Kervanhof Platform privacy policy

Last updated: 26 October 2026

In short

Your shops and your social media accounts belong to you. You set your passwords; we don’t know them and don’t store them.
We only publish posts that you have approved.
Your data is stored in Germany (Frankfurt, European Union).
We do not sell your data and we do not share it with advertisers.
You can disconnect at any time and ask us to delete your data.

Who we are

Kervanhof helps Turkish makers sell their own products abroad, starting with Germany. The Kervanhof Platform is where the Kervanhof team prepares product texts and social media posts, and where the shop owner approves them.

Until the company is registered, Kervanhof is run by Yusuf Mirza Pıçakcı.

Responsible: Yusuf Mirza Pıçakcı
Address: Samsun, Türkiye
Email: info@kervanhof.com
Phone and WhatsApp: +90 545 587 62 55

What this page covers

This page covers the Kervanhof Platform: the panel at panel.kervanhof.com and the connections it makes to shops’ accounts on Instagram, Facebook and Pinterest. On Meta and Pinterest, our app is called “Kervanhof”.

It does not cover:

Our public website, kervanhof.com. The website has its own privacy page.
What Meta and Pinterest do with data on their own services. For that, see their privacy policies:

Our two roles

For a shop’s content and its connected accounts, Kervanhof works for the shop owner and follows the owner’s instructions. The owner decides. The contract with the shop sets this out.
For panel accounts, logins and security, Kervanhof decides. The controller for this data: Yusuf Mirza Pıçakcı.

Who uses the panel

Shop owners.
The Kervanhof team: team members and language checkers who work with us under contracts that bind them to confidentiality.
The admin.

Everyone has their own account; there are no shared logins. Team members see only the shops they are assigned to.

What we collect

Each row is one kind of data: what it is, why we use it, the legal basis and how long we keep it.

Data	Why	Legal basis	How long
Panel accountsName, phone number, role, the shops the person works on, and the languages a language checker may check.	To let the right people in and show each person only their own shops.	Contract	While the person has access. Deleted within 30 days after access ends.
Login codes and login attemptsOnce phone login is turned on, login codes are sent by WhatsApp or SMS through Twilio. Twilio creates and checks the codes; we don’t store them. We record login attempts with the phone number and IP address stored only as keyed hashes, never in plain form. To limit very frequent requests, we keep a keyed hash of the IP address for one minute.	To stop abuse.	Legitimate interest (security)	Login attempt records are deleted after 2 days, request limit records after one minute.
PasskeysThe fingerprint or face check happens on the person’s own device and never reaches us. We store only a public key.	To log in securely.	Contract and legitimate interest (security)	Until the person removes the passkey or their account is deleted.
Session cookie (kh_session)An essential cookie.	To keep you logged in.	Contract (essential cookie)	Shop owners: 30 days, renewed to 30 days on each day you use the panel. The Kervanhof team: 7 days from login, not renewed.
Login cookie (kh_login)An essential cookie. Between entering your phone number and entering the code, it remembers which login is in progress.	To complete the login.	Contract (essential cookie)	15 minutes.
Passkey cookie (kh_passkey)An essential cookie. It recognises a passkey check while it is in progress.	To complete a login or registration with a passkey.	Contract (essential cookie)	5 minutes.
Shop contentProducts, photos (location and camera data are removed on upload), texts in each language, prices, notes, social media posts, videos from the shop’s shoots, voiceovers and subtitles.	To prepare and publish what the owner approves.	Contract with the shop	While the shop works with Kervanhof. When the shop leaves, the owner gets an export and the content is deleted within 30 days. Raw video clips are deleted 90 days after upload; if a post made from a clip is still being prepared then, the clip waits until that post is published or removed. The finished videos of the posts are kept with the shop’s content.
People in videosThe maker, team members or presenters who appear or speak in a video. Only with their signed consent, which also says where the video may be used.	So they can appear in the shop’s videos.	Consent. It can be withdrawn for the future.	The video and the consent are kept while the shop uses the video. If consent is withdrawn, we stop using the video in new posts and delete it from the platform within 30 days. Posts already published stay on the shop’s accounts unless the shop removes them; we tell the shop. The signed consent form is kept for 3 years after the video’s last use, as proof.
WhatsApp approvalsOnce this feature is available, you can turn it on in Hesabım (your account page). For each video post you then get a WhatsApp message: a preview of the video, the market, the time, the start of the caption, and the buttons Onayla (approve), Değiştir (change) and Panelde aç (open in the panel). A post still waiting two days later gets one reminder, and each month you get a summary of the report. Your reply is added to the post as a note. Twilio sends the messages; Twilio and WhatsApp (Meta) receive your phone number, the preview and your reply. Members of the Kervanhof team who switch it on get one reminder for a late task.	So you can approve posts without opening the panel.	Contract (you switch the feature on)	Until you switch it off in Hesabım or write “DUR” (stop). The record of the messages and your notes are kept with the post.
History (Geçmiş in the panel)A log of who did what and when, visible to the shop owner. For example: Ayşe from the Kervanhof team wrote the caption, Mehmet checked the German, the owner approved. It never contains passwords, tokens or codes.	To show who did what.	Legitimate interest (accountability) and contract	Kept with the shop’s content.
Connected accountsSee “Connected accounts” below.	To publish the posts the owner approved and show how they did.	Contract with the shop	Access token: until the account is disconnected. Links and statistics of Instagram and Facebook posts: until the owner asks us to delete them or the shop leaves. Data from Pinterest: at the latest 30 days after disconnecting.
Technical logsErrors and requests, without phone numbers or codes.	Security and keeping the service running.	Legitimate interest (security, keeping the service running)	14 days.
BackupsEncrypted.	To restore data after a failure.	Legitimate interest (not losing data)	30 days. Deleted data leaves the backups within 30 days.

