Privacy Policy

Who we are

SOGA is operated by [company name not configured] ("we", "us"). We are the data controller for the personal data described here under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). You can contact us at info.sogaapp@gmail.com.

Data we collect

We collect only what we need to provide SOGA:

• Account data: your email address, display name and password. We store the password only as a salted hash, never in readable form.
• Workspace data: workspace names, members and their roles.
• Instagram professional account profile, when you connect an account: account ID, username, name, account type (Business or Creator), profile picture and follower, following and media counts.
• Instagram content and insights: your posts and stories (media, captions, publishing times) and the performance metrics Instagram provides for them, such as views, likes, comments, shares and saves.
• Instagram access tokens: the credentials Instagram issues so that SOGA can act for the connected account. We store them encrypted and never display or share them.
• Content you create in SOGA: drafts, edited media and scheduled posts and stories.
• Device and security data: the device name and platform you sign in from, sign-in and last-activity times, and security logs.

We access Instagram only through Meta's official API, with the permissions you grant on Instagram's own login screen. We never ask for your Instagram password, we do not support personal Instagram accounts and we do not scrape Instagram.

Why we use your data

• To provide SOGA: analyze the performance of your content, explain what to improve, prepare weekly reports and help you edit and schedule content.
• To publish to Instagram only when you explicitly ask us to, for example by scheduling or confirming a post.
• To keep accounts secure: sign-in, session management and the prevention of fraud and abuse.
• To send service emails, such as email verification, password reset and notices that an Instagram connection needs to be renewed.
• To meet our legal obligations.

Some explanations in SOGA may be written with the help of AI language models. They work from figures that SOGA calculates from your data; they do not create numbers. We do not sell your personal data and we do not use it for advertising.

Legal bases

Under the GDPR we process your data because it is necessary to perform our contract with you (Art. 6(1)(b)), to comply with legal obligations (Art. 6(1)(c)) and for our legitimate interest in keeping SOGA secure and reliable (Art. 6(1)(f)). Under the KVKK the corresponding grounds are Article 5(2)(c), (ç) and (f). Where the law requires your consent, we will ask for it separately, and you can withdraw it at any time.

Instagram and Meta

When you connect an Instagram account, you authorize SOGA on Instagram's own screen and can see the permissions requested. We use data received from Instagram only to provide the SOGA features you use, in line with the Meta Platform Terms. Your use of Instagram remains subject to Instagram's own terms and policies. You can disconnect the account in SOGA at any time, and you can ask for its data to be deleted (see the Data Deletion Instructions).

If you remove SOGA from your Instagram account and ask for your data to be deleted there, Meta sends us a data deletion request. We always honor these requests and give you a confirmation code that you can check on our data deletion status page.

Who we share data with

We share personal data only with service providers that process it on our behalf (for example hosting, email delivery and, where used, AI providers) under data processing agreements, and with public authorities when the law requires it. The list of these providers will be published here before SOGA launches.

Some providers may process data outside Türkiye or the European Economic Area. In that case we use the safeguards required by the KVKK (Article 9) and the GDPR, such as standard contractual clauses.

How long we keep data

• Account data: as long as your SOGA account exists; deleted within 30 days after the account is deleted.
• Instagram access tokens: until you disconnect the Instagram account or the connection ends for another reason; deleted immediately at that point.
• Instagram profile, content and insights: kept after you disconnect the Instagram account, so your history and reports stay available; deleted within 30 days after you delete your SOGA account, ask us to delete them, or Meta sends us a deletion request for the account.
• We do not delete accounts or data because they have been inactive; your data stays until you or Meta ask us to delete it.
• Security logs: kept for a limited period of at most 12 months.
• Backups: deleted data can remain in encrypted backups for up to 30 more days until the backups are overwritten.

How we protect data

Data is encrypted in transit (HTTPS). Instagram access tokens are also encrypted at rest. Access to data is limited to what each workspace member's role allows, and each workspace's data is kept separate from other workspaces.

Your rights

Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to data portability and to withdraw consent. You can also lodge a complaint with the data protection authority in your country.

Under Article 11 of the KVKK you have the right to learn whether your data is processed and to request information about it, to learn the purpose of the processing and whether the data is used for that purpose, to know the third parties in Türkiye or abroad to whom it is transferred, to request its correction, erasure or destruction and the notification of these steps to those third parties, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing. You can also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

To exercise your rights, email info.sogaapp@gmail.com. We reply within 30 days at the latest.

Children

SOGA is a tool for professional accounts and is not intended for anyone under 18.

Cookies

The SOGA website does not use advertising or analytics cookies. The SOGA app keeps your sign-in session in your device's secure storage.

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect.