Privacy Policy and Data Protection Notice

1. Data controller

The data controller is VidSense (vidsense.co). You can reach us about anything related to your personal data at [email protected].

2. Data we process

• Account data: name, email address, password (only as an irreversible hash), language, time zone and notification preferences.
• Usage data: content and captions you check, videos and images you upload, analysis results and allowance usage.
• Payment data: plan, subscription status and order records. Card details are processed by Polar and Stripe and are not stored by VidSense.
• Technical data: IP address, browser information and session records. Abuse-prevention counters store a salted hash of the IP address, not the address itself.
• Connected Instagram account: when you connect your account, within the scope Meta permits, profile data, posts (caption, type, date, link), post and account insights (such as reach, engagement, saves and shares) and the analysis results produced from them. The access token is stored encrypted.
• Instagram analyses: the usernames you look up. Instagram data is obtained only through Meta's official APIs and within the permitted scope; we do not scrape.

3. Purposes and legal bases

We process your data to create and manage your account, run analyses, handle payments and subscriptions, send service-related notifications, keep the service secure and prevent abuse.

Legal bases (KVKK Art. 5): entering into and performing our contract with you, complying with legal obligations (e.g. accounting records), and our legitimate interest in securing and improving the service. You can turn off weekly summary and alert emails in Settings.

4. AI analysis

Content and captions you submit are sent for analysis to Google's Gemini API (paid tier) and Anthropic's Claude API. Gemini watches a video and transcribes what is said, written and shown in it; Claude assesses it from that transcript, a few still frames and your caption. Images and texts are also analysed by one of these two providers. Neither provider uses content submitted this way to improve its models. Your content is never published anywhere outside VidSense.

If you connected your account, the captions of your posts are sent to these providers on the same terms during the account analysis, and on the Creator plan and above your latest Reels are sent to the Gemini API only. Videos are processed only temporarily during the review and deleted when it ends; no transcript is stored. Only the review result is kept: the moment the main idea becomes clear, the cover text, the opening and CTA scores and possible risk signals.

5. Transfers and sub-processors

To provide the service, your data is shared with the following providers only as far as necessary. Some of them are located outside Türkiye, so your data is transferred abroad in accordance with Article 9 of the KVKK.

• Google (Gemini API): content and caption analysis.
• Anthropic (Claude API): content and caption analysis.
• Google Workspace: sending service emails.
• Google Analytics 4 (Google Ireland Limited / Google LLC): aggregate measurement of how the site is used. Your Instagram data, email address or user ID are not sent to Google Analytics; identifiers and query details are removed from page addresses before they are sent, and advertising signals are turned off.
• Cloudflare: delivering and protecting site traffic, temporary storage of uploaded media (R2).
• Polar and Stripe: payments, invoicing and subscription management.
• Hosting: the provider of our database and application servers.

6. Retention

• Uploaded raw videos and images: at most 24 hours after the analysis is complete.
• Check results: until you delete them or your account is closed.
• Posts, insights and video review results from a connected account: deleted 30 days after you disconnect it (at the next cleanup if you request data deletion through Meta) or when your account is closed.
• Account data: while your account is open.
• Payment and order records: for the period required by law.
• Abuse-prevention counters: 35 days; IP hashes in profile scan records: 90 days.
• Privacy requests: 3 years after they are resolved.

7. Cookies

Necessary cookies are required for the service to work: the sign-in cookies that keep your session open (session cookies prefixed with better-auth), the NEXT_LOCALE cookie that remembers your language, the vs_cookie_notice cookie that remembers that you closed the cookie notice (180 days) and Cloudflare's security cookie. We do not use advertising or tracking cookies.

In addition, there are two functional preference cookies: vs_account remembers the account you selected in the panel's top bar and vs_period remembers the analysis period you selected, so your choice carries over between pages. Both are first-party cookies, stay in your browser and are not used to track you.

Analytics cookies: we use Google Analytics 4 (Google Ireland Limited / Google LLC) to measure in aggregate how the site is used and to improve the service; it sets the _ga (2 years) and _ga_<container ID> (2 years) cookies. Identifiers and query details are removed from the page addresses sent to Google, and analytics does not run on shared report links. Your analytics data may be processed by Google on servers abroad.

You can delete or block cookies in your browser settings, and you can turn off Google Analytics measurement with Google's browser add-on (tools.google.com/dlpage/gaoptout). If you block necessary cookies, features such as signing in will not work.

8. Your rights

Under Article 11 of the KVKK, you have the right to learn whether your data is processed, request information about it, learn its purpose and whether it is used accordingly, know the third parties it is transferred to, request correction of incomplete or inaccurate data, request deletion or destruction, object, and claim compensation for damages.

You can download a copy of your account data as a JSON file at any time in the panel under Settings → Data and privacy (“Download my data”). In the same section, “Delete my account” deletes your account: the deletion happens as soon as you confirm it with the link we send to your email address and cannot be undone. A paid subscription ends without a refund; your invoices stay with our payment provider Polar. Records we are required to keep (e.g. payment records) are kept with your personal details removed; copies in backups are deleted when the backups expire.

Send other requests to [email protected]; we respond within 30 days at the latest. People without an account can also send erasure or access requests about their own Instagram profile through the privacy request form.

9. Security

Connections are encrypted (HTTPS), passwords are stored irreversibly, and access to data is limited to authorized people.

10. Changes

We may update this policy; we will announce material changes on the site or by email.