This is a translation. The Turkish version of this text is binding (Bu metnin Türkçesi esastır).
Klibim Platform — Privacy Notice on the Processing of Personal Data
Scope: the Klibim platform: clippers, creators, agencies, workspace team members, clients invited by agencies, and visitors to community pages who create an account on or use the platform at klibim.com. Applies once the platform opens.
This privacy notice has been prepared by Batuhan Yaraş, as data controller, pursuant to Article 10 of the Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
Applies once the platform opens. Klibim currently operates only as a waitlist. This notice is published to explain in advance the processing activities relating to account creation, social media account connection, campaigns, clip submission, view measurement and payments, and applies from the date the platform opens for service. Until then, no accounts can be created on the platform and the data described in this notice is not processed.
Processing relating to visits to the klibim.com website, the waitlist and support communication is described in the Privacy Notice; when you use the platform, both notices apply together. The rules for using the platform are set out in the Terms of Use, and how to have your account and the data obtained from your connected accounts deleted is explained on the Data Deletion Instructions page.
What is Klibim? Klibim is a clip campaign platform. Creators and agencies open campaigns by setting a budget; clippers cut short clips from this content, post them on their own TikTok, Instagram, YouTube or X accounts connected to Klibim, and earn per 1,000 views. Views are measured automatically, only through the official application programming interfaces (APIs) of these platforms and with the permission you grant when connecting the account. The campaign budget never enters Klibim's bank account; it is held by a licensed payment institution, and payments to clippers are made through that institution.
1. Identity of the Data Controller
| Data controller | Batuhan Yaraş (natural person) |
|---|---|
| Address | Our postal address for written applications will be provided to you if you write to destek@klibim.com. |
| destek@klibim.com | |
| Website | https://klibim.com |
Once a commercial company is established to operate Klibim, that company will become the data controller. In that case this notice will be updated, platform users will be notified of the change of data controller at their registered e-mail addresses, and the records will be transferred to the new data controller in accordance with the Law.
2. Personal Data Processed and Purposes of Processing
Your personal data is processed only for the purposes stated below for each user group and data category. Which data is processed depends on the features you use on the platform; no data is processed for a feature you do not use.
2.1 All users: account, sign-in and security
| Data category | Personal data processed | Purposes of processing |
|---|---|---|
| Data categoryIdentity, contact | Personal data processedE-mail address; an irreversible hash of your password (the password itself is not stored); e-mail verification and last sign-in times; sign-up language | Purposes of processingCreating and verifying your account and enabling sign-in |
| Data categoryIdentity, contact | Personal data processedIf you choose Sign in with Google: your Google account ID, name, e-mail address and whether the e-mail is verified (only the email and profile permissions are requested). The address of your Google profile photo may be recorded by the authentication infrastructure; Klibim does not use or display this photo | Purposes of processingAllowing you to sign in with your Google account |
| Data categoryTransaction security | Personal data processedSession records (session and refresh tokens, browser information, IP address, assurance level); authentication event logs (event type, time, IP address) | Purposes of processingManaging your session; preventing account takeover; investigating security events; showing accounts that appear to belong to the same person (e.g. the same IBAN or the same session IP address) together on the administrator screen for fraud review |
| Data categoryTransaction security | Personal data processedBot-check (Cloudflare Turnstile) signals on the sign-in, sign-up and password reset forms: IP address, browser information, TLS connection characteristics, verification token | Purposes of processingPreventing automated account creation and account takeover attempts |
| Data categoryContact | Personal data processedAccount e-mails (verification, password reset, e-mail change) and service notifications (e.g. a warning that a connected account has been disconnected; review, hold and appeal outcomes; bonus and withdrawal information; a new campaign in a community you joined; a budget warning to the campaign owner) and their dashboard equivalents | Purposes of processingVerifying your account; sending the notifications required to perform the contract |
2.2 Profile, clipper profile and workspace
| Data category | Personal data processed | Purposes of processing |
|---|---|---|
| Data categoryIdentity | Personal data processedFull name; public shortened name or nickname (e.g. "Ahmet Y."); account type (clipper, creator or agency); account status (active, suspended, closed) | Purposes of processingManaging your account; showing only your shortened name in public places (e.g. leaderboards) |
| Data categoryLegal transaction | Personal data processedYour declaration that you are at least 18 years old and its time; the version of the Terms of Use you accepted and the time of acceptance (server time; cannot be changed afterwards) | Purposes of processingFormation of the contract; proof of the age declaration and of acceptance |
| Data categoryIdentity, professional experience | Personal data processedClipper profile: username, profile photo, short bio, connected accounts and Discord name you choose to show, founding clipper badge if any, statistics (number of approved clips, number of campaigns joined, views in the last 30 days and, if you choose to show it, total net earnings); the setting for whether the profile is public (default: off) | Purposes of processingDisplaying your profile. A private profile is visible only to you, to the teams of campaigns you joined and to the Klibim administrator; you appear as "Hidden clipper" in community winners lists and do not appear in community member lists |
| Data categoryCustomer transaction | Personal data processedWorkspace (creator and agency): type, name (public name for creators, agency name for agencies), owner, team members and their roles (owner, manager, moderator); e-mail address, inviter, validity and outcome of team invitations; founding agency flag and date | Purposes of processingIdentifying the unit that opens campaigns, makes payments and is invoiced for the service fee; applying permissions by team role (moderators do not see financial information); applying the founding agency discount |
2.3 Clippers: connected social media and Discord accounts
Clippers connect their TikTok, Instagram, YouTube and X accounts, and optionally their Discord account, to Klibim through each platform's own sign-in and consent screen (OAuth). Klibim never sees your password and requests only the read permissions listed below; no permission to post on your behalf, delete content, or read or send messages is requested. The connection screen lists the accounts linked to that sign-in; only the accounts you select are saved.
