Privacy Policy and KVKK Information Notice

Your personal data is processed by Fluint Digital Ltd (“favslay”, “we”) as data controller. Fluint Digital Ltd owns and operates the favslay and uygunsecim brands and is a company established in the United Kingdom.

As a data controller established outside Türkiye, we process personal data of people in Türkiye under the Turkish Personal Data Protection Law No. 6698 (KVKK). Users and visitors in Türkiye can exercise their rights under KVKK art. 11 as described in “How to make a request” below. For people in the United Kingdom and the European Economic Area, the UK GDPR / GDPR also applies (see “Your rights under the UK GDPR and GDPR”).

favslay is software that lets creators and influencers build a product recommendation site on username.favslay.com or their own domain, add products and send visitors to stores. Product names, images and prices are read from stores' public pages using the store reading service of our sister service uygunsecim.

• Users: creators who open an account, build a site and share products on favslay.
• favslay.com visitors: people visiting our main site, Discover pages, blog and help pages.
• Visitors of creator sites: people who visit a site built with favslay, subscribe to its newsletter, set a price alert or sign up. The roles of the creator and favslay differ here; see “Our role on creator sites”.

We do not ask for special categories of data (health, religion, ethnic origin, biometrics etc.). Please do not share such data about other people in your content.

We collect personal data electronically and partly automatically through sign-up and login forms, Google and Apple sign-in, the dashboard and Studio, the payment page (Stripe), support and contact forms, emails, and cookies and similar technologies.

We never sell your personal data. We share it only as needed to run the service, with these recipients:

Stores: when you click a store link you go to the store's website. The link may carry the creator's affiliate code or a source tag; the store and the affiliate network may use their own cookies and are subject to their own privacy policies. favslay does not pass your identity to the store.

International transfers (KVKK art. 9)

Some of the providers above have servers outside Türkiye. Transfers abroad follow KVKK art. 9: based on an adequacy decision of the Turkish Personal Data Protection Board where one exists, otherwise with appropriate safeguards such as the Board's standard contractual clauses (notified to the Authority within 5 business days of signing), provided one of the conditions in art. 5 or 6 is met.

Where no appropriate safeguard is available, a transfer may only be made occasionally and in the cases listed in art. 9/6 (for example when necessary to perform our contract with you, or with your explicit consent after being informed of the possible risks).

When the period ends, data is deleted, destroyed or anonymised at the next periodic destruction run (within 6 months at the latest).

• All connections are encrypted (HTTPS).
• Passwords are stored as one-way hashes.
• Card details never reach us; payments run on PCI-DSS compliant Stripe.
• Access to data is limited to authorised people and only as needed, and is logged.
• We take regular backups; in case of a data breach we notify the people affected and the Board within 72 hours as required by KVKK art. 12/5.

favslay is the platform creators use to build their own sites. For data about visitors of creator sites the roles are:

• The creator (site owner) is the data controller for the newsletter subscribers, members and contact messages collected on their site and for any analytics or ad tools they add (e.g. Google Analytics, Tag Manager, Meta Pixel). The creator must publish their own privacy notice, obtain any required consents (cookie consent, marketing consent) and answer visitor requests. favslay Studio offers legal page fields for this.
• favslay is the data processor: we host this data for the creator, send the creator's newsletter emails and show the creator statistics, and we do not use it for our own purposes beyond the creator's instructions and this notice.
• favslay is the data controller for platform security, abuse prevention, aggregate and anonymous statistics, the technical sending of price alert emails, and favslay marketing emails that a site visitor separately consented to.

Creators only see aggregate numbers (views, clicks, country, referring site); visitors' IP addresses are not shown to creators. Your newsletter or sign-up email is shared with the creator you subscribed to or signed up with.

You can send requests about a creator site to that creator or to [email protected]; if the request concerns the creator we forward it and let you know.

You have the right to:

• learn whether your personal data is processed,
• request information about the processing,
• learn the purpose of processing and whether data is used accordingly,
• know the third parties in Türkiye or abroad to whom data is transferred,
• request correction of incomplete or inaccurate data,
• request deletion or destruction under the conditions of KVKK art. 7,
• request that corrections and deletions be notified to the third parties data was transferred to,
• object to a result against you arising solely from automated analysis,
• claim compensation if you suffer damage from unlawful processing.

You can withdraw consent at any time; this does not affect processing carried out before the withdrawal.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller you can send your request:

• from the email address registered on favslay to [email protected] (fastest),
• in writing with a wet signature by post or via a notary to 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Please include your name, signature (for written requests), Turkish ID number (for foreigners: nationality and passport or ID number), postal address, email and phone if any, and what you are asking for.

We answer free of charge within 30 days; if the request involves extra cost, the fee set by the Board may be charged. If your request is refused, you find the answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request.

You can also do some things yourself: delete your account and data under Account settings > Delete account, unsubscribe from marketing emails via the link in each email, and change your cookie choices in Cookie settings.

As our company is established in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply; for people in the European Economic Area the GDPR applies. Our legal bases are performance of a contract (art. 6(1)(b)), legal obligation (art. 6(1)(c)), legitimate interests (art. 6(1)(f)) and consent (art. 6(1)(a)).

You have the right to access, rectify and erase your data, restrict or object to processing, and to data portability. Send requests to [email protected]. You have the right to complain to the UK Information Commissioner's Office (ICO, ico.org.uk); if you live in the EEA you can contact your local data protection authority.

You must be at least 18 to open a favslay account. If we find an account belonging to someone under 18 we close it and delete the data.

favslay.com and the dashboard always use strictly necessary cookies and use functional, analytics and marketing cookies only with your consent. Details and how to change your choice are in the Cookie Policy.

When we update this notice we change the date at the top. We announce significant changes by email or a dashboard notice.