What we never collect

Passwords for Instagram, Facebook, Pinterest or any other account. The account owner sets the password; Kervanhof never stores passwords, and the platform never receives one.
Orders or buyers’ personal data. Orders and shipping stay with the shop owner.
Payment card data.
Data for tracking, analytics or advertising. The panel has no cookies or pixels for these purposes.

Connected accounts

How connecting works

The account owner, or Kervanhof using the partner access the owner gives, approves the connection on the platform’s own page (OAuth). Kervanhof receives an access token, not a password. Tokens are encrypted, stored apart from other data, never shown in a browser and never written to logs. Only the parts of the platform that publish and read statistics can use them.

If we help open an account, it is opened in the owner’s name with the owner’s email address, and the owner sets the password. If we open the account before the setup visit, it gets a temporary password. At the visit, before anything is connected, the owner changes it on their own phone and turns on two-step login.

Instagram and Facebook (Meta)

We receive the ID and name of the Instagram professional account and of the Facebook Page.
We publish the videos and captions the owner approved.
We read statistics for those posts (views, reach, likes), the account’s follower count and its audience by country. These are totals from Meta; we never see individual viewers or followers.
We store each post’s ID and link.

Once Pinterest is connected:

We receive the business account’s name and ID and its list of boards.
We create the Pins the owner approved, on the board chosen, linking to the shop’s own product pages.
We read statistics for the account and those Pins: impressions, saves, outbound clicks, video views.
We store each Pin’s ID and link.

What we never do with data from connected platforms

Read other people’s accounts, Pins or boards.
Follow, like, comment or send messages.
Change account settings.
Sell or rent this data.
Share it with advertisers or data brokers.
Use it to train AI models.
Combine it with other data to build profiles of people.

Disconnecting

You can disconnect in two ways:

Write to us at info@kervanhof.com.
Remove Kervanhof’s access in the platform’s own settings. Menu names can differ between apps and versions:

Instagram: If you approved the connection on Instagram: in the Instagram app, go to your profile and tap Menu. Under “Your app and media”, tap “Website permissions”, then “Apps and websites” and “Active”, and tap “Remove” next to Kervanhof.
Facebook: If you approved the connection on Facebook: Menu → “Settings and privacy” → “Settings”. Under “Your activity”, tap “Business integrations”, select Kervanhof and tap “Remove”.
Meta partner access: If you gave Kervanhof partner access on Meta: remove it in your Meta business settings.
Pinterest: If you gave Kervanhof partner access on Pinterest: in your business account, open the menu at the top left, choose “Business Manager” under “Manage business”, open the “Partners” tab and remove Kervanhof.

We delete the access token at once.

Instagram and Facebook: post links and statistics stay in the shop’s history until the owner asks us to delete them or the shop leaves.
Pinterest: we delete all data from Pinterest (Pin IDs, links, statistics) within 30 days. The history keeps only our own entries, for example “a Pin was published on 3 November”, with no Pinterest data in them.

Where data is stored and who helps us

Your data is stored in the European Union, in Frankfurt, Germany.

Our service providers:

Amazon Web Services: Server, database, files and backups, in Frankfurt.
Cloudflare: The address, HTTPS and protection in front of the panel. It sees IP addresses and requests.
Twilio: Login codes by WhatsApp or SMS, once phone login is turned on; WhatsApp messages, once WhatsApp approvals are turned on.

Each provider processes only what its job needs, under its own data processing terms.

Our team works from Türkiye and opens the panel from there.

Meta and Pinterest receive what the owner approves for publishing, under their own policies, and may process it outside the European Union. Once WhatsApp approvals are turned on, WhatsApp (Meta) also receives the messages.

Security

HTTPS everywhere.
Tokens are encrypted at rest.
Every action is checked on the server.
Each shop’s data is kept separate in the database, so a team member of one shop cannot see another shop.
Team accounts are by invitation only, and passkeys are required.
The history log cannot be edited.

If you find a security problem, write to info@kervanhof.com.

Your rights

Under Article 11 of Türkiye’s Personal Data Protection Law No. 6698 (KVKK), you have the right:

to learn whether your personal data is processed;
to ask for information about it if it is;
to learn why it is processed and whether it is used for that purpose;
to know who it is passed to in Türkiye and abroad;
to have it corrected if it is incomplete or wrong;
to have it deleted or destroyed;
to have corrections and deletions passed on to those it was passed to;
to object to a result against you that comes only from automated analysis of your data;
to claim damages if you suffer harm because your data was processed unlawfully.

If you live in the European Union and the General Data Protection Regulation (GDPR) applies, you also have the right:

to learn whether we process your data, and to get a copy;
to have it corrected;
to have it deleted;
to get it in a portable format;
to object;
to restrict its use;
to withdraw consent you gave for videos, for the future.

Write to info@kervanhof.com. Requests are free of charge, and we answer within 30 days. For a shop’s content, we act on the shop owner’s instructions and pass requests on to them.

Complaints: in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu); in the EU, the data protection authority where you live.

Personal Data Protection Authority (kvkk.gov.tr)

Deleting your data

To disconnect one platform, follow the steps under “Disconnecting”.

Disconnecting

To delete everything:

Email info@kervanhof.com or send a WhatsApp message to +90 545 587 62 55.
We confirm that the request really comes from you.
We delete your data within 30 days and tell you when it is done.
Copies in the backups are gone within 30 days after that.

Shop owners can get an export of their records first.

Children

The panel is for businesses and adults. It is not meant for anyone under 18.

Changes

We update this page when the platform changes, for example when TikTok or YouTube are connected. The date at the top changes. For important changes, shop owners see a notice in the panel.

This page is a translation of the Turkish original. If the two differ, the Turkish text applies.