317ads Privacy Policy and KVKK Information Notice
Last updated: 3 October 2026
This English version is provided for convenience. If it differs from the Turkish original, the Turkish version prevails.
This document explains how your personal data is processed when you use the 317ads.com website (the "Site") and the 317ads advertising platform (the "Platform"), operated under the 317ads brand by Wemeep Teknoloji Limited Şirketi ("317ads", "we"). It constitutes an information notice under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK").
The Platform’s terms of use are set out in the Terms of Use, and the terms of sale for paid services are set out in the Distance Sales Agreement and the Delivery and Return Terms.
1. Data controller
The data controller under the KVKK is Wemeep Teknoloji Limited Şirketi.
- Trade name: Wemeep Teknoloji Limited Şirketi
- Brand: 317ads
- Address: Yiğitçavuş Mah. Silvan Blv. Dicle Teknokent No: 222, İç Kapı No: 1, Sur / Diyarbakır
- MERSIS number: 0801175518600001
- Tax office / number: Süleymannazif Vergi Dairesi / 8011755186
- Phone: 0850 305 54 80
- E-mail: hello@317ads.com
- Registered e-mail (KEP): wemeepteknoloji@hs01.kep.tr
2. Personal data we process
- Identity and contact: full name, email address, phone number; if you choose "Sign in with Google", your Google account ID.
- Account and business information: business name, industry, city, website, WhatsApp number and your brand kit (logo, colors, fonts, brand copy).
- Billing information: trade name, tax office and tax number (Turkish national ID number for sole proprietorships), billing address, phone number.
- Payment transaction information: the package purchased, amount, date, the outcome of the payment and the iyzico transaction number. Your card number, expiry date and security code (CVC) do not reach 317ads and are not stored.
- Meta connection information: encrypted access token; business portfolio, ad account, Facebook Page, Instagram account and pixel IDs; your Meta user ID.
- Advertising and content data: campaign plans, ad copy and images, the prompts you write in Studio and the images you upload, your competitor list, and the impression, click, spend and result reports read from Meta.
- Transaction security data: IP address, browser and device information, session records, login attempts and the audit log (which user performed which action, and when).
We do not collect the personal data of the people who see your ads; the reports from Meta are aggregated statistics. Responses to instant forms that the Platform sets up on Meta remain on Meta and in your account; the Platform does not read or store these responses.
When you merely visit the Site, we do not use analytics or advertising tools. Our infrastructure provider processes your IP address and browser information in its technical logs so that it can deliver your request and block attacks.
3. Collection method, purposes and legal grounds
We collect your data by partly or fully automated means: from the registration, sign-in, settings and payment forms; from the Meta and Google sign-in windows; from Meta’s official interfaces, with the authorization you grant; from the publicly available information on your website, Facebook Page and Instagram account, when you ask us to fill in your brand kit; from iyzico’s payment notifications; and from cookies.
| Purpose | Legal ground (KVKK Article 5(2)) |
|---|---|
| Opening your account, providing the Platform service, the Meta connection, ad and content generation, support | (c) Establishment and performance of a contract |
| Sale of paid services, collection and refund of payments, invoicing | (c) Performance of a contract; (ç) legal obligation |
| Retention of invoices and financial records, requests from competent authorities | (ç) Compliance with a legal obligation |
| Keeping the audit log, evidence in disputes | (e) Establishment, exercise or protection of a right |
| Account and infrastructure security, prevention of abuse and fraud | (f) Legitimate interest |
We do not send you marketing messages; if we wish to do so, we will first obtain your consent in accordance with Law No. 6563 on the Regulation of Electronic Commerce. Service messages such as email verification, password reset and order notifications are not covered by this.
4. Payment security
- Payments are collected through iyzico Ödeme Hizmetleri A.Ş., a payment institution licensed under Law No. 6493 on Payment and Security Settlement Systems, Payment Services and Electronic Money Institutions.
- You enter your card details directly into iyzico’s payment form. This information does not pass through 317ads servers and is not stored by 317ads.
- iyzico processes transactions on infrastructure that complies with the PCI DSS card security standard and, where your bank requires it, with 3D Secure authentication.
- iyzico is also subject to its own information notice with respect to payment data.
- All connections between you and the Site and the Platform are encrypted with TLS (HTTPS).
5. Use of artificial intelligence
- Suggestions for ad copy, images and performance commentary are generated with models hosted on Cloudflare Workers AI. The content of the request (brand information, prompt, required images) is sent to the model only for that task.
- AI requests pass through Cloudflare’s AI gateway; the gateway logs requests for operating the service and for debugging.
- We do not work with providers that demand perpetual rights over inputs and outputs for model training.
- The model does not make decisions on targeting, budget, schedule or campaign structure. No text or image goes live without your approval.
- Meta may display its own label on ads generated with AI.
6. Parties to whom data is transferred
| Recipient | Purpose | Data transferred |
|---|---|---|
| Meta Platforms, Inc. and Meta Platforms Ireland Ltd. | Setting up and publishing ads, reading reports | The ad content, budget, location and schedule you approve; Meta IDs |
| Cloudflare, Inc. | Hosting, database and file storage, email delivery, bot protection (Turnstile), AI models | Data held on the Platform, to be processed on our behalf and on our instructions |
| iyzico Ödeme Hizmetleri A.Ş. | Collection and refund of payments | The buyer information iyzico requires for the payment (full name, email, phone, billing address, IP address and, where iyzico makes it mandatory, ID number) and the amount; card details are entered directly into iyzico |
| Google LLC | Authentication, only if you choose "Sign in with Google" | The sign-in request; your name, email and account ID come from Google |
| OpenFreeMap | Displaying the map when you choose a location | Your browser’s IP address (the map request goes directly from your browser) |
| Certified public accountant (mali müşavir), auditors and competent public authorities | Legal obligations | To the extent the obligation requires |
We do not sell or rent your data, or give it to third parties for their advertising purposes.
