Legal

LA Marketing OS — Privacy Policy

Last updated: 2026-11-09. The Turkish version prevails in case of conflict.

Controller: YCT Sağlık Hizmetleri Ltd. Şti., Alacaatlı Mah. Park Cad. No: 15/15, Çankaya/Ankara · info@lafish.com.tr

1. In short

LA Marketing OS runs on your computer. Your videos, scripts, brand details, AI keys and social media connections stay on your computer and never reach us. Our server does only three things: verifies your license, relays notifications to your phone, and when you connect an account, forwards the platform's return to your computer. It also receives the complaints and suggestions you optionally send us from the app (see 2).

2. Data we process

Purchase: Name, e-mail, plan, payment/subscription status and iyzico references. Phone, ID/passport number and billing address go to iyzico; we also keep them for automatic renewal payments and delete them when renewal is turned off. We never keep the card number; the card is stored by iyzico. See section 9 of the Sales Terms.
License verification: License ID; device ID (randomly generated, unrelated to hardware), device name and type, when added and last seen; computer resets and downloads.
Phone notifications: Your computer sends us the notification title, short text and your phone's push token together with your license document; we relay it via Google Firebase Cloud Messaging (Apple Push Notification service on Apple devices). Content and token are not stored; a daily count per license is kept.
Connecting accounts: Connection return addresses are on our site. When you connect to Meta or TikTok with your own developer app, the platform's one-time code is forwarded through your browser to your computer. When you connect with the LA Marketing OS app (Meta and YouTube), our server exchanges the code for an access token in memory and passes it to your computer. Neither the code nor the token is stored on the server. Access tokens are kept only on your computer, encrypted.
Error reports: If the app crashes or hits an unexpected error, the error message and its technical details, and the app and OS version are sent to the error tracker on our own server. The phone app also sends the device model, memory and screen details, language and time zone settings, and a random ID the error-reporting library creates for that installation; this ID is not linked to you, your account or your license. No video, text, keys, IP address or account data is sent. Error records are deleted after 60 days.
People: The names, descriptions, voice choices and photos of people who appear in your videos are stored only on your computer and never reach us. When you generate video with Gemini, the photo is sent to Google with your key to produce the video; when you create a face with AI, your description goes to Google; if you pick an ElevenLabs voice, the video's audio track goes to ElevenLabs. These transfers are governed by that service's privacy policy. Upload a real person's photo only if it is you or you have that person's written permission.
Translation suggestions: If you fill in and send the "Fix a translation" form yourself, what you write (place, text, your suggestion), the language and app version, and the e-mail you optionally enter reach us; if you send it from the app, your computer forwards it. To limit abuse we keep a short irreversible digest of the IP address, not the IP address itself. Suggestions are used to fix translations and deleted after at most 1 year.
Complaints and Suggestions: If you write to us from the Complaints and Suggestions section of the app, we process: the type you choose (complaint, suggestion, bug), your message and the follow-up conversation, up to 3 screenshots you choose to attach, your e-mail address if you enter it, the app version, platform and device details, language, and your license or device ID (never the license key itself). Screenshots are re-encoded on the server and extra data in them, including location (EXIF), is removed. This data is used only to answer your request and improve the product; it is not used for advertising and is not sold. Your e-mail address is used only because you want the reply by e-mail too; if you leave it empty, the reply shows only in the app. Legal basis: performance of the contract and legitimate interest to answer your request (KVKK art. 5/2-c, f); your explicit consent for the e-mail address (by entering it).
Website: Standard server access logs (IP address, time, requested address). We use no cookies or analytics.

3. Purposes and legal bases

Performance of contract: license, subscription, notifications. Legitimate interest: finding and fixing bugs. Legal obligation: invoicing and accounting. Legitimate interest: preventing abuse (license sharing, excessive notifications).

4. Recipients

iyzico (payments), Cloudflare (hosting the website and license server), Google Firebase / Apple (notification delivery), an e-mail sending service (license e-mail). Some are outside Türkiye and your country; transfers are limited to what the service needs, with appropriate safeguards. Complaint and suggestion records are kept on the same data controller's server in Turkey (api.lafish.com.tr); the full text of new messages is e-mailed to our team (sending: Brevo – Sendinblue SAS, France/EU; mailbox: Zoho Corporation B.V., Netherlands/EU).

5. Your third-party services

Data sent to the AI and social media services you connect with your own keys is between you and that service and governed by its privacy policy; it never passes through us.

