Privacy Policy
This policy explains what personal data the Brand Corner website (brandcorner.co) collects, why, who receives it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK).
1. Who we are
The data controller for personal data collected through brandcorner.co is SAAS CORNER DANIŞMANLIK VE EĞİTİM HİZMETLERİ SANAYİ TİCARET LİMİTED ŞİRKETİ, Mehmet Ali Paşa Mah. Ogün Sok. No:1, Kocaeli, Türkiye ("Brand Corner", "we", "us"). Brand Corner is part of Corner Group.
MERSİS No: 0735223096400001 · Tax No: 7352230964 (Alemdar Tax Office) · Trade Registry No: 37886 (Kocaeli Trade Registry Office)
You can contact us about privacy at [email protected].
2. In short
- You can create a Brand Corner account to use the panel. We store the name, email address and account type you enter, a salted hash of your password (never the password itself), and the profile and campaign details you add there. The website has no online payments.
- If you choose to, you can connect your Instagram, TikTok, YouTube or LinkedIn account to the panel through the platform's own sign-in page (OAuth). We never ask for your social media password and never post or change anything on your account. We read only basic profile details and audience figures, such as your follower count and the average views, likes and comments on your recent posts. For Instagram, we also add your recent posts to the Posts section of your panel, where only you can see them. You can disconnect at any time, which deletes what we stored for that account (see Disconnecting a social media account).
- Besides the account sign-up and sign-in forms, the website has a newsletter sign-up in the footer of some pages. It collects your email address, and our form service also records your IP address and browser information.
- We do not set cookies ourselves and do not use advertising or analytics tracking scripts.
- Our hosting provider, Cloudflare, processes technical data such as your IP address to deliver the website.
- The About page and the blog load fonts from Google Fonts, and the blog also shows images hosted by Pexels; these providers receive your IP address.
3. What we collect
We collect personal data electronically, in two ways: through the forms you fill in, and automatically when your browser loads the website.
Newsletter form
The home, features, pricing and solutions pages have a "Stay Updated" newsletter form in the footer. When you submit it, your browser sends your entry to our form service, which runs on Cloudflare Workers and stores each submission in a Cloudflare D1 database. A submission contains:
- the email address you enter;
- the page you submitted it from and the website name (brandcorner.co);
- the date and time of the submission;
- your IP address; and
- your browser's user-agent string (information about your browser and operating system, up to 300 characters).
Giving your email address is voluntary and is not a legal or contractual requirement. If you do not give it, you will not receive our news and updates; you can still use the rest of the website.
A copy of the submission (your email address, the page, the website name and the time, but not your IP address or user-agent string) is then sent by email to our team's mailbox.
To prevent spam and abuse, we limit how many submissions can be sent from one IP address in a short period.
Contact form
The contact page has a form for questions about campaigns, plans or partnerships. When you send it, your browser sends your message to the same form service, which stores it in the same Cloudflare D1 database. A message contains:
- your name, your email address and your message;
- your company name, if you enter it (this field is optional);
- the page and the website name (brandcorner.co);
- the date and time; and
- your IP address and your browser's user-agent string.
A copy of the message (everything above except your IP address and user-agent string) is sent by email to our team's mailbox, so that we can reply to you. We use it only to answer your message. Sending a message is voluntary; you can also email us directly at [email protected].
Account and panel
When you create an account on the sign-up page, we store your name, email address, account type (brand, influencer or agency), the page language and a salted hash of your password. We also store the date and time you confirmed that you have read our privacy notice and agree to the Terms of Service. In the panel you can add profile details (for example city, bio, niches and social media accounts with follower counts), campaigns and applications; these are stored with your account.
To stop password guessing and abuse, each sign-up and sign-in attempt is recorded with your IP address and the email address entered; these records are deleted after one day. Each new account is also recorded with your name, email address, account type, language and IP address, and a copy without the IP address is sent by email to our team's mailbox.
Influencers can also record their posts in the panel, one by one or by importing a CSV file. For each post we store the link, platform, type, date, caption and thumbnail image link you enter, and the likes, comments, views and reach figures you enter for each day. Only you can see your posts in the panel; they are not shown to other members. If you connect an Instagram account, we also add your recent Instagram posts to this list automatically (see below).
