This translation is provided for convenience. If it differs from the Turkish version, the Turkish version prevails.
This notice explains which personal data Igora collects and why, who we share it with, how long we keep it and how you can exercise your rights. It fulfils our duty to inform under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and includes GDPR information for users based in the European Union.
1. Data controller and scope
This policy covers the igora.shop website, the app.igora.shop seller panel, the API services behind them, and our communication with you by email and WhatsApp. The data controller for these channels is:
For data about buyers in your stores (your customers) you are the controller; Igora processes that data only on your instructions, as a processor (see section 10).
2. What we collect and how
We collect data directly from you through web forms and the panel, from the stores you connect through their APIs, and automatically while you use the service (server logs, cookies).
- Application form: full name, email, phone, chosen package, the platforms you want to sell on, estimated sales volume, budget range, your message, confirmation that you are over 18, and language.
- Contact form and newsletter: name, email, phone, relevant office, subject and message; for the newsletter only your email address.
- Account and profile: first and last name, email, phone, profile photo, short bio, social media links, country, address and billing details (business name, tax ID, billing email), notification preferences and two-factor status. Your password is stored by our identity provider as an irreversible hash; Igora cannot see it.
- Company formation and financial account services: only if you buy this service; ID or passport details, residential address, registration and EIN documents of the formed company, and the information required by payment and bank account applications.
- Platform usage: the products and designs you create, images you upload, your conversations and prompts with the AI assistant, connected stores and their access tokens, orders, wallet transactions and notification history.
- Order data from your stores: the buyer's name, shipping address, email and phone, order contents and tracking details.
- Payments: your card details are held by our payment provider; Igora stores only the transaction reference, amount and date.
- Collected automatically: IP address, browser and device information, sign-in and last access times, audit records of significant actions in the panel, and cookies (see section 4).
3. Purposes and legal bases
We process personal data on the following grounds under KVKK Articles 5 and 6 (and the corresponding GDPR Article 6 bases):
| Purpose | Legal basis |
|---|---|
| Reviewing your application, opening your account and providing the panel | Performance of a contract |
| Producing and shipping orders and syncing them with marketplaces | Performance of a contract |
| Coordinating company formation, tax ID and financial account applications | Performance of a contract; legal obligation |
| Taking payments, invoicing and accounting records | Legal obligation |
| Answering support requests by email and WhatsApp, sending service notifications | Performance of a contract; legitimate interest |
| Running AI-assisted design, text and analysis tools | Performance of a contract |
| Account security, fraud prevention, access and audit logs | Legitimate interest |
| Aggregated, anonymous usage statistics to improve the service | Legitimate interest |
| Website analytics (Google Analytics) | Consent, via the cookie banner |
| Newsletter and marketing messages | Consent; you can withdraw it at any time |
| Responding to lawful requests from authorities | Legal obligation |
We do not request or process special categories of data (health, religion, biometrics and the like). ID documents are used only for the company formation service and only as far as the official application requires.
6. International transfers
Some of the providers above are located outside Turkey. Transfers abroad rely on one of the safeguards in KVKK Article 9: an adequacy decision published by the Board, standard contractual clauses, or your explicit consent where the law allows it. Store connections and company formation applications are carried out on your instructions and to perform the contract. For users in the EU, transfers are governed by the GDPR standard contractual clauses.
7. Retention periods
| Data | Period |
|---|---|
| Account and profile data | For as long as you have an account. Deleted or anonymised within 30 days of your deletion request, except records we must keep by law. |
| Invoices, payment and accounting records | 10 years (Turkish Commercial Code and Tax Procedure Law) |
| Order records and buyer contact details | Order records for the accounting period; buyer contact details for 2 years after delivery |
| Application and contact form records | Up to 2 years after the request is closed |
| Newsletter subscription | Until you unsubscribe. Records of consent and withdrawal are then kept for 3 years as required by Turkish commercial email rules. |
| Access, session and audit logs | 2 years |
| AI chat history | Until you delete it or your account is deleted; you can delete conversations in the panel |
When a period ends, data is deleted, destroyed or anonymised in line with the Turkish regulation on the deletion, destruction and anonymisation of personal data.
8. Security
- All connections are encrypted with TLS.
- Passwords are stored as irreversible hashes; optional two-factor authentication (TOTP) is available.
- The panel uses role-based access control; administrator actions and access changes are logged with who, when and why.
- Card data is never stored on our servers.
- Marketplace access tokens are kept server-side only and never sent to your browser; you can disconnect a store from the panel at any time.
- Servers and software dependencies are updated regularly; access follows the least-privilege principle.
In the event of a data breach we notify the Turkish Personal Data Protection Board and affected individuals as soon as possible and within 72 hours, as required by KVKK Article 12.
9. Your rights
Under KVKK Article 11 you have the right to:
- Learn whether your personal data is processed and, if so, request information about it,
- Learn the purpose of processing and whether data is used in line with it,
- Know the third parties, in Turkey or abroad, to whom data is transferred,
- Request correction of incomplete or inaccurate data,
- Request deletion or destruction under the conditions in KVKK Article 7,
- Request that corrections and deletions are notified to third parties who received the data,
- Object to a result that is to your detriment and produced solely by automated analysis,
- Claim compensation for damage caused by unlawful processing.
If you are based in the EU you also have the GDPR rights to data portability and to lodge a complaint with your local supervisory authority.
How to apply: send your request from the email address registered with us to [email protected] or in writing to the address above. We may ask for additional information to verify your identity. Requests are answered within 30 days and, as a rule, free of charge. To delete your account you can also use the account deletion request on the Profile page of the panel. If you are not satisfied with the outcome, you can complain to the Turkish Personal Data Protection Board.
To stop newsletter and marketing messages, use the unsubscribe link at the bottom of every email or write to [email protected]. WhatsApp notifications can be switched off under Settings in the panel.
10. Your customers’ data: our role as processor
You are the controller of buyer data transferred from your stores. Igora processes it only to produce and ship the order, pass tracking details to the marketplace and report to you, following your instructions; we do not use it for any other purpose or for our own marketing. Informing your customers and complying with marketplace rules is your responsibility. On request, we help you correct or delete a buyer’s data.
11. Sign in with Google and Google user data
When you sign in to the panel (app.igora.shop) with Sign in with Google, Google shares only your name, email address, profile picture and Google account ID with us (the openid, email and profile scopes). We do not ask for access to Gmail, Drive, Calendar, contacts or any other Google service.
- We use this information only to identify you, sign you in to your account and confirm your account's contact email.
- We do not sell Google user data or use it for advertising, marketing or training AI models. We share it with no one except Supabase, the authentication provider we need to run the service.
- Igora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We keep this information while your account is open and delete it when you delete your account. You can remove Igora's access to your Google account at any time in your Google account settings.
12. Children
Our services are for people aged 18 or over; the application form asks you to confirm this. If we learn that we hold data about someone under 18, we delete it.
13. Changes and contact
We update this policy as our services or the law change; the current version and its date are published on this page. We notify you of significant changes at your registered email address.