Pavern Privacy Policy

Welcome to Pavern. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our social media management (SMM) platform and our Managed service.

Account information: Your name, email address, and payment information when you subscribe.

Connected social media accounts: When you connect your accounts (X/Twitter, LinkedIn, YouTube, Instagram, Facebook, TikTok) via OAuth, we receive authentication tokens. We never store your social media passwords.

Platform data: We fetch analytics data (likes, views, engagement) only to display in your Pavern dashboard.

We use your data only to provide Pavern's core functions:

• To publish, schedule, and manage content on your behalf through our AI tools and your dashboard.
• To let the specialist assigned to you create content on your behalf, only if you use the Managed add-on.
• To generate performance analytics.
• To send you product news and offers by email, only if you opted in.

Pavern uses several third-party APIs. By using Pavern, you also accept the privacy policies of these platforms:

Google/YouTube: Pavern uses YouTube API Services. By using Pavern, you agree to be bound by the YouTube Terms of Service. Pavern's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. YouTube Terms of Service and Google Privacy Policy

X (formerly Twitter): We strictly comply with the X Developer Agreement. We don't use X data for mass automation, spam, or unauthorized surveillance. Terms & Privacy Policy

Meta (Facebook & Instagram): We comply with the Meta Platform Terms and Developer Policies. We access only the accounts and content you authorize via OAuth, and never your password. Instagram and Facebook

TikTok: We comply with the TikTok Developer Terms of Service. We access only the content you authorize for publishing to your own account. Terms & Privacy Policy

LinkedIn: We comply with the LinkedIn API Terms of Use. We post only on your behalf, with your explicit consent, to your own profile and to the company pages you administer and connect. Terms & Privacy Policy

We don't sell your personal data. We share your data only with:

• Pavern team: If you use the Managed add-on, the specialist (Lancer) assigned to your account has limited access to your content and scheduled posts in order to carry out your tasks.
• Service providers: Providers that run our hosting, email, SMS, AI and payment services on our behalf. Section 9 lists who they are and where they are located.

You can revoke Pavern's access to your social media accounts at any time directly from your social media settings or the Pavern dashboard. After account deletion, your data and access tokens are securely deleted from our servers within 30 days. Manage or revoke Google/YouTube access

We use a small number of cookies and similar browser storage. On your first visit we ask for your consent through a banner.

• Strictly necessary. These keep you signed in, protect our forms from bots (Cloudflare Turnstile), and remember your cookie choice (pavern_cookie_consent, stored for about a year). The site cannot function without them, so they do not require consent.
• Analytics and marketing. We do not currently set analytics or advertising cookies. If we add them in the future, they will load only after you accept them in the banner.
• Managing your choice. You can change your decision at any time by clearing the pavern_cookie_consent cookie or this site’s data in your browser, which brings the banner back. You can also block cookies in your browser settings, though some necessary features may then stop working.

We take the protection of your data seriously, especially sensitive data such as your account credentials and the access tokens for the social accounts you connect. We apply the following safeguards:

• Encryption in transit. All traffic between you and Pavern, and between Pavern and connected platforms (Google, Meta, X, LinkedIn, TikTok and others), travels over encrypted HTTPS/TLS connections.
• Encrypted token storage. The access and refresh tokens for your connected social accounts are stored encrypted at rest using AES-256-GCM. They are never sent to your browser or written to logs in plain text.
• Credential protection. Account passwords are stored only as salted, one-way hashes, never in plain text, and two-factor authentication (2FA) is available to further protect your account.
• Access controls. Access to data is gated by authentication and role-based permissions, and internal access follows the principle of least privilege.
• Payment data. We do not store your full card number. Payments are processed by a PCI-DSS-compliant payment provider.
• Data minimization and deletion. We collect only the data needed to provide the service and keep it only as long as necessary. You can disconnect any account or request deletion at any time; revoking access immediately removes our ability to use that data.
• Google user data (Limited Use). Data obtained through Google APIs is used solely to provide the features you request and is handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements. It is never sold or used for advertising.

This section is our information notice under Türkiye's Personal Data Protection Law No. 6698 (KVKK).

Data controller: Pavern is operated by TAPTAKE BİLİŞİM TEKNOLOJİ SATIŞ HİZMETLERİ YAZILIM SANAYİ TİCARET ANONİM ŞİRKETİ, Batı Mah. Hat Boyu Cad. İntay İş Hanı Bl. No: 28/28, Pendik, İstanbul, Türkiye. This company is the data controller for the personal data of Pavern users, Lancers and pavern.com visitors described in this policy. For personal data of other people that our customers process through Pavern, such as comments and messages arriving on their connected accounts and their email campaign subscriber lists, the customer is the data controller, and Pavern processes that data only on the customer's instructions, as a data processor. Please send requests about that data to the owner of the account.