Connected social media accounts
In the panel, under Profile → Social accounts, you can connect an Instagram, TikTok, YouTube or LinkedIn account. Connecting is optional. You sign in on the platform's own page and decide there whether to give Brand Corner access (OAuth), so we never see or store your social media password. One social media account can be connected to only one Brand Corner account.
When you connect an account, the platform gives us an access token, and for some platforms a refresh token, that lets our service read the data below on your behalf. We read it when you connect and then about once a day while the account stays connected:
| Platform | Permissions we ask for | What we read |
|---|---|---|
| Instagram (professional accounts) | instagram_business_basic, instagram_business_manage_insights | Your account ID, username and follower count; for your 12 most recent posts, the link, date, type, caption and the link to the post's image or cover, the number of likes and comments, and the views and reach figures from the post's insights |
| TikTok | user.info.basic, user.info.profile, user.info.stats, video.list | Your account ID, username, display name and follower count; for your 12 most recent videos, the number of views, likes and comments |
| YouTube | youtube.readonly (read-only) | Your channel ID, name, handle and subscriber count (if it is public); for your 12 most recent uploads, the number of views, likes and comments |
openid, profile, email | Your LinkedIn member ID and name. LinkedIn also sends your email address; we do not use or store it. We do not keep a LinkedIn access token and do not read anything else. |
From this, we store:
- a record of the connection: the platform, your username (or channel name), the account ID, the connection date and status, and the last error, if any;
- the access token and refresh token, encrypted (see section 8), with their expiry date and the permissions granted;
- each time we read the data, one record of the totals and averages: follower or subscriber count, average views, likes and comments, the number of posts they are based on, and the date; and
- for Instagram only, your 12 most recent posts: the link, type, date, caption and the link to the post's image or cover, with one record per day of their likes, comments, views and reach. They appear in the Posts section of your panel, where only you can see them. For TikTok, YouTube and LinkedIn, we do not store figures for individual posts.
Apart from the Instagram post details listed above, we do not read or store the content of your posts or videos, their captions, your messages, or who your followers are, and we do not post, comment, like or send messages on your behalf.
While you connect an account, we also keep a single-use security code that expires after at most 10 minutes and is deleted once used.
We use this data only to show your audience figures in your panel and, as described in section 5, to brands and agencies on Brand Corner, and to list your Instagram posts in your panel. We do not sell it, use it for advertising, or use it to train artificial intelligence models.
YouTube. Brand Corner uses YouTube API Services to read the YouTube data above. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. Besides disconnecting in the panel, you can remove Brand Corner's access at any time on the Google security settings page.
Google API Services. Brand Corner's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When you visit the website
The website is hosted on Cloudflare Pages. To deliver pages to you and protect the service, Cloudflare processes technical data about each request, such as your IP address, the address requested, the time of the request and your browser's user-agent string. How Cloudflare handles this data is described in the Cloudflare Privacy Policy.
Cloudflare also asks browsers that support it to report network errors (Network Error Logging). If a request to the website fails, your browser may send Cloudflare a short report with technical details of the failed request, such as the address requested and the type of error. Successful requests are not reported.
Fonts and images from other providers
The About page, the blog and blog posts load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), and the blog and blog posts show images hosted by Pexels (images.pexels.com). When you open these pages, your browser connects directly to Google and Pexels, which receive your IP address and browser information. See the Google Privacy Policy and the Pexels Privacy Policy.
What we do not collect
Because the website has no online payments, we do not collect payment details through it. We never ask for your social media passwords. We do not use advertising or analytics tracking scripts and do not build profiles of visitors.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR / KVKK) |
|---|---|---|
| Sending you the news and updates you signed up for | Email address | Your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) |
| Keeping a record of newsletter sign-ups | Email address, page, website name, date and time | Compliance with a legal obligation, including keeping records of your consent (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)), and, where necessary, establishing, exercising or protecting a right (KVKK Art. 5(2)(e)) |
| Replying to your contact form message | Name, email address, company (if given), message, page, website name, date and time | Our legitimate interest in answering the questions people send us (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Preventing spam and abuse of the forms | IP address, user-agent string, date and time | Our legitimate interest in keeping the form secure and free of abuse (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Running your account and the panel | Name, email address, account type, language, password hash, profile, campaigns, applications, the posts you record, sign-in token and the record of your confirmation (date and time) | Performance of a contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Showing the audience figures of the social media accounts you connect, in your panel and to brands and agencies as described in section 5, and listing your Instagram posts in your panel | Platform, username, account ID, follower or subscriber count, average views, likes and comments, date read, the access tokens used to read them, and for Instagram your recent posts' link, type, date, caption, image link and daily likes, comments, views and reach | Performance of a contract with you, at your request when you connect the account (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Preventing password guessing and abuse of accounts | Sign-up and sign-in attempt records (IP address, email address entered, date and time) and the IP address in the sign-up record | Our legitimate interest in keeping accounts secure (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Delivering the website and keeping it secure | Technical request data and network error reports (processed by Cloudflare) | Our legitimate interest in delivering a working and secure website (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Showing fonts on the About page and the blog, and images on the blog | IP address and browser information (received by Google and Pexels) | Our legitimate interest in displaying the website properly (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
We do not make decisions about you based solely on automated processing, and we do not use your data for profiling.