| Platform | Connection method and permissions requested | Personal data obtained | Purposes of processing |
|---|---|---|---|
| PlatformYouTube | Connection method and permissions requestedAuthorization with Google (OAuth); only the youtube.readonly permission | Personal data obtainedChannel ID, channel name and subscriber count; the ID, title, description, publish time, duration and view, like and comment counts of the videos you submit | Purposes of processingVerifying that the channel belongs to you; checking submission requirements; measuring views and calculating earnings; detecting fake engagement |
| PlatformTikTok | Connection method and permissions requestedTikTok Login Kit (OAuth); only the user.info.basic, user.info.profile, user.info.stats and video.list permissions | Personal data obtainedTikTok account ID (open_id), username and display name; account statistics (follower, following, like and video counts); the ID, link, posting time, duration, description (to the extent TikTok provides it) and view, like, comment and share counts of your videos | Purposes of processingVerifying that the account belongs to you and showing it with your username; checking submission requirements; measuring views and calculating earnings; detecting fake engagement (e.g. views relative to follower count, Section 5) |
| PlatformInstagram | Connection method and permissions requestedInstagram API with Instagram Login (OAuth); professional (creator or business) accounts only; permissions to access your profile and the insights of your own media (instagram_business_basic, instagram_business_manage_insights) | Personal data obtainedInstagram account ID, username, account type and follower count; the ID, link, posting time, caption and view, like, comment and share counts of your media | Purposes of processingVerifying that the account belongs to you; checking submission requirements; measuring views and calculating earnings; detecting fake engagement |
| PlatformX | Connection method and permissions requestedOAuth 2.0 (PKCE); only the tweet.read and users.read permissions and offline.access to keep the connection refreshed | Personal data obtainedX user ID, username, display name and follower count; the ID, posting time, text and view, like, reply and repost counts of your post | Purposes of processingVerifying that the account belongs to you; checking submission requirements; measuring views and calculating earnings; detecting fake engagement |
| PlatformDiscord (optional) | Connection method and permissions requestedDiscord OAuth2; only the identify and guilds permissions | Personal data obtainedDiscord user ID, username and display name; the list of servers you are a member of (compared only at the time of the check and not stored; only the result and time of the check are recorded) | Purposes of processingLetting the campaign team see your Discord name; automatically checking a campaign's "join the Discord server" requirement. No views are measured on Discord and your messages are not read |
For each connection, the access and refresh tokens issued by the platform, the permission scopes and their expiry times are stored in the database encrypted at application level (AES-256-GCM); they are never sent to the browser or written to logs or error messages. The connected account record holds the platform, the platform account ID, the display name and the connection status. A social media account or Discord account can be connected to only one Klibim account. Campaign teams see only the name of your connected account and the details of the clips you submit. Platform-specific explanations and ways to revoke access are in Section 10.
2.4 Clippers: submissions, measurement, submission notes and holds
| Data category | Personal data processed | Purposes of processing |
|---|---|---|
| Data categoryCustomer transaction | Personal data processedSubmission: the link of your clip and its ID on the platform, the posting time obtained from the platform, the results of the campaign requirement checks (e.g. posting window, collaboration tag, minimum video length, duplicate submission, community or Discord server requirement), a copy of the campaign settings and additional rules in force at the time of submission, the time you accepted the rules, and the status of the submission | Purposes of processingRecording the submission in the campaign; automatically checking requirements; calculating earnings |
| Data categoryCustomer transaction | Personal data processedView measurements: view, like, comment and share counts and the time of measurement, taken roughly every 6 hours (once a day on Instagram) for up to 30 days from posting until the clip reaches the threshold and for 7 days after approval, plus once at submission and once on the 7th day after approval. The only source is the platform's official API; manually entered figures or screenshots are not used. Raw counts are deleted after 30 days; earnings records keep only the calculated Turkish lira amount and its date | Purposes of processingDetecting that the threshold has been passed; calculating earnings; detecting fake engagement |
| Data categoryTransaction security | Personal data processedSuspicion score: a score from 0 to 100 calculated at every measurement and its reason categories (likes, comments and shares relative to views; sudden jumps between measurements; views relative to account age and follower count; accounts that appear to belong to the same person) | Purposes of processingPreventing fake views and engagement. The score is not shown to you or to the campaign team; the reason category, the decision and the reasons for the decision are shown (see Section 5) |
| Data categoryTransaction security, legal transaction | Personal data processedHold records: Klibim hold (suspicion score, or a violation report by the campaign team or client with its mandatory reason, the administrator's decision and reasons); the campaign team's "Hold and request information" record, request and decision; your request to escalate a hold to Klibim; the evidence you upload (text and at most 1 file) | Purposes of processingAssessing compliance with campaign rules and possible fraud; making and proving the decision |
| Data categoryCustomer transaction, communication | Personal data processedSubmission notes: your correspondence with the campaign team under your submission (text and at most 1 file per note: an image of up to 5 MB or a video of up to 60 seconds and 20 MB). Files may contain your data or the data of third parties | Purposes of processingAllowing the campaign team to assess the clip. Notes are visible only to you, the campaign team and the Klibim administrator; in agency campaigns the client does not see them |
| Data categoryCustomer transaction, legal transaction | Personal data processedReview decisions (approval, automatic approval, rejection and any reason for rejection); your appeal message, new evidence and the outcome of the appeal; "reject and block" records and their reasons | Purposes of processingAssessing submissions; deciding on your appeal; applying the campaign owner's right to block |
| Data categoryLegal transaction | Personal data processedLicense acceptances: the sublicense text you accept when joining a campaign and the declaration "my clip does not infringe anyone else's rights"; text version and time of acceptance (server time) | Purposes of processingEstablishing and proving the copyright license chain |
2.5 Clippers: earnings, bonuses, identity verification, tax and payment
| Data category | Personal data processed | Purposes of processing |
|---|---|---|
| Data categoryFinance | Personal data processedEarnings records and their statuses (pending, awaiting budget, withdrawable, cancelled); for each record the gross amount, the clipper service fee (10%, VAT included) and the net amount; balance; withdrawal requests, their outcomes and the payment institution's transaction ID; statutory tax withholding, if any | Purposes of processingCalculating and paying your earnings; calculating and invoicing the service fee; accounting and tax obligations |
| Data categoryFinance | Personal data processedBonus: the amount, note, sending team member and date of a bonus sent by the campaign owner through an automatic rule or manually | Purposes of processingCalculating and paying the bonus like earnings. A bonus can be sent only from the campaign's budget and only to a clipper who joined the campaign; money or balance cannot be sent between users |
| Data categoryCustomer transaction | Personal data processedFounding clipper: whether your account's e-mail address matches a clipper record that joined the waitlist before the platform opened, the time of the match and the end date of the service fee exemption | Purposes of processingApplying founding clipper benefits (no clipper service fee for the first 30 days after the beta launch and a founding clipper badge on the profile) (see Section 2.9) |
| Data categoryFinance | Personal data processedTax status: your choice of "I have a 20/B exemption certificate", "I have a company" or "None", and any information or documents that tax legislation may require depending on that choice | Purposes of processingDetermining whether statutory tax withholding applies and which document is to be issued |
| Data categoryIdentity | Personal data processedIdentity verification (once, before the first withdrawal): full name, Turkish ID number, date of birth and the result of the verification | Purposes of processingEnsuring payment is made to the entitled person in their own name; not making payments to persons under 18; preventing fraud |
| Data categoryFinance | Personal data processedIBAN and account holder name (only an account opened in your own name); other information required by the payment institution to register the recipient | Purposes of processingMaking the payment to your bank account through the payment institution; preventing the same IBAN from being used on more than one account |
| Data categoryFinance | Personal data processedFull name, Turkish ID number, payment amount and date, within the scope of notifications required by tax legislation (e.g. BTRANS notifications to the Revenue Administration) | Purposes of processingFulfilling notification obligations arising from tax legislation, to the extent such obligations arise |
Identity verification, IBAN and tax status information is not requested at sign-up; it is requested only once, when you want to withdraw money. Your Turkish ID number and IBAN are stored in the database encrypted at application level (AES-256-GCM), and your IBAN is shown masked on screen. This information is not shown to campaign owners or clients. The identity verification method and the name of the payment institution will be added to this notice before money starts to flow.
