Security
How we protect your data
Brands trust us with campaign data, creators with their identity and payment details. This page describes the measures we actually have in place today; we don't claim certifications or audits we don't have.
What we do
Encryption in transit and at rest
The site and database connections run over HTTPS (TLS) only, enforced in the browser with HSTS. The database is hosted on Supabase, which provides disk-level encryption at rest. Passwords are never stored in plain text; they are one-way hashed.
Row-level access control
Row-level security (RLS) is enabled on every database table: each query is limited to the rows the signed-in person is allowed to see. These rules are verified by automated tests on every code change.
Role-based access
Admin, brand and creator roles are separate. Brands only see performance data for their own campaigns; creators' names, emails and payment details are never shown to brands. Payment details are visible only to the creator and our operations team.
Immutable audit log
Invoice creation, approval, rejection and payment, bonus changes and security events (locked accounts, two-factor changes) are recorded with who did them and when. These records can't be edited or deleted afterwards.
Two-factor authentication
Admin accounts can't access the panel without two-factor authentication via an authenticator app, and the database only honors admin privileges in verified sessions. Brands and creators can turn this protection on in their account settings.
Brute-force and spam protection
Sign-in, password reset, invitation links and public forms are rate limited. Repeated failed attempts temporarily lock the account and are written to the audit log. IP addresses are not stored in raw form.
Privacy-respecting error monitoring
We use error monitoring to spot application errors quickly. User identity, IP, cookies and form contents are not sent with error reports; emails, phone numbers and IBANs in text are masked.
Our approach to KVKK (Turkish data protection law)
- We only collect what's needed to provide the service: contact, social account and payment details for creators; contact and campaign details for brands.
- We use data only for the purpose it was collected for (campaign management, performance reporting, creator payouts); we don't sell or share it for advertising.
- Some of our service providers (subprocessors) process data outside Turkey. These transfers and their legal basis are explained in our privacy notice.
- Post statistics are collected from public posts only. Financial records are kept for the legally required periods; other data is deleted or anonymized once its purpose ends.
- To exercise your rights under KVKK (access, correction, deletion, objection), contact us at the address below.
Subprocessors
We work with the providers below to run the service. Each one only accesses the data needed for the stated purpose.
| Provider | Purpose | Data processed |
|---|---|---|
| Supabase | Database, authentication and file storage | Account, campaign, video, metric and payment records |
| Vercel | Hosting and serving the application | Request logs (IP, browser information) |
| Resend | Transactional email (invitations, password resets, notifications) | Email address and email content |
| Anthropic | AI assistant that localizes campaign briefs for Turkey | Campaign brief text (not intended to contain personal data) |
| Apify | Collecting view and engagement counts of public posts | Public post links and statistics |
| Sentry | Application error monitoring | Masked error reports (no user identity or form contents) |
Security contact
If you believe you've found a security vulnerability, please email us before disclosing it publicly. We'll review your report and get back to you. You can also use this address for personal data requests.