Privacy Policy

01 In brief

• We do not use advertising or analytics cookies on the site; there are three cookies: the session cookie required for the security of the form, the preference cookie that remembers your language choice and the sign-in status cookie that determines whether the button at the top right reads “Sign in” or “My account”.
• You send us personal data only when you fill in the contact form or write to us by e-mail, telephone or WhatsApp.
• We do not sell your data and we do not transfer it to third parties for marketing purposes.
• You grant the authorisation to access your social media accounts and you may withdraw it at any time from the panel or from the settings of the platform concerned.
• For your request, you can refer to the your rights section, and you can write to hello@ayduke.com on any matter.

02 Data controller

Your personal data is processed by the following company, which provides the AYDUKE service:

You may send all your privacy-related requests to this e-mail address.

03 The data we process

Contact form

When you submit the contact form on the site, we process the following fields: full name, e-mail address, telephone number (optional), subject and your message. A record of the consent you give in order to submit the form is also kept.

In order to prevent misuse and to be able to verify the request, the date of submission and the IP address from which you connected are added to the notification e-mail generated by the form. These two items are not asked for in the form fields but are added technically; we wish to state this clearly here.

Session cookie

A session cookie is used for the security of the form. This cookie is not there to identify or track you, but to verify that the form submission is not forged (CSRF protection) and to ensure that what you have written is not lost if a submission fails. Details are on the Cookie Policy page.

Language preference cookie

The language code of the page you are viewing (for example en) is stored in your browser for one year. Its sole purpose is to take you to the address in the language you last used when you type the address without a language into the address bar. It is not linked to your identity and is not shared with third parties; if you block it, the site opens in Turkish, and no other function is affected. Details are on the Cookie Policy page.

Server logs

The server hosting the site keeps technical logs for each request, such as the IP address, date and time, requested address and browser information. These logs are necessary for security, debugging and the prevention of misuse.

Panel account and telephone verification

When you open a panel account, we process the following fields: full name, e-mail address, telephone number, company name (optional) and an irreversible hash of your password. Your password itself is not stored anywhere.

The telephone number is mandatory because it is used to verify your account: a one-time code is sent to your number by SMS and your account is activated when this code is entered. The code itself is not stored; only an irreversible hash of it is kept, and it expires shortly afterwards. To keep a record of the sending, the number to which the message was sent, the time of sending and the result are recorded.

Your number is also used to reset your password: at the "Forgot password" step you may enter your telephone number instead of your e-mail address, and the reset code is sent to that number. If the number is registered to more than one account, for security reasons no code is sent to any of them.

The following transactional notifications relating to your account may also be sent to this number: an alert that your password has been changed, notice that your subscription has been activated and a warning before your files are deleted. The channel through which these are sent (SMS, e-mail or both) is a manageable setting.

We do not send marketing or announcement SMS messages to this number; only transactional messages relating to your account are sent.

Panel and connected social media accounts

When you use the AYDUKE panel, your account details, the authorisation records of the social media accounts you connect to the panel, the posts you create, the media files you upload and your publishing calendar are processed for the purpose of providing the service. You grant the authorisation to access your social media accounts; you may withdraw this authorisation at any time from the panel or from the platform's own settings. Once the authorisation is withdrawn, AYDUKE cannot publish on that account.

Payment details

Plan and device fees are currently arranged by contacting you directly; no online payments are taken on the site. We do not ask for or store your card details on this site.

04 For what purpose and on what basis

• Responding to your request: the information you send via the form, e-mail, telephone and WhatsApp is used only to answer your question and to make you an offer. Basis: your explicit consent and pre-contractual discussions.
• Providing the service: the panel account, account connections, posts and calendar are processed for the performance of the contract between us.
• Verifying your account and recovering your access: when you open a panel account, a one-time verification code is sent by SMS to the telephone number you provide. The same number is also used to receive the reset code when you forget your password. The codes expire shortly afterwards, only their irreversible hashes are stored and the number of sends is recorded in order to limit misuse. Basis: the formation of the contract between us and our legitimate interest in account security.
• Transactional notifications: an alert that your password has been changed, notice that your subscription has been activated and a warning before your files are deleted are sent by e-mail and/or SMS. These are notifications required for running the service; they are not marketing communications and are not subject to consent. Basis: performance of the contract.
• Security and prevention of misuse: the session cookie, server logs, form submission time and IP address are processed for this purpose. The number of verification codes sent is also recorded in order to limit misuse. Basis: legitimate interest.
• Legal obligations: records required by our accounting, tax and retention obligations are kept.

We do not use your data for automated decision-making or profiling. We do not send marketing e-mails without your consent.

05 Who we share it with

We do not sell or rent your data or share it for advertising purposes. It is shared only with the service providers necessary for the service to operate, and only to the extent necessary:

• Hosting and e-mail infrastructure: the site and form notifications run on this infrastructure.
• SMS provider: in order to deliver verification codes, password reset codes and transactional notifications relating to your account, your telephone number and the message text are passed to an SMS service provider. The provider is given only as much data as is needed to send the message; it is not used for any other purpose.
• Social media platforms you connect: your posts are transmitted to the platform's own system with the authorisation you have granted. From that point on, the data is subject to the platform's own terms and privacy policy.
• External resources on the site: the interface library is loaded from a content delivery network (jsDelivr); when the promotional video is published, the player runs via YouTube's cookieless domain. Because it is your browser that makes these requests, your IP address is visible to the provider concerned. Details are in the Cookie Policy.
• Legal requirement: in the event of a duly made request from a competent public authority, data is shared only to the extent requested.