2.6 Creators, agencies and agency clients: campaigns, budget and payment
| Data category | Personal data processed | Purposes of processing |
|---|---|---|
| Data categoryIdentity, professional experience | Personal data processedSource channel links of the content the campaign is opened for (e.g. Kick, Twitch, YouTube, Spotify) and the record verifying that they belong to you | Purposes of processingVerifying that the campaign content belongs to you; preventing copyright and content rights disputes |
| Data categoryCustomer transaction, visual records | Personal data processedCampaign: title, description, brief, additional rules, source links and files, cover and thumbnail image (may include your face), campaign requirements and settings (including the time and person accepting the warning if the collaboration tag is turned off), content rights declaration; Klibim's review decision and reasons during the pilot period | Purposes of processingPublishing the campaign and showing it to clippers; proving declarations |
| Data categoryFinance | Personal data processedBudget and budget movements (deposit, top-up, refund), campaign owner service fee and VAT, the payment institution's fee for card payments, the payment institution's transaction ID; for the service fee invoice, full name or trade name, Turkish ID or tax number and address. Card details do not reach Klibim and are entered directly with the payment institution | Purposes of processingPerforming the contract; issuing the invoice; tax and accounting obligations. If the workspace owner is a natural person, this data is personal data |
| Data categoryFinance, customer transaction | Personal data processedClient in an agency campaign: the account of the client (creator or brand) invited by the agency, the payment link, the budget and service fee paid, the invoice; the budget, spending, approved clips and views shown on the client's read-only dashboard; the client's violation reports | Purposes of processingEnabling the client to pay for and follow the agency campaign directly. The client sees only its own campaigns; approval and rejection decisions are made by the agency team |
| Data categoryFinance | Personal data processedBonuses sent: amount, note, public name of the receiving clipper, sending team member | Purposes of processingPaying the bonus from the campaign budget and recording it |
| Data categoryContact | Personal data processedTeam member and agency client invitations: the invitee's e-mail address, a hash of the invitation code, the inviter, the validity of the invitation (7 days) and its outcome; the link between the agency and the client | Purposes of processingDelivering and completing the invitation; building the team; allowing the agency to manage campaigns for its client |
| Data categoryLegal transaction | Personal data processed"Reject and block" records and their reasons; violation reports and their reasons | Purposes of processingApplying the campaign owner's right to block and to report violations; preventing abuse |
| Data categoryLegal transaction | Personal data processedLicense acceptance: the limited license text, accepted when opening the campaign or, in an agency campaign, at payment, which lists the rights one by one (adaptation, reproduction, communication to the public) and covers only the clips of that campaign; a brand client's declaration of rights ownership or permission; the agency's declaration that it manages the campaign on behalf of its client; text version and time of acceptance | Purposes of processingEstablishing and proving the copyright license chain |
2.7 Invited persons who do not yet have an account
When an agency invites you as its client, or a workspace owner invites you to their team, your e-mail address is provided by the inviter; Klibim obtains this data from the inviter, not from you. In that case you are informed through a link to this notice in the first invitation e-mail sent to you. If the invitation is not accepted within 7 days it expires; your e-mail address is not used for any purpose other than delivering and completing the invitation, and the invitation record is deleted within the period stated in Section 6.
2.8 Community pages, rooms and complaints
| Data category | Personal data processed | Purposes of processing |
|---|---|---|
| Data categoryIdentity, contact, visual records | Personal data processedCommunity page (creator and agency): short name, cover and logo (may include your face), display name, short description, social media links, Discord invite link and the server ID resolved from that link through Discord's public invite information; rooms and room content (announcement, link, text, YouTube video ID) and the team member who added them | Purposes of processingPublishing the community page and rooms; checking the "join the Discord server" requirement |
| Data categoryCustomer transaction | Personal data processedCommunities you joined or follow, the time you joined, your new campaign notification preference | Purposes of processingOpening rooms to you; new campaign notifications; checking a campaign's "join the community" requirement. Only clippers with a public profile appear in member lists |
| Data categoryCustomer transaction | Personal data processedWinners list: the names and earnings ranking of the top-earning clippers in the community's campaigns (a clipper with a private profile is shown as "Hidden clipper") | Purposes of processingDisplay on the community page |
| Data categoryTransaction security | Personal data processedComplaints: the content you report, the reason, time and outcome; a record of Klibim staff access to the reported content | Purposes of processingReviewing and, where necessary, removing the content. Room content complaints go to the community team and to Klibim, submission note complaints only to Klibim; Klibim staff see only the reported content |
Room content, profile bios and submission notes are processed as plain text; links in content lead to external sites. YouTube videos in rooms load only when you click them, using YouTube's privacy-enhanced player (youtube-nocookie.com). Chat rooms and direct messaging will open later; this notice will be updated before they do.
2.9 Matching of the waitlist record and founding clippers
If you joined the waitlist before the platform opened and you create an account on the platform with the same e-mail address, your e-mail address is matched automatically and once with your waitlist record when your account is created. For a clipper record, the founding clipper information (time of the match and end date of the service fee exemption) is transferred to your account, and your waitlist record is then deleted. Creator and agency records are likewise deleted when the account is created. The match is logged in the audit record with only the account ID and role, without your e-mail address. Processing of the waitlist record is described in the Privacy Notice.
