data and cookie identifiers where applicable.
  • Google Tag Manager – Manages and deploys analytics and advertising tags. May facilitate data flows to Google services and other tools configured in Tag Manager.
  • Google AdSense – Advertising delivery and measurement based on cookies/identifiers where applicable.

Each of these providers processes data only for specified purposes, under their own terms and privacy notices. Google may act as an independent controller for certain advertising and analytics operations.

We do not sell or rent your personal data to third parties.

6. International data transfers

Sepetbayım is based in Türkiye and operates internationally. Depending on your location and the services you use:

  • Your data may be processed in Türkiye (by Sepetbayım and daosmm.com).
  • Your data may be transferred to the United States or other countries where Google and Cloudflare operate data centers.

For individuals in the EU/EEA or UK:

  • Türkiye and many other countries where our processors operate currently do not benefit from an EU/UK adequacy decision.
  • When transferring personal data outside the EU/EEA or UK, we rely on:
    • Standard Contractual Clauses (SCCs) or equivalent safeguards approved by the European Commission/UK authorities, where applicable, and/or
    • Article 49 GDPR derogations, such as the necessity of the transfer for performance of a contract at your request (providing the tools you choose to use) where appropriate.

Despite these safeguards, such transfers may carry a residual risk due to differences in local laws. By using Sepetbayım, you acknowledge that your data may be processed in these locations in accordance with this Policy and applicable law.

7. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy, and then delete or irreversibly anonymize it.

  • Order records and technical hashes (hashed IP, hashed device fingerprint, hashed URL, timestamp)

    • Retention period: up to 90 days from the date of your request
    • Purpose: abuse detection, security, and enforcement of daily rate limits
    • After 90 days, these records are purged.

  • Aggregated analytics data (GA4)

    • Retention period: according to Google’s default settings, currently up to 14 months (subject to change by Google and our configuration).
    • This data is aggregated and does not allow us to identify you as an individual.

If we are legally required to retain certain information for a longer period (for example, to comply with applicable law or to establish or defend legal claims), we will do so only for that limited purpose.

8. Your rights under data protection laws

Your rights depend on where you reside. We respect and aim to facilitate these rights for all users, even where not legally required, to the extent technically feasible.

8.1 Rights under GDPR / UK GDPR (EU/EEA and UK residents)

If you are located in the EU/EEA or the UK, you have the following rights in relation to your personal data:

  • Right of access – To obtain confirmation whether we process your personal data and to receive a copy.
  • Right to rectification – To request correction of inaccurate or incomplete data (to the extent we can identify and correct it).
  • Right to erasure (“right to be forgotten”) – To request deletion of your personal data in certain circumstances (for example, where it is no longer needed or you withdraw consent and no other legal basis applies).
  • Right to restriction of processing – To request that we limit processing in certain cases (for example, while we verify accuracy or respond to an objection).
  • Right to data portability – To receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where processing is based on your consent or a contract and is carried out by automated means.
  • Right to object – To object at any time, on grounds relating to your particular situation, to our processing based on legitimate interests; we will stop processing unless we have compelling legitimate grounds or need to continue for legal claims. You also have an absolute right to object to direct marketing.
  • Right to withdraw consent – Where we rely on your consent (for example for non-essential cookies or advertising), you may withdraw that consent at any time. This does not affect the lawfulness of processing before withdrawal.
  • Right not to be subject to solely automated decisions with legal or similarly significant effects – You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. Sepetbayım does not make such decisions.

You also have the right to lodge a complaint with your local supervisory authority:

  • United Kingdom: Information Commissioner’s Office (ICO)
  • EU/EEA: The data protection authority of your country of residence or work, or where you consider a violation has occurred

Contact information for these authorities is available on their official websites.

8.2 Rights under Türkiye KVKK (Türkiye residents)

If you are in Türkiye, your rights under the Law on the Protection of Personal Data (KVKK) include:

  • Learning whether your personal data is processed
  • Requesting information if your personal data has been processed
  • Learning the purpose of processing and whether it is used in line with that purpose
  • Knowing the third parties to whom your data is transferred, in or outside Türkiye
  • Requesting correction of incomplete or inaccurate data
  • Requesting deletion or destruction of data under the conditions set out in KVKK
  • Requesting notification of correction/deletion to third parties to whom data has been transferred
  • Objecting to unfavorable results arising from exclusively automated analysis of processed data
  • Requesting compensation for damages arising from unlawful processing

You may also file a complaint with the Kişisel Verileri Koruma Kurumu (KVKK Board) if you are not satisfied with our response.