5. Who receives your data
- Cloudflare, Inc., which hosts the website (Cloudflare Pages), runs our form service and its database (Cloudflare Workers and D1) and forwards form emails (Cloudflare Email Routing).
- Our email provider, which hosts the mailbox that receives form submissions.
- Google, when you open the About page or the blog, and Pexels, when you open the blog, as described above.
- Meta (Instagram), TikTok, Google (YouTube) and LinkedIn, only for a platform whose account you connect. You sign in on the platform's page; our service then uses your access token to request the data described in section 3, and when you disconnect, it asks TikTok and Google to revoke our access. Each platform handles your data under its own policy: Instagram, TikTok, Google, LinkedIn.
- Other Brand Corner members, who see what the panel shares: signed-in influencers see open campaigns with the owner's account name; brands and agencies see listed influencer profiles (name, bio, city, niches and social media accounts with follower counts); a campaign's owner sees the name and profile of each influencer who applies to or is invited to that campaign; and an influencer sees the owner's name on their applications. If an influencer connects a social media account, the brands and agencies who can see that influencer's profile, or a campaign they applied to or were invited to, also see the account's username and its latest figures (followers or subscribers, average views, likes and comments, and the date they were read). The figures from a brand's or agency's own connected accounts are shown only to that account. Email addresses, access tokens, social media account IDs and the posts you record are not shown to other members.
- Public authorities, if we are required by law to disclose data.
We do not sell your personal data and do not share it with advertisers.
6. International transfers
Cloudflare is based in the United States and operates a global network, so your data may be processed outside Türkiye and the European Economic Area, including in the United States. Our email provider, Google and Pexels, and Meta, TikTok and LinkedIn if you connect an account with them, may also process data in other countries.
Under KVKK Article 9, we rely on appropriate safeguards such as standard contracts announced by the Personal Data Protection Board or binding corporate rules.
7. How long we keep it
- Email address used to send you news and updates: 2 years from your last contact with us, or until you object.
- Records of your consent and objection (sign-up email, page, website name, date and time): for the period required by law.
- Contact form messages: kept for as long as needed to answer your request and for the retention periods required by law, then deleted or anonymised.
- IP address and user-agent string kept to prevent spam and abuse: 2 years.
- Account details, profile, campaigns, applications and the posts you record: while your account is open. You can ask us to close your account and delete this data (see section 10).
- Access tokens, audience figures and imported Instagram posts of a connected social media account: while the account stays connected. When you disconnect it, we delete them immediately and keep only the record that it was disconnected (platform, username and dates) until your account is closed. If you connect a different account on the same platform, the previous account's figures and imported posts are deleted. Posts you entered yourself are not affected.
- If you remove Brand Corner's access on the platform's side instead, we can no longer read new data, but the figures and posts already stored remain until you disconnect in the panel or ask us to delete them.
- Single-use security codes used while connecting an account: at most 10 minutes.
- Sign-in sessions: 30 days, or until you sign out; expired sessions are deleted automatically.
- Sign-up and sign-in attempt records: 1 day.
- The IP address in the sign-up record: 2 years, as for other IP addresses kept to prevent abuse.
- Technical request data and network error reports: kept by Cloudflare under its own policies.
At the end of these periods, we delete, destroy or anonymise the data we hold.