2.10 Third parties appearing in campaign content
Klibim does not copy or store the videos posted by clippers; it keeps only the video's link, platform ID, description and numerical statistics. The content of video comments and the names of commenters are not obtained, and no data about viewers is processed. Data of third parties may appear in campaign images, video descriptions and submission note files; such data is processed only to run the campaign and enforce its rules.
2.11 Transaction records (audit trail)
For every money- and permission-related action (e.g. budget movement, earnings, bonus, withdrawal, role change, blocking, hold decision), the account that performed it, the related workspace, the type of action, the affected record and the time are written to an audit record. This record accepts additions only; it cannot be changed or deleted afterwards. Its purpose is to prove transactions, resolve disputes, investigate fraud and fulfil obligations arising from legislation.
2.12 Data not collected and commercial electronic messages
No analytics, advertising, social media plug-ins or tracking pixels are used on the platform. Special categories of personal data (Article 6 of the Law) are not requested. Clippers are not asked for screenshots or manual view declarations. Commercial electronic messages announcing campaigns or containing promotional content may be sent only on the basis of your separate approval obtained in accordance with Law No. 6563; this notice will be updated before any such approval is collected. Service notifications about your account (Section 2.1) are not commercial electronic messages.
3. Method of Collecting Personal Data and Legal Grounds
Your personal data is collected electronically, by automated or partly automated means through the forms on the platform (sign-up, profile, clipper profile, campaign wizard, submission window, submission notes, community page and rooms, identity verification and tax status form), the images and files you upload, the Sign in with Google flow, the official APIs of the social media platforms and Discord with the permission you grant when connecting your accounts (OAuth), transaction results sent by the payment institution, information entered by an inviter, your waitlist record (only for the matching described in Section 2.9) and records generated automatically by the system (session, measurement, suspicion score, audit trail).
| Personal data | Collection method | Legal ground (Law Art. 5/2) |
|---|---|---|
| Personal dataAccount data; Sign in with Google data | Collection methodSign-up form; your sign-in with your Google account | Legal ground (Law Art. 5/2)(c) Formation and performance of a contract |
| Personal dataSession and authentication event logs; bot-check signals | Collection methodAutomatic | Legal ground (Law Art. 5/2)(c) Performance of the contract; (f) legitimate interest (account security) |
| Personal dataProfile, clipper profile and visibility setting; workspace and team data | Collection methodProfile forms; invitation and acceptance | Legal ground (Law Art. 5/2)(c) Formation and performance of the contract. The clipper profile becomes public only by your choice |
| Personal dataAge declaration and record of acceptance of the Terms of Use | Collection methodSign-up and profile form (automatic timestamp) | Legal ground (Law Art. 5/2)(c) Formation of the contract; (e) establishment, exercise or protection of a right (proof) |
| Personal dataConnected social media accounts, profile and video data obtained from the platforms, access tokens | Collection methodThe platforms' official APIs, with the permission you grant when connecting (OAuth) | Legal ground (Law Art. 5/2)(c) Performance of the contract; (f) legitimate interest (verifying account ownership and preventing fraud) |
| Personal dataView measurements | Collection methodAutomatic queries to the platforms' official APIs | Legal ground (Law Art. 5/2)(c) Performance of the contract (calculating earnings); (f) legitimate interest (preventing fraud) |
| Personal dataDiscord account and server membership check | Collection methodConnection via OAuth on Discord | Legal ground (Law Art. 5/2)(c) Performance of the contract (checking a campaign requirement) |
| Personal dataSubmission details, acceptance of rules and requirement checks | Collection methodSubmission window; the platforms' official APIs | Legal ground (Law Art. 5/2)(c) Performance of the contract; (f) legitimate interest (enforcing campaign rules) |
| Personal dataSuspicion score, hold records, evidence and decision | Collection methodAutomatic calculation; report by the campaign team or client; evidence you upload; administrator decision | Legal ground (Law Art. 5/2)(f) Legitimate interest (preventing fraud and unjustified payments); (e) protection of a right. There is no automatic rejection; the decision is made by a human |
| Personal dataSubmission notes and files; review, appeal and blocking records | Collection methodSubmission page and dashboard | Legal ground (Law Art. 5/2)(c) Performance of the contract; (f) legitimate interest (enforcing campaign rules); (e) protection of a right |
| Personal dataLicense acceptances and rights declarations | Collection methodCampaign wizard, payment and joining step (automatic timestamp) | Legal ground (Law Art. 5/2)(c) Formation and performance of the contract; (e) establishment, exercise or protection of a right (proof) |
| Personal dataCampaign content and images | Collection methodCampaign wizard, file upload | Legal ground (Law Art. 5/2)(c) Performance of the contract |
| Personal dataBudget, budget movements, service fee, VAT and invoice details; payment data of an agency client | Collection methodPayment link; notification from the payment institution; automatic | Legal ground (Law Art. 5/2)(c) Performance of the contract; (ç) compliance with a legal obligation (tax and commercial legislation) |
| Personal dataEarnings records, bonuses, clipper service fee, balance and withdrawals | Collection methodAutomatic; bonus sent by the campaign owner | Legal ground (Law Art. 5/2)(c) Performance of the contract; (ç) legal obligation (accounting and tax records) |
| Personal dataIdentity verification data, IBAN and tax status; tax notifications | Collection methodIdentity verification and tax status form; automatic | Legal ground (Law Art. 5/2)(c) Performance of the contract (paying the entitled person); (ç) legal obligation; (f) legitimate interest (age check and fraud prevention) |
| Personal dataFounding clipper matching | Collection methodAutomatically and once against the waitlist record when the account is created | Legal ground (Law Art. 5/2)(c) Performance of the contract (applying the benefit announced on the waitlist) |
| Personal dataTeam and agency client invitation: the invitee's e-mail address | Collection methodInformation entered by the inviter | Legal ground (Law Art. 5/2)(f) Legitimate interest (delivering the invitation); if the invitation is accepted, (c) formation of the contract |
| Personal dataCommunity page, rooms, membership and winners list | Collection methodDashboard; automatic | Legal ground (Law Art. 5/2)(c) Performance of the contract; (f) legitimate interest (promoting the community) |
| Personal dataComplaints and staff access records | Collection methodComplaint form; automatic | Legal ground (Law Art. 5/2)(f) Legitimate interest (preventing abuse); (e) protection of a right |
| Personal dataAudit trail | Collection methodAutomatic | Legal ground (Law Art. 5/2)(e) Establishment, exercise or protection of a right; (ç) legal obligation |
| Personal dataAccount e-mails and service notifications | Collection methodAutomatic | Legal ground (Law Art. 5/2)(c) Performance of the contract |
The processing activities covered by this notice are not based on your explicit consent; they are based on the legal grounds in Article 5(2) of the Law stated above. The permission you grant on a platform's consent screen when connecting a social media account allows Klibim to access only the data covered by that permission. Transfers abroad rely on the safeguards described in Section 4.2.