When you connect an account to LA Marketing OS, the app can access only what you approve on the platform's consent screen, and uses it solely to publish the videos you approved to your own account:

Meta (Facebook and Instagram): the list of Facebook Pages you manage and the name and ID of the Instagram business account linked to them (pages_show_list, instagram_basic, business_management); publishing the video you approved to your Page and Instagram account (pages_manage_posts, instagram_content_publish); verifying the published post's link (pages_read_engagement); showing the comments on the videos the app published and sending the reply you write or the automatic reply you turn on (pages_read_user_content, pages_manage_engagement, instagram_manage_comments); if you turn it on, sending one private message you set to the person who commented, under Meta's private-reply rules (pages_messaging, instagram_manage_messages). Your inbox is never read and no message history is stored.
YouTube: your channel's name and ID (youtube.readonly) and uploading the video you approved to your channel (youtube.upload).

This data is never used for advertising or profiling, never sold or shared with anyone else, and never used to train AI models. Access tokens are stored encrypted only on your computer; our server relays the one-time code returned by the consent screen to your computer (when you connect through our app, it exchanges the code for an access token and relays that instead) and stores neither the code nor the token.

LA Marketing OS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. By connecting YouTube you agree to the YouTube Terms of Service; Google Privacy Policy: policies.google.com/privacy.

5b. Disconnecting and data deletion

In the app, disconnect the account under Social accounts; the token is deleted from your computer.
Also revoke access on the platform: on Facebook under Settings → Business Integrations, on Google at myaccount.google.com/permissions.
To delete the licence and sales records we hold, write to info@lafish.com.tr; records without a legal retention period are deleted within 30 days.

5c. How we protect your data

Sensitive data (Google/YouTube, Meta and TikTok access and refresh tokens, and your AI keys) is protected as follows:

Encrypted at rest on your computer: Access and refresh tokens are stored in the local database encrypted with AES-256-GCM. The encryption key is a random 256-bit key generated on each computer and kept in the operating system's secure credential store (macOS Keychain, Windows Credential Manager); your AI keys are kept directly in that store too. Tokens are never written to disk or to log files in plain text.
Local-only access: The local database that holds the tokens accepts connections only from the computer itself (127.0.0.1); it cannot be reached over the network.
Encrypted in transit: All communication with Google, Meta, TikTok and our server uses HTTPS (TLS).
No storage on our server: When you connect with our app, our server exchanges the one-time code returned by Google or Meta for an access token in memory and passes it to your computer; when a YouTube access token expires, it relays the refresh request to Google the same way. Codes, access tokens and refresh tokens are not stored, logged or cached on the server. The app's Google client secret and Meta app secret are kept only in Cloudflare's encrypted secret store.
Restricted access: Neither we nor our staff can access your videos, tokens or account content; this data never reaches our server.
Least privilege: We request only the permissions the feature needs (on YouTube, youtube.upload and youtube.readonly; Meta permissions and the purpose of each are listed in 5a). You can revoke access at any time using the steps in 5b.
Retention: Tokens and the channel/page name and ID are kept only on your computer, until you disconnect the account or remove the app; disconnecting deletes them. If you revoke access in your Google account, the token stops working.
Breach notification: If we become aware of a security breach, we will notify affected users and the authorities as required by law.

6. Retention

Sales and invoice records 10 years; license and device records for the subscription and 1 year after it ends; access logs at most 30 days. Complaint and suggestion records are deleted automatically 2 years after the last message.

7. Your rights

To access, correct, delete or object, and for your other rights under KVKK and, where applicable, the GDPR, write to info@lafish.com.tr; we reply within 30 days. You may also complain to your data protection authority.

7a. Requests from public authorities

Data received from Instagram, Facebook and YouTube (account names, access tokens, IDs of comments already answered) is stored only on your own computer; comment content is shown on screen and not stored. Our servers hold no copy of it. We therefore have no ability to disclose that data to a public authority. We only hold license, device and sales records. If we receive a request concerning them:

We only consider requests that comply with applicable law and come in writing from a competent authority (such as a court order or a prosecutor's request); we do not respond to verbal or informal requests.
We review the legal basis and scope of every request, and refuse or legally challenge requests that are unlawful, unclear or overly broad.
We disclose only the minimum data strictly necessary to comply.
Unless legally prohibited, we notify the affected person before disclosure.
We document every request, our response and its legal basis.

Questions: info@lafish.com.tr.