Privacy Policy

This notice explains how your personal data is processed when you use adall, under the Turkish Personal Data Protection Law No. 6698 (KVKK, Art. 10) and the GDPR. It is for information and is not a request for consent.

Data controller

• Pariette Teknoloji Ltd. Şti. (users in Türkiye): Maslak Mah. Ahievran Cad. No: 11-2, Olive Plaza, 34398 Sarıyer / Istanbul, Türkiye. Maslak Tax Office, tax no. 7211005729. MERSİS 0721100572900001. Registered e-mail (KEP): pariette@hs06.kep.tr. Phone: +90 538 257 84 62. E-mail: tech@pariette.com.
• Pariette Inc (users in other countries): 8 The Green, Ste D, Dover, Kent County, DE 19901, USA. EIN 30-1424178. Phone: +1 302 754 3461.
• Requests and contact: tech@adall.io
• Agreements and approvals are made electronically only; no paper contracts with wet signatures are issued.

For the data in the ad accounts you connect and the data your site sends (orders, hashed customer identifiers), you are the controller and adall is the processor; that relationship is governed by the Data Processing Agreement. This notice covers the data of adall's own users.

Data we process

• Identity and contact: name, e-mail, company name, billing details.
• Account security: password hash, two-step verification data, session records, IP address, browser and device type.
• Activity records: what you do in the panel, approvals, the activity log, the version and time of the agreements you accepted.
• Payments: package, amount, payment status. Card details stay with the payment provider and never reach adall.
• Support: chat and e-mail conversations.
• Connections: the id and e-mail address of the platform account you connect; its access key is kept in the encrypted vault.

Purposes and legal bases

• Opening your account, providing the service, taking payment: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Account security, abuse prevention, activity records: legitimate interest (Art. 5/2-f; GDPR Art. 6(1)(f)) and legal obligation (Art. 5/2-ç; GDPR Art. 6(1)(c)).
• Invoices and accounting records: legal obligation.
• Anonymous usage statistics to improve the product: legitimate interest; analytics cookies on the site only with your consent.
• We send no marketing e-mail; only service-related notifications.

How the data is collected

Electronically: from the sign-up and payment forms, your actions in the panel, the APIs of the platforms you connect, and the sales records your site sends.

Where the data is and transfers

• Data of users in Türkiye is processed and stored on servers in Türkiye (CloudSpark); data of users in other countries in the USA (Hostinger, Boston).
• Some tasks are done by subprocessors (backup storage, e-mail, payments, AI). Which company processes which data and where: Subprocessors and Data Location. Subprocessors abroad receive only the data their task needs; these transfers follow KVKK Art. 9 and the GDPR's rules on international transfers.
• Data is never sold or shared for advertising. It is disclosed to public authorities only where the law requires.

Retention

Periods run from the record's own date; automatic deletion runs every night and what it removes is recorded.

• Raw platform responses: 395 days.
• Daily ad figures and breakdowns: 1,125 days (for year-over-year comparison).
• Order amounts: 1,125 days. Hashed e-mail/phone, click ids and landing pages on orders: deleted after 180 days.
• Delivery records to platforms: 180 days.
• Recommendations and the decision journal: 1,125 days.
• Activity (audit) log: 730 days.
• AI call records: 395 days.
• Notifications and sync records: 180 days.
• Vault access records: 395 days.
• Purchase journey records: 14 days after the last step.
• Closed workspace: 30-day grace period, then deletion from every store.
• Invoices and accounting records: as long as tax law requires.
• Backups: 35 days.

Your rights and how to apply

Under KVKK Art. 11 and the GDPR you have the right to learn whether your data is processed, to request information, to learn the purpose, to know the recipients, to rectification, to erasure, to have recipients notified, to object to automated processing and to compensation. Users under the GDPR also have the rights to data portability and to restriction of processing.

• How to apply: write to tech@adall.io from your registered e-mail address, so we can verify your identity.
• Time: we conclude your request free of charge within 30 days at the latest.
• Yourself: you can export your data, remove connections and close your account in the panel.
• If you are not satisfied with the outcome, you may complain to the Turkish Personal Data Protection Authority or, under the GDPR, to your supervisory authority.

Security

How we protect your data: Security and Data Protection. Cookies: Cookie Policy.

Children

adall is a service for businesses; it is not intended for people under 18.

Changes

When this notice changes, the new version is published at this address with its version date below; we tell users about important changes by e-mail.

Google user data

• What we access: when you connect Google Ads, the campaign structure, settings, performance reports (spend, impressions, clicks, conversions, search terms, placements, location, device, hour) and change history of the accounts you grant access to; the identity and e-mail address of the Google account that connected. If you connect Search Console, query, position and click data; if you connect Google Analytics, landing page, campaign and sales reports; if you connect Merchant Center, product, feed and disapproval information.
• What we send to Google: if you turn on sales measurement, your site's orders (order number, date, amount, currency, ad click id and, where the buyer consented, hashed e-mail/phone) go to Google Ads as conversions; if you turn on customer lists, your consenting customers' hashed identifiers go to Customer Match lists, both through Google's Data Manager API. In Merchant Center only the feed and shipping settings you confirm are written.
• What for: only for features shown to you in the panel: reports, audits, recommendations, and changes to your accounts made with your approval or under the authority you granted.
• Sharing: never sold, never used for ad targeting, never transferred to data brokers. Sub-processors that run the service (hosting, storage, e-mail; for the analysis feature, a model provider that receives computed summary figures only) are bound by contract.
• Human access: Adall staff see your data only through a time-limited support view you approve, for a security investigation, or where the law requires; every access appears in your activity log.
• Retention and deletion: retention periods are shown on the workspace page. Removing a connection deletes its access token; closing the workspace deletes the data from every store after the waiting period. You can also revoke access in your Google account's security settings.
• Adall's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Mobile app

• What we collect: a random installation id the app creates itself (not an advertising or hardware identifier), the device's model and manufacturer, operating system and version, the app's version, language and time zone, and whether notifications are allowed. If you allow notifications, your device's push token (Firebase Cloud Messaging / Apple Push Notification service).
• Crash reports: if the app crashes, an error report goes to Firebase Crashlytics (Google); it carries your account's id, never your name or e-mail. You can turn it off in the app's settings.
• Usage statistics: which screens are used is recorded only if you turn it on; it is off by default and can be turned off at any time.
• What we never collect: location, contacts, photos, microphone or camera data; the app does not track you across other apps and websites and does not use an advertising identifier.
• Retention: usage records are deleted after 180 days, installations not opened for 400 days after 400 days. Signing out deletes that device's push token; closing your account deletes all installation and notification records.

Deleting your account

You can close your account at any time: sign in at adall.io and follow Account › Close my account. Your name and e-mail are deleted and every session is signed out. If you cannot sign in, write to tech@adall.io from the address on your account; we complete the request within 30 days.