4. To Whom and for What Purpose Personal Data May Be Transferred
4.1 Transfers within Türkiye
| Recipient | Personal data transferred | Purpose and legal ground |
|---|---|---|
| RecipientLicensed payment institution (its name will be added to this notice once selected) | Personal data transferredClipper: full name, Turkish ID number, IBAN, amount and other information the institution requires to register the recipient. Campaign owner and agency client: full name or trade name, contact details, payment and refund amounts (card details are entered directly with the institution) | Purpose and legal groundCollecting the budget and holding it in a protected account, paying clippers, refunds and identity verification — Art. 5/2-c and 5/2-ç. The payment institution is also a data controller in its own right for its obligations under Law No. 6493 |
| RecipientThe clipper's bank | Personal data transferredThrough the payment institution: full name, IBAN, amount | Purpose and legal groundCrediting the payment to your account — Art. 5/2-c |
| RecipientRevenue Administration and the electronic invoice (e-Archive) service provider | Personal data transferredInvoice: full name or trade name, Turkish ID or tax number, address, amount. Tax notifications (to the extent the obligation arises): full name, Turkish ID number, payment amount and date | Purpose and legal groundIssuing invoices and tax notifications — Art. 5/2-ç |
| RecipientAccounting and certified public accountant services (when engaged) | Personal data transferredPayment, withholding and invoice records | Purpose and legal groundTax and accounting obligations — Art. 5/2-ç |
| RecipientThe other party to the campaign: for a clipper, the creator or agency that opened the campaign, its team members and, in an agency campaign, the client; for a campaign owner, the clippers who joined the campaign | Personal data transferredThe clipper's public name, clipper profile (even if private), connected account name and Discord name, submission link and measurements, submission notes and files (not the client), hold status, decision and reasons (excluding the suspicion score), bonuses. The campaign owner's workspace name, campaign content, decisions and any reasons. The client sees only approved clips and views | Purpose and legal groundPerformance of the contract — Art. 5/2-c. The clipper's full name, identity, tax and bank details are not shown to the campaign owner or the client; moderators do not see financial information |
| RecipientVisitors to the platform | Personal data transferredPublic clipper profiles; names ("Hidden clipper" if the profile is private) and rankings in winners lists; community page content; public information about live campaigns | Purpose and legal groundPublishing the platform and community pages — Art. 5/2-c and 5/2-f |
| RecipientPublic authorities authorized by law | Personal data transferredOnly upon a lawful written request, limited to the data requested | Purpose and legal groundCompliance with a legal obligation — Art. 5/2-ç and Art. 8 |
Your personal data is not sold or rented to any third party for commercial purposes.
4.2 Transfers abroad
Service providers whose headquarters or servers are located abroad are used to host the platform, store data, run bot checks, send e-mail and connect social media accounts. The hosting, database, bot-check and e-mail providers act as data processors, processing personal data only on Klibim's behalf and instructions. Google (YouTube), TikTok, Meta (Instagram), X and Discord, by contrast, are independent data controllers for their own services when you connect your account; how these companies process your data is explained in their own privacy policies (see Section 10).
| Recipient | Country / data location | Personal data transferred | Purpose of transfer |
|---|---|---|---|
| RecipientGoogle Cloud EMEA Limited (Ireland) and Google LLC (USA) — Google Cloud / Firebase App Hosting | Country / data locationApplication server: the Netherlands (europe-west4). Load balancer and content delivery network: Google's global edge locations. Server logs: Google's global infrastructure | Personal data transferredEvery request made to the platform (in transit); server request and error logs (IP address, browser information, requested address, date and time) | Purpose of transferHosting the platform; keeping security and error logs |
| RecipientSupabase Pte. Ltd. (Singapore) | Country / data locationDatabase, authentication, file storage and backups: Ireland (AWS eu-west-1). Content in file storage may be served through a global content delivery network. Support access: Singapore and USA. Some sub-processors are in the USA | Personal data transferredAll data in this notice (including encrypted access tokens, encrypted identity and bank details and files in private storage) | Purpose of transferDatabase, authentication and file storage service |
| RecipientCloudflare, Inc. (USA) | Country / data locationGlobal network | Personal data transferredBot-check (Turnstile) signals on the sign-in, sign-up and password reset forms; request information relating to domain name (DNS) resolution; forwarding logs of e-mails sent to destek@klibim.com | Purpose of transferBot checks; operating the domain; forwarding support e-mails. Cloudflare also processes part of the Turnstile signals as an independent data controller to improve its own product |
| RecipientE-mail delivery service provider (its name will be added to this table once selected) | Country / data locationWill be added to this table once the provider is selected | Personal data transferredThe recipient's e-mail address; the content of account e-mails, invitations and service notifications; delivery information | Purpose of transferSending account e-mails, invitations and service notifications |
| RecipientGoogle LLC (USA) — Gmail | Country / data locationUSA and Google's global infrastructure | Personal data transferredThe full content of e-mails you send to destek@klibim.com and our replies | Purpose of transferReceiving and answering support requests and applications |
| RecipientGoogle LLC (USA) — Sign in with Google | Country / data locationUSA and Google's global infrastructure | Personal data transferredWhen you sign in with Google, Klibim's application ID and the sign-in request go to Google; Google sends your identity information to Klibim | Purpose of transferSigning in with your Google account |
| RecipientGoogle LLC (USA) — YouTube API Services | Country / data locationUSA and Google's global infrastructure | Personal data transferredWhen connecting a channel and during measurement: Klibim's application ID, your access token, channel and video IDs (your channel and video data is received in return). When you click to play a YouTube video in a community room, your browser connects to youtube-nocookie.com (IP address, browser information) | Purpose of transferChannel verification, checking submission requirements and measuring views; playing the video |
| RecipientTikTok (the TikTok group company providing the TikTok for Developers service) | Country / data locationTikTok's infrastructure abroad | Personal data transferredWhen connecting an account and during measurement: Klibim's application ID, your access token and the queried video IDs (your profile and video data is received in return) | Purpose of transferAccount verification, checking submission requirements and measuring views |
| RecipientMeta Platforms, Inc. (USA) — Instagram API | Country / data locationUSA and Meta's global infrastructure | Personal data transferredWhen connecting an account and during measurement: Klibim's application ID, your access token and the queried media IDs (your profile and media data is received in return) | Purpose of transferAccount verification, checking submission requirements and measuring views |
| RecipientX Corp. (USA) — X API | Country / data locationUSA and X's global infrastructure | Personal data transferredWhen connecting an account and during measurement: Klibim's application ID, your access token and the queried post IDs (your profile and post data is received in return) | Purpose of transferAccount verification, checking submission requirements and measuring views |
| RecipientDiscord Inc. (USA) — only if you connect your Discord account | Country / data locationUSA | Personal data transferredKlibim's application ID and your access token (your Discord user ID, name and server list are received in return); the code of the Discord invite link on a community page | Purpose of transferLetting the campaign team see your Discord name; checking the "join the Discord server" requirement |
Since no country has yet been declared adequate by the Personal Data Protection Board under Article 9 of the Law, the transfers above qualify as transfers abroad within the meaning of the Law even where the servers are located in the European Union. For these transfers, the process of putting in place the appropriate safeguards provided for in Article 9(4) of the Law (the standard contracts announced by the Board) for each provider and notifying the Authority is under way. Which safeguard has been put in place for which transfer is published and kept up to date in this section; you can also request information by writing to destek@klibim.com.
