Privacy Policy
Version 1.1 · Effective date: 2026-10-07
This policy explains how the PREVED platform (preved.co and the brand store domains hosted on PREVED) processes personal data under the Turkish Personal Data Protection Law No. 6698 (KVKK). PREVED is operated by HEYV PHARMA Kozmetik Ticaret ve Sanayi Limited Şirketi. The Turkish version is the governing text; this English version is provided for convenience.
1. Data controller and contact
Data controller: HEYV PHARMA Kozmetik Ticaret ve Sanayi Limited Şirketi, Demirtaş Mah. 77034 Sk. Bahar Perde No: 11/A Toroslar / Mersin.
Privacy and data requests: privacy@heyvaql.com
2. Whose data do we process?
- Shoppers: people who buy from a brand's store on PREVED.
- Creators: people who voluntarily connect their Instagram professional account (Business or Creator) to PREVED using “Connect with Instagram”.
- People who write to creators: people who comment on, message, mention or tag a creator connected to PREVED on Instagram. We have no direct relationship with them; their data reaches us through Instagram (Meta) because the creator connected their account.
- Prospective creators: owners of public Instagram professional accounts not yet connected to PREVED; we obtain their public profile information through Meta's official interface so we can offer them a PREVED collaboration (see “Why we contacted you”).
3. Data we receive from Instagram
When you connect your Instagram account, Instagram (Meta) shows you the permissions you grant. We only access data you have authorized. We never see your Instagram password.
| Permission | Data we receive | What we use it for |
|---|---|---|
instagram_business_basic | Instagram account ID, username, account type, follower count, media count; list of your posts (link, type, date) | Connecting your account to PREVED, showing you your connected account, matching your posts to your sales links |
instagram_business_manage_insights | Account and post insights (views, reach, engagement) and aggregated audience demographics (age range, gender, city, country) | Building your performance reports; showing brands you work with only the aggregated summary you approve |
instagram_business_manage_comments | Comments on your posts (comment text and the commenter's Instagram username) | Letting you view and reply to comments in one place and surface product questions |
instagram_business_manage_messages | Instagram messages received by and sent from your account | Letting you view and reply to your messages in one place |
What we do not do: we do not collect follower or liker lists (Instagram does not provide them). We do not sell Instagram data, do not build advertising profiles, and do not automatically match people who comment or message with shopper accounts. We process Instagram Platform Data in accordance with the Meta Platform Terms and only for the purposes described here.
If you wrote to a creator
- Controller: HEYV PHARMA Kozmetik Ticaret ve Sanayi Limited Şirketi, Demirtaş Mah. 77034 Sk. Bahar Perde No: 11/A Toroslar / Mersin. Contact: privacy@heyvaql.com.
- What data: your Instagram username and app-scoped ID, display name, follower count, whether your account is verified, whether you follow the creator (only if you sent a message); the text and time of your comment or message; which post it was on; your reactions to messages; posts in which you mention or tag the creator.
- How we get it: when you write to the creator, Instagram (Meta) automatically forwards it to PREVED, which the creator has connected.
- Why: so the creator can reply to you from one place, see messages still waiting for a reply, and follow conversations on their account as numbers.
- Legal basis: for your public comments, data you made public yourself (KVKK Art. 5/2-d); for messages and account management, the creator's and our legitimate interest (KVKK Art. 5/2-f).
- What we don't do: we don't sell your data, use it for ads, or share it with other creators or brands. We don't match you with your records on other creators' accounts. We don't analyse your messages with AI. We link you to a shopper account only if you agree to it yourself during a purchase.
- Who sees it: only the creator you wrote to. Our hosting and backup providers process it on our behalf.
- How long: comment and message text for 12 months. If you don't interact with a creator for 24 months, your record is deleted, and only numbers that can't be linked to you remain (e.g. "this post got 40 comments"). If the creator disconnects PREVED, all related records are deleted within 30 days. If you delete a message on Instagram, we delete its text too.
- Your rights: you have the rights in KVKK Art. 11 (access, correction, deletion, objection, compensation). Email privacy@heyvaql.com with your Instagram username; we delete within 30 days at the latest and let you know.
4. Data we collect from shoppers
- Phone number (account and verification code), full name and delivery address, order details.
- Consent record: version of the text you accepted, time, brand and IP address (as proof).
- Verification code: we store only a hash of the code, not the code itself; a code is valid for 5 minutes.
- Cookies: a session cookie (sign-in and checkout) and the
pv_vidvisit cookie.pv_vidis a random ID kept for 90 days to measure which source (ad, creator link, etc.) brought you to a store. IP address and browser details are not stored for this measurement.
5. Legal bases (KVKK Art. 5)
- Performance of a contract/service (Art. 5/2-c): connecting accounts, orders, delivery.
- Legal obligation (Art. 5/2-ç): keeping order and invoice records for the statutory periods.
- Legitimate interest (Art. 5/2-f): security, abuse prevention, source measurement.
- Explicit consent (Art. 5/1): asked separately where required and can be withdrawn at any time.
6. Retention
| Data | Retention |
|---|---|
| Instagram access token | While connected. Deleted immediately when you disconnect or remove PREVED's access from Instagram. |
| Instagram profile data and insights | While connected; deleted within 30 days after you disconnect. Deleted immediately on a deletion request. |
| Text of comments and messages sent to creators | 12 months from when written, then the text is deleted. Text of a message you delete on Instagram is deleted immediately. |
| Record of a person who wrote to a creator (username, name, counts) | 24 months after that person's last interaction with the creator; then deleted, leaving only totals that cannot be linked to the person. |
| Prospective creator (public profile) | Up to 6 months if we don't make contact; 12 months if we write and get no reply; immediately if you ask us not to contact you (only a hash of your username is kept so we don't write again). |
| Backups | Deleted data drops out of backups within 35 days. |
| Shopper account and addresses | Until the account is deleted. |
| Order records | For the period required by law (up to 10 years for commercial/tax records). |
pv_vid visit cookie | 90 days. |
| Data deletion request record | A confirmation code and date are kept permanently as proof; your Instagram ID is not kept in plain form in this record. |
7. Who do we share data with?
- Brands: the brand you buy from sees your order and delivery details to fulfil the order. Brands see a creator's Instagram data only as an aggregated summary approved by the creator.
- Service providers: hosting, encrypted backups, verification code delivery (WhatsApp/Meta), and an AI service that may be used to suggest replies to comments/messages. They process data only on our behalf and instructions. Some providers may host data outside Türkiye; such transfers follow KVKK Art. 9.
- Competent public authorities where required by law.
We do not sell personal data.
8. Security
Instagram access tokens are stored encrypted in our database and are never displayed on any screen or written to logs. Token exchange with Instagram happens only on our server. Verification codes are stored as hashes. Backups are encrypted.
9. Your rights (KVKK Art. 11)
You may ask whether your data is processed, request information, learn the purpose and recipients, request correction or deletion, ask that recipients be notified, object to outcomes of automated analysis and claim compensation for damages. Contact privacy@heyvaql.com; we respond within 30 days.
10. How do I delete my data?
Step-by-step instructions: Data Deletion.
11. Changes
When we change this policy we update the version and date at the top of this page and ask for consent again where required.