8. Security
The website is served over HTTPS and tells browsers to connect to it only over HTTPS (HSTS). The form service only accepts new submissions; it offers no way to read stored submissions over the internet. Access tokens for connected social media accounts are stored encrypted (AES-GCM), are used only by our service to read the data described in section 3, and are never shown in the panel. Panel data can only be reached with a valid sign-in token, and other members see only what the panel shares with them: open campaigns, profiles their owners have chosen to list, and, for a campaign's owner, the profile of each influencer who applies to or is invited to that campaign, together with the connected-account figures described in section 5. No method of sending or storing data over the internet is completely secure.
10. Your rights under the GDPR and KVKK
Depending on where you live and which law applies, you have the rights below. To use them, contact us at [email protected]. We may need to confirm your identity before we act on a request.
Under the GDPR
- Access: get a copy of your personal data and information about how we use it (Article 15).
- Rectification: have inaccurate data corrected (Article 16).
- Erasure: have your data deleted in certain cases (Article 17).
- Restriction: ask us to limit how we use your data in certain cases (Article 18).
- Data portability: receive the data you gave us in a machine-readable format, where processing is based on consent or a contract and is carried out by automated means (Article 20).
- Objection: object to processing based on our legitimate interests, and object at any time to the use of your data for direct marketing (Article 21).
- Withdrawal of consent: where processing is based on your consent, withdraw it at any time; this does not affect processing carried out before the withdrawal (Article 7(3)).
- Complaint: complain to a data protection supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place (Article 77). See the list of EU supervisory authorities.
We respond within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period can be extended by two further months; if so, we will tell you within the first month (Article 12(3)).
Under KVKK (Law No. 6698, Article 11)
You have the right to:
- learn whether your personal data is processed;
- request information about the processing if your data has been processed;
- learn the purpose of the processing and whether your data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom your data is transferred;
- ask for your data to be corrected if it is incomplete or inaccurate;
- ask for your data to be erased or destroyed under the conditions in Article 7 of KVKK;
- ask for the third parties to whom your data was transferred to be notified of a correction, erasure or destruction;
- object to a result against you that arises from the analysis of your data exclusively by automated systems; and
- claim compensation if you suffer damage because your data was processed unlawfully.
We conclude KVKK applications as soon as possible and within 30 days at the latest, free of charge, unless the action requires an additional cost, in which case a fee set by the Personal Data Protection Board may be charged (Article 13). If your application is rejected, you find our answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) within 30 days of learning our answer, and in any case within 60 days of your application (Article 14).
Unsubscribing from the newsletter
You can ask us at [email protected] at any time to delete your newsletter sign-up.
Disconnecting a social media account and deleting its data
To disconnect an Instagram, TikTok, YouTube or LinkedIn account and delete the data we received from it:
- Sign in to Brand Corner and open the panel.
- Go to Profile → Social accounts.
- Select Disconnect next to the account and confirm.
We then immediately delete the account's access tokens, all audience figures we stored for it and, for Instagram, the posts we added to your Posts section; brands and agencies no longer see the figures. Posts you entered yourself stay. For TikTok and YouTube, we also ask the platform to revoke Brand Corner's access.
You can also remove Brand Corner's access on the platform's side:
- Instagram: in the Instagram app, Settings and activity → Website permissions → Apps and websites, or Apps and websites on the web.
- TikTok: in the TikTok app, Settings and privacy → Security & permissions → Apps and services permissions.
- YouTube: the Google security settings page.
- LinkedIn: Settings → Data privacy → Permitted services.
Removing access there stops us from reading new data but does not by itself delete what we already stored, so also disconnect in the panel or email us.
If you cannot sign in, or want us to delete this data for you, email [email protected] from the email address of your Brand Corner account, naming the platform and the username. We delete the data, including the connection record, and confirm by email within 30 days. To close your Brand Corner account and delete all of its data, including your posts and every connected account, email us in the same way.
11. Children
The website is intended for brands, influencers and agencies, not for children. The newsletter form is not intended for anyone under 18.
12. Links to other websites
The website links to other websites, such as other Corner Group companies and LinkedIn. Those websites have their own privacy policies, and this policy does not cover them.
13. Changes to this policy
We may update this policy. The current version is always available on this page, with the date of the last update at the top.
14. Contact
For questions or requests about your personal data, email [email protected] or write to SAAS CORNER DANIŞMANLIK VE EĞİTİM HİZMETLERİ SANAYİ TİCARET LİMİTED ŞİRKETİ, Mehmet Ali Paşa Mah. Ogün Sok. No:1, Kocaeli, Türkiye.
See also our Terms of Service.