8.3 Rights under CCPA/CPRA (California residents)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA:

  • Right to know/access – To request information about the categories and specific pieces of personal information we have collected about you, the sources, purposes of use, and categories of third parties to whom we disclose it.
  • Right to deletion – To request deletion of personal information we have collected from you, subject to certain exceptions (for example, for security or legal obligations).
  • Right to correction – To request correction of inaccurate personal information we maintain about you.
  • Right to non-discrimination – We will not discriminate against you for exercising your CCPA rights.
  • Right to opt-out of sale or sharing – To direct a business that sells or shares your personal information to stop doing so.

Sepetbayım does not knowingly sell or share your personal information as these terms are defined under the CCPA/CPRA. We do not exchange your personal data for money or other valuable consideration with third parties for their own marketing purposes.

However, third-party advertising and analytics providers (such as Google) may collect personal information directly from your browser or device when ads are shown or analytics are run. They act as independent businesses in relation to this data. You can limit such collection and use by:

  • Using your browser’s or device’s privacy settings (including blocking third-party cookies),
  • Using Google’s own privacy and ad-settings tools,
  • Enabling Global Privacy Control (GPC) signals where supported.

You also have the right to lodge consumer complaints regarding CCPA/CPRA compliance with the California Attorney General.

9. How to exercise your rights

To exercise any of the rights described above, please contact us at:

Please:

  • Indicate which right(s) you wish to exercise.
  • Provide enough information for us to reasonably verify that you are the person to whom the data relates (for example, the approximate date/time and type of request you made, and the profile/post link used, if applicable).

Because we store only hashed identifiers and do not maintain user accounts or direct identifiers, our ability to identify and locate your data may be technically limited. We will be transparent about any such limitations in our response.

Response times:

  • Under GDPR/UK GDPR and KVKK, we typically respond within 30 days, extendable where legally permitted and necessary due to complexity or volume.
  • Under CCPA/CPRA, we aim to respond within 45 days, extendable as permitted by law.

If we cannot honor your request due to legal or technical constraints, we will explain the reasons, unless we are legally prevented from doing so.

10. Security measures

We take appropriate technical and organizational measures to protect your personal data, including:

  • Encryption in transit – All communication with https://sepetbayim.com is protected by TLS (HTTPS).
  • Hashing of identifiers at rest – IP addresses, device fingerprints, and submitted URLs are stored only as SHA‑256 hashes, rather than plain-text values.
  • Data minimization – We collect and store only the minimum personal data needed to operate and protect the service.
  • Limited retention – Technical identifiers linked to orders are purged after 90 days.
  • Access controls – Access to data is limited to what is necessary for technical operation and security.

No system is completely secure, but we work to keep your data protected according to industry practices and applicable law.

11. Children’s privacy

Sepetbayım is not directed to children and is intended for use by individuals who can lawfully use online services without parental consent in their jurisdiction:

  • In many countries, this means 16 or older.
  • In the United States, including California, the relevant threshold under federal and state law is often 13 or older.

We do not knowingly collect personal data from children under these ages. If you believe that a child has provided us with personal data, please contact us at [email protected] so we can take appropriate steps, including deletion where required.

12. Automated decision-making and profiling

We do not use your personal data to make decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you.

We do perform basic automated checks for:

  • Bot detection and abuse prevention
  • Enforcing daily rate limits

These checks may block or limit use of the tools when abuse is suspected, but they do not produce legal effects in the sense contemplated by GDPR, UK GDPR, or KVKK and are limited to protecting our systems.

13. Complaints and supervisory authorities

If you have concerns about how we handle your personal data, we encourage you to contact us first at [email protected]. We will do our best to address your questions.

You also have the right to lodge a complaint with a data protection or consumer authority, in particular:

  • Türkiye:
    • Kişisel Verileri Koruma Kurumu (KVKK Board)
  • United Kingdom:
    • Information Commissioner’s Office (ICO)
  • EU/EEA:
    • The supervisory authority of your member state of residence, place of work, or place of alleged infringement
  • California (United States):
    • Office of the California Attorney General

Please visit the official websites of these authorities for up-to-date contact details and complaint procedures.

14. Changes to this Privacy Policy

We may update or amend this Privacy Policy from time to time, for example to:

  • Reflect changes in our services or technologies
  • Comply with changes in applicable laws or regulatory guidance
  • Improve clarity and transparency

When we make changes, we will:

  • Update the “last updated” date at the top of this Policy, and
  • Post the revised Policy at https://sepetbayim.com (or its localized equivalent if applicable).

Where required by law, we will inform you of material changes and, if necessary, obtain your consent again (for example for certain types of cookies or processing).

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

1,000 for just $2.99
Get it now