5. Automated Processing, Suspicion Score and Right to Object
Some outcomes on the platform arise automatically under predefined rules. None of them is profiling for advertising or marketing purposes. Decisions that may have an adverse effect on you (rejection of a submission, cancellation of a clip on hold, closure of an account) are made by a human. Under Article 11(1)(g) of the Law, you may object to an outcome against you that arises from analysis carried out exclusively by automated systems, using the routes below.
| Automated outcome | What happens | How to object |
|---|---|---|
| Automated outcomeSubmission pre-checks | What happensA clip is not recorded if it was not posted from a connected account that belongs to you, is on a platform not enabled for the campaign, was posted more than 30 minutes earlier, lacks the tags the campaign requires, is shorter than the minimum length, was submitted before, or does not meet a community or Discord server requirement; this carries no penalty | How to objectThe submission screen shows which requirement was not met; you can request human review by writing to destek@klibim.com |
| Automated outcomeThreshold deadline | What happensIf a clip does not pass the campaign's view threshold within 30 days of posting, or before the campaign ends, it expires and no earnings arise | How to objectYou can request human review by writing to destek@klibim.com |
| Automated outcome72-hour automatic approval | What happensIf the campaign team does not decide on a clip that has passed the threshold within 72 hours and the clip is not on hold, the clip is approved automatically | How to objectThis outcome is in your favour. The campaign team or client may report a violation they see in an approved clip, with reasons, within 7 days after approval; the decision rests with the Klibim administrator |
| Automated outcomeSuspicion score and Klibim hold | What happensIf the suspicion score calculated at each measurement exceeds the limit, the clip is not rejected automatically; it is placed on hold "under Klibim review": if not yet approved it will not be approved automatically, if approved its earnings will not become withdrawable, and measurement continues. You are notified and shown the reason category; the score itself and the limit values are not shown, to prevent the detection method from being gamed | How to objectDuring the hold you upload evidence (text and at most 1 file) from the dashboard; the Klibim administrator decides within 3 business days. You may appeal a "fake" decision once, with new evidence, within 3 days of the decision; the administrator makes a final decision within 3 business days. Earnings do not return to the budget while the appeal is pending |
| Automated outcomeInsufficient budget | What happensIf the campaign's remaining budget is not enough for the increases in a measurement round, the remaining budget is shared in proportion to the increases; the uncovered part is shown on a separate line as "awaiting budget". If budget is added, these amounts are covered first, starting from the oldest approval; if no budget is added within 14 days, the campaign ends and these amounts lapse | How to objectYou can request human review by writing to destek@klibim.com |
| Automated outcomeClip that cannot be measured | What happensIf your connected account is disconnected or the platform's service is unavailable, you are sent an e-mail and measurement waits; if the final measurement cannot be taken on the 7th day after approval, the system waits up to 7 more days and then uses the last successful measurement | How to objectYou can request human review by writing to destek@klibim.com |
| Automated outcomeEarnings becoming final | What happensWhen the final measurement is taken on the 7th day after approval, the earnings become withdrawable and can no longer be taken back; for a clip on hold, the earnings are credited when the hold is resolved | How to objectThis outcome is in your favour |
Decisions to reject a submission, to "reject and block", to cancel a clip on hold and to close an account are made by a human. You may appeal a rejection once from the dashboard within 3 days of the decision; the Klibim administrator decides within 3 business days. You can always escalate the campaign team's "Hold and request information" decision to the Klibim administrator.