7. Transfers abroad
Meta, Cloudflare and Google are established abroad and may process data on servers abroad. These transfers are made under Article 9 of the KVKK, relying on the appropriate safeguards provided for in the law, in particular the standard contracts announced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). Transferring ad data to Meta is necessary so that your ad can be published on Meta on your instructions. iyzico is established in Türkiye.
8. Retention periods
| Data | Period |
|---|---|
| Account, business, brand kit, advertising and content data | For as long as your account is open. When you delete your account, they are deleted immediately and permanently. |
| Meta access token | For as long as the connection lasts. When you remove the connection, it is deleted and the app’s permission on Meta is revoked. |
| Audit log and AI call logs | For as long as your account is open; deleted together with the account. |
| Session record (IP address, browser) | A session is valid for 14 days. The record is deleted when you sign out; for sessions left open, it is deleted together with the account. |
| Login attempts | 24 hours |
| Email verification and password reset codes | Valid for 30 minutes. |
| Infrastructure backups | Deleted data remains in the database’s restore records for at most 30 days and is then deleted automatically. |
| Deletion record | The confirmation code, the source of the request and its dates; for requests coming from Meta, the user ID Meta assigns specifically to this app. Retained so that we can show the request was fulfilled; it does not hold names, email addresses or content. |
| Invoices and financial records | 10 years (for accounting records) under the Tax Procedure Law No. 213 (Vergi Usul Kanunu) and the Turkish Commercial Code No. 6102 (Türk Ticaret Kanunu) |
9. Deleting your data
- From the Platform: Settings › Account › Delete account and data. Deletion takes effect immediately; before that, you can download all of your data as a JSON file from the same place.
- From Meta: when you remove the app in your Meta account settings, Meta sends us a signed deletion notice; your data is deleted automatically, and you can track the status on the Data deletion page with your confirmation code.
- In writing: you can write to hello@317ads.com or to our KEP (registered electronic mail) address. Your request will be resolved within 30 days at the latest.
Your ad account, campaigns and spend records on Meta belong to you; they remain on Meta and are deleted through Meta’s interface.
10. Cookies
We use only cookies that are strictly necessary for the Site and the Platform to work. We do not use analytics, advertising or third-party tracking cookies; for this reason, we do not ask for your explicit consent for cookies. You can delete or block cookies in your browser; if you block the strictly necessary cookies, you will not be able to sign in to the Platform.
| Cookie | Purpose | Duration |
|---|---|---|
sid | Keeps your session open | 14 days |
lang | Remembers your language preference | 1 year |
auth_chal | Completes the 317 team’s two-step sign-in verification | 10 minutes |
meta_oauth_state, meta_signup_via | Blocks forged requests when you connect with Meta; records which button the sign-up started from | 10 minutes |
meta_pending_login | Completes your selection if there is more than one ad account when you sign in with Meta | 10 minutes |
google_oauth | Blocks forged requests when you sign in with Google | 10 minutes |
In addition, your browser’s local storage holds only whether the sidebar is open or closed and your column preferences for the campaign table; this information is not sent to the server.
11. Security measures
- All connections are encrypted with TLS (HTTPS).
- Meta access tokens are stored encrypted with AES-256-GCM, are never sent to the browser under any circumstances and are used only on the server.
- Every Meta call made from the server carries an app signature (appsecret_proof).
- Passwords are stored hashed with PBKDF2-SHA256; not even we can see your password.
- Every query is limited to your own account; one account’s data does not appear in another account.
- Every write action performed on your behalf is recorded in the audit log.
- Login attempts are limited; the 317 team’s sign-ins are protected by two-step verification.
12. Your rights and how to apply
Under Article 11 of the KVKK, you have the following rights:
- To learn whether your personal data is processed
- If it has been processed, to request information about it
- To learn the purpose of the processing and whether the data is used for that purpose
- To know the third parties to whom it is transferred in Türkiye or abroad
- To request its correction if it is incomplete or inaccurately processed
- To request its erasure or destruction within the framework of the conditions in Article 7 of the KVKK
- To request that the correction, erasure or destruction be notified to the third parties to whom the data was transferred
- To object to an outcome against you arising from analysis of the data exclusively by automated systems
- To claim compensation for damage if you suffer damage due to unlawful processing
You may submit your application, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), in writing to our address, to our KEP address (wemeepteknoloji@hs01.kep.tr), with a secure electronic signature or mobile signature, or from your email address registered on the Platform to hello@317ads.com. Your application will be resolved free of charge within 30 days at the latest; if the process requires an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, you find the response inadequate, or no response is given in time, you may file a complaint with the Personal Data Protection Board.
13. Children
The Site and the Platform are intended for persons who have reached the age of 18 and for businesses. We do not knowingly process personal data belonging to children.
14. Changes
We may update this document. We will send notice of significant changes to your email address registered on the Platform. The date at the top of the page shows the last update.