Privacy Policy

Last updated: 2 October 2026

This policy explains which personal data is processed when you use ClientPoster, why it is processed and what your rights are. It is written to match what the software actually does.

1. Two distinct roles: controller and processor

ClientPoster touches two different kinds of personal data and its role in each is not the same. This distinction is the most important clause here.

For agency users' data we are the data controller. We process the name, email and session information of the people who create an account, sign in and use the service in order to provide the service itself.

For data belonging to the agency's own customers we are a data processor. The agency enters customer names, contact persons, emails and phone numbers at its own discretion; we store and process that data only on the agency's instructions. Legal responsibility for it rests with the agency.

2. What data we process

The list below is derived from the product's database schema; it is not a generic template.

• Account information — full name, email address, an irreversible hash of your password, your role, interface language and theme preference, last sign-in date and whether your account is suspended.
• Sign-in with Google — if you sign up or sign in with Google, we receive only your name, your email address and whether Google has verified that address. We never see your Google password; no other data in your Google account is requested and the access token issued by Google is not stored. An account opened this way has no password.
• Agency information — agency name, email, phone, address and tax number. These are required in order to issue invoices.
• Customer information entered by the agency — customer name, sector, contact person, email, phone and brand voice definitions.
• Session information — an irreversible hash of the token that identifies your session, the date it was opened, and the first 160 characters of the string your browser uses to identify itself. This exists so that you can list your open sessions and close them remotely when needed.
• Audit trail — who changed what and when in your account. This record is kept for security and accountability; the contents of free-text fields are never written into the audit trail.
• Commercial records — your subscription, credit ledger entries and issued invoices. The recipient details on an invoice are stored as they were at the moment the document was issued and do not change afterwards.
• Content and media files you generate — the brief you type into the wizard, the generated post texts, where applicable the generated images, and the reference images you upload for generation. Files are stored with our cloud storage provider in the European Union and are served only to signed-in users of the agency they belong to.
• No-login approval link: when your agency submits a content item for approval, the non-member recipient's e-mail address (entered by the agency), the IP address and browser signature at the moment the link is opened and a decision is made, the timestamp and the reason written are stored as approval evidence. This record is an evidence ledger proving who decided and on what; it is not modified and is not deleted even if the content is removed. A separate retention period for this data has not yet been defined.

3. Cookies

ClientPoster uses only cookies that are strictly necessary for the service to work. We use no advertising cookies, no tracking pixels and no third-party analytics tools.

• Session cookie — written when you sign in. It is encrypted and can be read only by the server; no script in the browser can access it.
• Preference cookies — your chosen interface language and light/dark theme. They contain no personal data.
• Sign-in with Google cookie — a single-use, encrypted cookie that proves the request started in this browser while you go to Google and back. It lives at most 10 minutes and is deleted on return.

If you reject the strictly necessary cookies you cannot sign in; this is a technical requirement of the service.

4. Who we share data with

We do not sell your personal data. Data is shared only to the extent the service requires it, and only with the parties listed below.

• AI providers — when you ask for content to be generated, the brief you write and the brand voice definitions are sent to the provider; if you pick a type with an image or a video, the same information also goes to the image or video provider. If you upload reference images, those images are also sent to the image or video provider; metadata such as location is removed before sending. The video provider keeps the request and the generated video in its own system for at most 55 days so that we can extend the video step by step. Your account details are not sent.
• Social media platforms — when you connect an account, authorisation happens on that platform's own screen and only the access required for publishing is stored.
• Google — if you choose to sign in with Google, your identity is verified on Google's own screen. We send no personal data to Google; only our application's identity and return address are passed.
• Payment provider (iyzico) — payment is taken on the payment provider's own screen. Your card number never reaches ClientPoster servers. If you choose to save your card, it is stored by iyzico; we keep only the card key issued by iyzico, encrypted, and use it for subscription renewals. The card brand and last four digits are shown in the panel.
• e-Invoice provider — invoice recipient details are transmitted in order to issue the official document.
• Email infrastructure — for delivering verification, password reset and invitation emails.
• File storage provider — your image, video and document files are stored in a cloud storage service located in the European Union; files are accessed over an encrypted connection.

Some of these providers are located abroad; the relevant data is transferred abroad only to the extent that service requires.

5. How long we keep data

Your account and agency data are kept for as long as your account is open. Invoices and commercial records are not deleted for as long as the applicable legislation requires them to be retained. Session tokens become invalid when they expire or when you sign out.

The content you generate is kept for the “content retention” period shown in the plan comparison. When that period ends, a daily cleanup job deletes your image, video and document files from storage; the post text, its details and the usage record remain. Reference images not used in a generation are deleted by the daily cleanup once 24 hours have passed; those in a saved draft are kept with the draft for at most 30 days, and those used in a generation for as long as the content they belong to. You can see the remaining time in the content list and on the content detail page. You can also delete content yourself at any time before the period ends.

6. How we protect data

• Your password is not stored — only an irreversible hash of it is kept. Not even we can see your password.
• The raw form of session and invitation tokens is not stored; only their hashes are held in the database.
• Social media access tokens are stored encrypted in the database.
• Generated images and videos are not held at a publicly reachable address. Every request first passes an authentication and authorisation check; a file is delivered only to users of the agency that owns it, or to the customer holding the approval link, through a signed link generated for that request and valid for a few minutes. Videos you share on the marketplace or allow to be shown on the home page are visible within the scope of that sharing.
• Each agency's data is separated at the database level; one agency's query cannot reach another agency's rows.
• All traffic is carried over an encrypted connection.

7. Your rights

In relation to your personal data you have the right to: learn whether it is being processed, request information about it, learn the purpose of processing, know the third parties to whom it is transferred domestically or abroad, request correction if it is incomplete or inaccurate, request its erasure or destruction, request that such actions be notified to third parties, object to an adverse outcome produced solely by automated analysis, and claim compensation if you suffer damage.

To exercise these rights you may contact us at the address below. Your request will be answered within the period required by law.

8. Contact

Legal name

Demircode - Bülent Demirhan

Address

Fatih Sultan Mehmet Mah. Balkan Cad. No: 62 A, Ümraniye / İstanbul

Tax office / number

Alemdağ / 2870099966

Email

info@demircode.com

Phone

0 (543) 326 47 77

9. Changes

This policy may be updated. We will inform you when a significant change is made; the date at the top of the page always shows the version in force.