6. Retention Periods
| Personal data | Retention period |
|---|---|
| Personal dataAccount, profile, clipper profile and workspace | Retention periodAs long as your account is open; deleted when you delete your account. For accounts with money movements, the records listed below are kept with restricted access for the statutory period |
| Personal dataAccess and refresh tokens of social media and Discord accounts | Retention periodDeleted immediately when you remove the connection or delete your account; where the platform supports it, Klibim also revokes the permission with the platform |
| Personal dataConnected account record (platform, platform account ID, display name) | Retention periodAs long as the connection exists. If your account was closed for breaching the rules, it is kept for the duration of the block to prevent the same social media account from being connected to another Klibim account |
| Personal dataRaw view, like, comment and share counts obtained from the platforms | Retention period30 days from measurement, then deleted. Earnings records keep only the calculated Turkish lira amount and its date |
| Personal dataDiscord server list | Retention periodNot stored; only the result and time of the requirement check are recorded |
| Personal dataSubmission, review, hold, appeal and blocking records; the text of submission notes | Retention periodTogether with the related earnings and payment records, for the statutory retention period of those records |
| Personal dataSubmission note files, hold evidence and appeal files | Retention periodDeleted 30 days after the decision or earnings become final |
| Personal dataLicense acceptances and rights declarations | Retention periodAfter the campaign ends, for the relevant limitation periods, as proof in possible disputes |
| Personal dataEarnings, bonus, withdrawal, budget, refund and invoice records | Retention periodFor the retention periods provided for in tax and commercial legislation |
| Personal dataIdentity verification data, IBAN and tax status | Retention periodAs long as your account is open; after the account is closed, encrypted and with restricted access for the statutory retention period of payment records |
| Personal dataCommunity page, rooms, room content and memberships | Retention periodAs long as your account is open or until you or the community team remove them; your membership record is deleted when you leave a community |
| Personal dataComplaint records and staff access records | Retention periodAfter the complaint is resolved, for the period necessary as proof in possible disputes |
| Personal dataInvitation records not accepted or expired | Retention periodDeleted once the invitation has expired and the purpose of processing no longer exists |
| Personal dataWaitlist record | Retention periodDeleted immediately once the account is created and matched (Section 2.9) |
| Personal dataSession and authentication event logs | Retention periodFor the duration of the session and the period necessary for account security |
| Personal dataServer request and error logs | Retention period30 days (Google Cloud Logging) |
| Personal dataAudit trail | Retention periodFor as long as necessary to prove the related transaction and as provided for by legislation |
| Personal dataE-mails sent to destek@klibim.com and our replies | Retention period2 years from resolution of the request; applications under Article 11 of the Law and their responses, 3 years owing to the burden of proof |
Personal data whose retention period has expired or whose purpose of processing no longer exists is deleted, destroyed or anonymized in accordance with Article 7 of the Law. Data obtained from connected platforms is also deleted within the periods required by the relevant platform's developer terms (see Section 10).
7. Platform Cookies
In addition to the preference cookies described in the Cookie Policy, the platform uses only the strictly necessary cookies below. These cookies are set with the HttpOnly and Secure attributes: they cannot be read by scripts in the browser and are sent only over an encrypted connection. They will also be added to the Cookie Policy when the platform opens.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| CookieSession cookies (authentication infrastructure) | PurposeKeeping you signed in after you sign in | DurationAs long as your session remains open; deleted when you sign out | TypeStrictly necessary |
CookieSign-in and account connection flow cookies (state and PKCE verifier) | PurposeSecuring the Sign in with Google flow and the social media or Discord account connection flow; preventing forged requests; returning you to the page you were on after the flow | DurationShort-lived; lose their function or are deleted when the flow completes | TypeStrictly necessary |
No analytics, advertising or tracking cookies are used. Under the Personal Data Protection Authority's Guide on Cookie Practices, strictly necessary cookies are not subject to explicit consent. YouTube videos in community rooms do not load until you click them; when you do, YouTube's player runs on its own domain and under YouTube's rules.
8. Data Security
Under Article 12 of the Law, appropriate technical and organizational measures are taken to prevent unlawful processing of and unlawful access to your personal data. These include: encrypted connections (HTTPS/HSTS) and content security headers; row-level access rules in the database (each user sees only the records they are authorized to see); no direct database access from the browser; application-level encryption of Turkish ID numbers, IBANs and social media and Discord access tokens, and masked display of IBANs; keeping submission note, evidence and appeal files in private storage, opening them only for authorized persons through links valid for at most 10 minutes, and deleting them after 30 days; server-side checking of file type and size from the file's content; processing community content as plain text; permissions by team role (moderators do not see financial information); limiting staff to the reported content when reviewing complaints and logging that access; measuring only through the platforms' official APIs; two-step verification for the administrator account; HttpOnly and Secure session cookies; keeping secret keys in an encrypted key management service; never writing passwords, tokens or full IBANs to logs; an immutable audit trail for money and permission actions; rate limits and bot checks.
9. Age Limit
The platform is intended for persons who are at least 18 years old. When creating an account you declare that you are at least 18; a clipper's date of birth is checked during identity verification before the first withdrawal. Accounts found to belong to persons under 18 are closed and their data is deleted, except for records subject to a statutory retention obligation.
10. Specific Provisions for Connected Platforms
Each platform you connect to Klibim is subject to its own terms of service and privacy policy. Klibim obtains data from these platforms only through official APIs and only within the read permissions you approve when connecting; no page scraping or third-party data providers that scrape are used. Removing access in a platform's own settings also breaks the connection on Klibim; in that case clips you submitted with that account cannot be measured (see Section 5).
10.1 YouTube (YouTube API Services)
Klibim uses YouTube API Services to let you connect your YouTube channel and to measure the statistics of your clips. By connecting your YouTube channel you agree to be bound by the YouTube Terms of Service. How Google processes your personal data is explained in the Google Privacy Policy.
Data accessed, stored and used: With the youtube.readonly permission you grant on Google's authorization screen, Klibim only reads: your channel's ID, name and subscriber count, and the ID, title, description, publish time, duration and view, like and comment counts of the videos you submit. This data is used to verify that the channel belongs to you, check submission requirements, measure views, calculate earnings and detect fake engagement. Your channel name and the statistics of the clips you submit are shown to the team of the campaign you joined (and, in an agency campaign, to the client for approved clips), and to visitors of your profile if your profile is public and you chose to show the channel. Klibim does not upload, edit or delete videos, post comments, or subscribe or like on your YouTube account. Raw statistics are deleted after 30 days; if statistics are needed for a clip older than 30 days, they are fetched again from the API.
Limited Use: Klibim's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This means:
- Data received from Google APIs is used only to provide or improve the features described in this notice and visibly offered to you on the platform (channel connection, submission checks, view measurement and earnings calculation).
- This data is not sold; it is not used to serve ads, for retargeting, or for personalized or interest-based advertising; it is not transferred to advertising platforms, data brokers or information resellers; and it is not used to determine creditworthiness or for lending purposes.
- This data is not transferred to third parties, except to provide these features (e.g. showing your clip's statistics to the campaign team), for security purposes (e.g. investigating abuse), to comply with applicable law, or as part of a merger, acquisition or sale of assets with your prior explicit consent.
- Humans do not read this data, except where you have given explicit consent for us to view specific data, where it is necessary for security purposes (e.g. investigating a bug or abuse in a clip placed on hold), where it is necessary to comply with applicable law, or where the data is aggregated so that no one can be identified and used for internal operations.