Data we process: Identity and contact data (your name, username and email address; your phone number, city and profile description if you add them at sign-up or on your profile; and the phone number you use for SMS two-step verification if you turn it on); customer transaction data (your plan, subscription and payment records, but not your card details, which the payment provider handles); the content you create or upload and the messages you send to our support team; data from the social accounts you connect (access tokens, your own posts and replies, and analytics); transaction security data (IP address, browser information, session and log records, sign-in and verification events); and, for Lancers, the application you submit (name, email address, phone number, birth date, city and country, experience, skills, portfolio link and motivation), performance records (customer ratings and comments, strikes and dispute outcomes) and payout details (Payoneer email address and earnings).

How we collect it: Electronically: through the forms and panel on pavern.com, from the social platforms you connect via OAuth, through cookies (see section 7), through support conversations, and automatically from server logs while you use the service.

Purposes and legal bases: We process this data to open and run your account, provide the service you choose, take payments, answer support requests, keep the service secure and protect our rights in possible disputes; for Lancers, also to evaluate applications, offer Lancers to customers, track the quality of their work, settle disputes and make payouts. The legal bases are the establishment and performance of our contract with you (KVKK art. 5/2-c), compliance with our legal obligations, such as keeping invoices and accounting records (art. 5/2-ç), the establishment, exercise or protection of a right in possible disputes, such as payment chargebacks or account suspensions (art. 5/2-e), and our legitimate interest in securing the service and preventing abuse, provided it does not harm your fundamental rights and freedoms (art. 5/2-f). Where none of these applies, we ask for your explicit consent first. That is how we send product news and offers by email: only if you opted in (KVKK art. 5/1), and you can withdraw that consent at any time with the unsubscribe link in each email or in your email preferences. An AI system may approve or reject a Lancer application, or decide a weekly-task dispute, automatically when it is highly confident; you can object to such a decision and ask for a person to review it by writing to us as described under How to apply.

Retention: We keep personal data only as long as its purpose requires. When you delete your account, your data is deleted as described in section 6, except records the law requires us to keep, such as invoices and accounting records, which we keep for the period the law sets. Security logs (IP address, browser information, and sign-in and verification events, which may include your email address) are kept for up to 180 days for security and to protect our legal rights, and are then deleted automatically, even if you have deleted your account.

Who we transfer it to: Only as far as the purposes above require: to the social platforms you connect (Meta, Google/YouTube, X, LinkedIn, TikTok), on your instruction, to publish to and read from your own accounts; to the Lancer, an independent freelancer, whom you choose for the Managed add-on or for a job you post; to customers, a Lancer's name, profile label and average rating, so they can choose a Lancer; to the service providers listed below, which process data on our behalf; to the payment provider that takes your payment; and to public authorities when the law requires it.

Transfers abroad: All of our servers and several of our providers are outside Türkiye, so personal data is transferred abroad.

• Namecheap (USA): hosting of our application and database servers.
• Cloudflare (USA, global network): content delivery, security, load balancing and file storage.
• Google (USA): AI features (Vertex AI and the Gemini API), including the review of Lancer applications and disputes, and the storage behind them.
• Resend (USA): sending service emails, such as sign-in, billing and notification messages, and marketing emails if you opted in.
• Twilio (USA): sending SMS verification codes when you turn on SMS two-step verification.
• Payoneer (USA): paying Lancers.
• Payment provider: the provider named on the checkout page, which takes your payment as the seller; it may be located outside Türkiye.
• Social platforms: the platforms you connect are located abroad; data goes to them only on your instruction.
• Lancers (any country): the Lancer you choose for the Managed add-on or for a job may be located outside Türkiye and receives your content, brand settings and name only to do the work you give them.

Your rights: Under article 11 of KVKK you have the right to:

• learn whether your personal data is processed;
• request information about it if it is;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for it to be corrected if it is incomplete or inaccurate;
• ask for it to be deleted or destroyed under the conditions in article 7 of KVKK;
• ask for the correction or deletion to be notified to the third parties it was transferred to;
• object to a result against you that arises from analyzing the data exclusively through automated systems;
• claim compensation if you suffer damage because your data was processed unlawfully.

How to apply: Send your request to [email protected] from the email address registered to your Pavern account, or in writing to the address above. We answer free of charge within 30 days at the latest; if answering involves an additional cost, we may charge the fee set by the Personal Data Protection Board. If we reject your request, you find our answer insufficient, or we do not answer within 30 days, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your application. If you live in the EU or the UK, you also have the rights given by the GDPR, including the right to complain to your local data protection authority.