06 AI assistant and chat window

AYDUKE customers (businesses) may have messages received via social media direct messages, comments and the chat window they add to their own websites answered by the AI assistant (Agent). For these messages, the business concerned is the data controller; AYDUKE acts as a data processor on the business's instructions and solely in order to provide the service. For your rights in relation to such a chat, you may first apply to the business concerned; if you send your request to us, we will pass it on to the business.

• Data processed: the text of the message, the chat history, the address and language of the page on which the window was opened; if you fill in the contact form, your name and your e-mail address or telephone number.
• Technical record: with each message, your IP address, the source port of the connection and the time of the message to the second are recorded; when the chat begins, browser and operating system information (User-Agent), the screen resolution, time zone, platform and language preferences reported by your browser, and the approximate location (country, city) and internet service provider derived from the IP address are recorded. We do not request your device's location permission (GPS). Messages are automatically flagged for expressions such as insults, profanity, threats and attempted attacks.
• Purpose and legal ground of the technical record: prevention of misuse, use as evidence for the establishment, exercise or protection of a right in the event of an unlawful situation such as insults or threats (Art. 5(2)(e) of the Turkish Personal Data Protection Law No. 6698 (KVKK)), and responding to requests from competent judicial or administrative authorities (KVKK Art. 5(2)(ç)). This record is visible only in the panel of the business concerned and is not used for purposes other than these. For rate limiting, an irreversible digest of your IP address (keyed hash) is also kept.
• Purpose: to generate answers to your questions based on the information provided by the business itself, to transfer the chat to a member of the business's staff where necessary and to provide the business with conversation statistics. The assistant talks only about the business's own products and services.
• AI provider: in order to generate a response, the message text is sent to the AI service chosen by the business (currently OpenAI, USA). Card numbers, Turkish national identity (T.C. kimlik) numbers and IBANs are automatically masked before sending. Data sent to this service is not used for the provider's model training and is not included in the provider's stored records.
• The business's consent: the assistant does not operate unless the business has explicitly consented to messages being processed by AI; the date of consent is recorded.
• Retention: chats and their technical records are kept in the business's panel until the business deletes them or the account is closed.
• Recommendation: do not type special category or sensitive information such as card numbers, passwords, identity numbers or health information into the chat window.
• Booking form: if you book through the chat window or the business’s booking link, your name, phone number, email address if requested, the chosen service and the appointment time are passed to the business; SMS or email reminders may be sent. The business is also the controller for this data. For healthcare businesses the form has no free-text note field.

07 Transfers abroad

DURU AKADEMI LTD is a company incorporated in the United Kingdom; the servers of the hosting and e-mail infrastructure we use and of the social media platforms you connect may be located outside Turkey. For this reason, your data may be processed abroad so that the service can be provided.

In any such transfer, we take care to ensure that the conditions laid down by the applicable legislation are met and that contracts containing data protection commitments are concluded with service providers.

08 How long we keep it

• Contact form messages: kept for as long as the request requires and for no more than 24 months, then deleted.
• Server logs: kept for approximately 12 months.
• Chat window messages and their technical records (IP address, port, device and approximate location): kept until the business concerned deletes them or its account is closed.
• Session cookie: deleted when you close your browser.
• Language preference cookie: kept for one year; you can delete it at any time from your browser settings.
• Panel and account data: kept for as long as the service relationship continues. When the service ends, everything other than records subject to a legal retention obligation is deleted.
• Accounting and invoice records: kept for the period laid down by the applicable legislation.

09 Security

Some of the specific measures we take to protect your data:

• Forged request protection (CSRF token) and a bot filter (hidden field and submission time check) on form submissions.
• Limiting submissions repeated at short intervals from the same session.
• Setting the session cookie so that it cannot be read by JavaScript (HttpOnly) and is closed to cross-site submission (SameSite); when a secure connection is used, the cookie is sent only over an encrypted connection.
• Validating form fields on the server side and escaping them when they are output to the screen.
• Restricting access to corporate data and to the panel to persons who need it for their duties.

We know that no system is 100% secure. If we detect a situation affecting the security of your data, we will make the notifications required by the legislation and inform the affected users. If you notice a security issue, please contact us by writing to hello@ayduke.com.

10 Your rights

You have the following rights in relation to your personal data:

• To find out whether your data is processed and, if so, to request information.
• To find out the purpose of processing and whether the data is used in accordance with that purpose.
• To know the third parties, in Turkey or abroad, to whom the data is transferred.
• To request the rectification of incomplete or inaccurately processed data.
• To request the erasure or destruction of the data when the conditions are met.
• To request that rectification, erasure and destruction be notified to the third parties to whom the data has been transferred.
• To object to processing and to request a copy of your data in a portable format.
• Where processing is based on consent, to withdraw your consent at any time. Withdrawal of consent does not affect processing carried out up to that point.
• To claim compensation for damage if you suffer damage as a result of unlawful processing.

It is sufficient to send your request to hello@ayduke.com. We may ask for additional information in order to verify your identity. We will respond to your request as soon as possible and in any event within the period laid down by the legislation. If you are not satisfied with the outcome, your right to lodge a complaint with the competent data protection authority is reserved.

11 Under 18s

AYDUKE is a service intended for businesses and adults who create content; it is not intended for persons under the age of 18 and we do not knowingly collect personal data from this age group. If we learn that such data has reached us, we will delete it.

12 Changes to this document

We update this document when there is a change in the service or in the legislation. The current version is always published on this page and the date of the last update is shown at the top of the page. When there is a significant change, we will also inform separately the users with whom we have a service relationship.

Effective date of this document: 30.09.2026.