Revoking access: You can remove Klibim's access to your YouTube data at any time from the Connected accounts page on the platform or from your Google Account security settings page. This route is always available in addition to the normal deletion route described on the Data Deletion Instructions page. When access is removed or you ask for your data to be deleted, data obtained from YouTube is deleted within the periods required by the YouTube API Services Developer Policies; Turkish lira amounts and dates in earnings and payment records subject to statutory retention are excluded. Klibim does not use cookies or similar technologies on your device for YouTube data; platform cookies are described in Section 7. For questions and complaints about your YouTube data you can write to destek@klibim.com.
10.2 TikTok
You connect your TikTok account through TikTok's official sign-in and consent screen (TikTok Login Kit); views are measured with the TikTok Display API. Klibim requests only the user.info.basic, user.info.profile, user.info.stats and video.list permissions and uses the data listed in Section 2.3 only for the purposes stated there. Klibim does not post, upload or delete content on your TikTok account and does not read your messages. TikTok is an independent data controller for its own service; how TikTok processes your data is explained in the TikTok Privacy Policy.
Revoking access: You can remove your TikTok connection from the Connected accounts page on Klibim; your access tokens are then deleted and the permission is also revoked with TikTok. You can also remove Klibim's access in the TikTok app: go to Profile → menu → Settings and privacy → Security and permissions → app permissions, select Klibim and remove access (menu names may vary by app version). When access is removed on TikTok's side, the connection is marked as disconnected and you are sent an e-mail.
10.3 Instagram (Meta)
You connect your Instagram account through Meta's Instagram Login screen; with the Instagram API, Klibim reads only the profile information of professional (creator or business) accounts and the insights of your own media. Personal Instagram accounts cannot be connected; you can switch your account to a professional account free of charge in Instagram's settings. Klibim does not post on your Instagram account and does not read your comments or messages. Meta is an independent data controller for its own service; how Meta processes your data is explained in the Meta Privacy Policy.
Revoking access and data deletion: You can remove your Instagram connection from the Connected accounts page on Klibim. You can also remove Klibim's access on Instagram: Settings → Website permissions → Apps and websites → Active, then the Remove option next to Klibim (Instagram Help Center). How to request deletion of data obtained from Instagram is explained step by step on the Data Deletion Instructions page.
10.4 X
You connect your X account through X's OAuth 2.0 authorization screen (with PKCE). Klibim requests only the tweet.read, users.read and offline.access permissions; only your profile information and the text and public metrics of your own posts are read. Klibim does not post, follow anyone, like posts or read your direct messages on your X account. X is an independent data controller for its own service; how X processes your data is explained in the X Privacy Policy.
Revoking access: You can remove your X connection from the Connected accounts page on Klibim; your access tokens are then deleted and the permission is also revoked with X. You can also remove Klibim's access on X: Settings and privacy → Security and account access → Apps and sessions → Connected apps, select Klibim and revoke access. Data obtained from X is processed and deleted in accordance with X's developer terms.
10.5 Discord
Connecting your Discord account is optional and is used only to let the campaign team see your Discord name and to check a campaign's "join the Discord server" requirement. Klibim requests only the identify and guilds permissions; it does not read your messages, add you to any server or act on your behalf. The list of servers you belong to is not stored. Discord is an independent data controller for its own service; how Discord processes your data is explained in the Discord Privacy Policy.
Revoking access: You can remove your Discord connection from the Connected accounts page on Klibim; your access tokens are then deleted and the permission is also revoked with Discord. You can also remove Klibim's access on Discord: User Settings → Authorized Apps, then the Deauthorize option next to Klibim (Discord Help Center).
11. Rights of the Data Subject under Article 11 of the Law
Under Article 11 of the Law, by applying to the data controller you have the right to:
- a) learn whether your personal data is processed,
- b) request information if your personal data has been processed,
- c) learn the purpose of processing your personal data and whether it is used in line with that purpose,
- ç) know the third parties in Türkiye or abroad to whom your personal data is transferred,
- d) request correction of your personal data if it is incomplete or inaccurate,
- e) request deletion or destruction of your personal data under the conditions set out in Article 7 of the Law,
- f) request that the actions taken under (d) and (e) be notified to third parties to whom your personal data has been transferred,
- g) object to an outcome against you arising from the analysis of the processed data exclusively by automated systems,
- ğ) claim compensation for damage you suffer as a result of unlawful processing of your personal data.
Rights you can exercise on the platform: You can correct your name and public name in your profile; make your clipper profile public or private and choose which connected accounts are shown. You can remove your social media and Discord connections at any time, leave communities and turn off new campaign notifications. To have your account and data deleted, you can follow the route on the Data Deletion Instructions page. The account type can be changed only by the Klibim administrator, at your request. Routes for objecting to automated outcomes are described in Section 5.
Limits of a deletion request: Payment and invoice records that must be kept under tax and commercial legislation, and license acceptance and audit trail records needed as proof, are kept with restricted access until the statutory period ends; they are deleted at the end of that period.
How to apply
You can submit your applications, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, through the following channels:
- In writing: with a wet-signed petition, after requesting our postal address from destek@klibim.com.
- By e-mail: from the e-mail address registered to your Klibim account, to destek@klibim.com.
Your application must include your name, surname, signature if the application is in writing, Turkish ID number (or, for foreign nationals, nationality and passport or ID number), residential or business address for notifications, e-mail address and telephone number for notifications if any, and the subject of your request. The application must be made in Turkish. To verify your identity, e-mail applications must come from the e-mail address registered to your account; where necessary, additional confirmation may be requested via a verification link sent to your registered address. We recommend that you do not share personal data in your application beyond the mandatory information listed in the Communiqué.
Your application will be concluded free of charge as soon as possible according to its nature and within 30 days at the latest. If the response is given in writing, the first 10 pages are free; a fee of TRY 1 may be charged for each page beyond 10. If the response is given on a recording medium such as a CD or flash drive, only the cost of the medium may be charged. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the Law.
12. Changes to This Notice
This notice is updated when there are changes in processing activities, in the service providers used (e.g. when the payment institution and the e-mail delivery service provider are selected) or in legislation. The current version and effective date always appear on this page; material changes affecting platform users are notified to their registered e-mail addresses.
31.10.2026: First version; published to apply once the platform opens.
01.11.2026: Username (user.info.profile) and account statistics (user.info.stats) were added to the permissions requested from TikTok; the TikTok profile photo address is not obtained.