Privacy Policy

The data controller is ADCROPPER YAYINCILIK HİZMETLERİ TİCARET LİMİTED ŞİRKETİ, Tomtom Mahallesi, İstiklal Caddesi, Mısır Apartmanı No: 163, Kat: 5, Daire: 20, Beyoğlu, İstanbul, Türkiye (“Adcropper”, “we”). You can reach us at contact@adcropper.com and our Data Protection Officer at privacy@adcropper.com.

This policy is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for people in the European Economic Area and the United Kingdom, under Articles 13 and 14 of the GDPR. It covers:

• our websites: www.adcropper.com, igaming.adcropper.com and ecommerce.adcropper.com;
• the Adcropper platform (platform.adcropper.com) and its editor;
• ads that our customers build in Adcropper and serve through Adcropper;
• the Adcropper MCP server (mcp.adcropper.com), which connects Adcropper to AI assistants such as Claude and ChatGPT.

When you contact us. The contact form asks for your name, company email, company (optional), the products you are interested in, how you found us and a message. If you tick the box, we also record your consent to receive our newsletter.

When you browse our websites. With your consent, cookies and similar technologies record the pages you visit, the buttons and sections you interact with, your device and browser type, an approximate location derived from your IP address, and the ad or website that brought you to us (campaign parameters and ad click identifiers). See Cookies.

When your company uses the platform.

• Company details: company name, website, country, number of employees, contact person and contact email.
• Billing details: billing name, tax number, billing address and country, invoices and payment records.
• User accounts: first and last name, email address, phone number, job title, role and permissions, and your password.
• Content you create or upload: creatives, images, videos, fonts, data feeds, campaigns, landing pages, comments and approvals.
• Integrations you connect: API keys for AI providers, stored encrypted and shown only in masked form, and access tokens for ad platforms such as Google Campaign Manager 360, Adform and Meta.
• Usage and security records: sign-ins, actions in the platform, IP address, browser and device information.

When you see an ad served by Adcropper. To report campaign performance to our customers, we record impressions and clicks, the type of device and an approximate location derived from the IP address. We process this data on behalf of the customer running the campaign, who decides how it is used.

When you use Adcropper through an AI assistant. See AI integrations and MCP.

Technical data. Like every online service, our servers and the providers that deliver our fonts and scripts receive your IP address and browser details when a page loads.

We do not ask for identity card or passport numbers, dates of birth, health data or other special categories of personal data. Providing your name and email is necessary for us to answer an enquiry, and company, billing and account details are necessary to provide the platform; without them we cannot do so.

Hashed email for ad measurement. If you have accepted Marketing cookies and send the contact form, a one-way hashed (SHA-256) version of your email address is passed to Google and Meta so they can tell us whether one of our ads led to the enquiry. Your email address itself is not sent to them for this.

We do not sell personal data and do not make decisions about you based solely on automated processing.

The Adcropper MCP server (mcp.adcropper.com) lets you use certain Adcropper functions from AI assistants such as Claude (Anthropic) and ChatGPT (OpenAI) through the Model Context Protocol. These integrations are optional. You connect one by signing in with your Adcropper account; the assistant then acts only with the permissions of that account.

What we receive. Only the requests and content the AI assistant sends to our tools. Depending on what you ask, this can include your Adcropper account and workspace identifiers; brand, campaign, set and feed information; content and files you choose to access or submit; the instructions and actions the assistant requests; the results we return; and technical and security records of each request. We do not receive or request your full conversation history, your assistant's memory or files you have uploaded to the assistant.

What we do with it. We use it to authenticate the connection, check your permissions, read, create or edit content at your request, return results, keep the service running, provide support and detect security issues or misuse. Actions taken through a connected assistant change the content stored in your Adcropper account, and other members of your team see those changes.

No model training. We do not use information exchanged through MCP integrations, or the content you create in Adcropper, to train AI models.

The AI assistant's provider. Anthropic, OpenAI or the provider of any other assistant you use processes your instructions and the results we return under its own privacy notice, terms and account settings, as an independent controller. We do not control how they handle that information. Review their terms before connecting, especially before sharing personal or confidential information.

Disconnecting. You can revoke access at any time in the connector settings of your AI assistant, and your company administrator can remove your access to Adcropper. Disconnecting stops new requests; records we must keep for legal or security reasons are kept for the periods in section 8.

Good practice. Never share your Adcropper password with an AI assistant, and do not submit information you are not authorised to disclose.

No cookies are set until you answer the cookie banner. Then we store your choice, and Analytics and Marketing cookies are set only if you accept them. Your choice applies across all three websites. You can change it at any time with Cookie settings in the footer of every page, or here:

If you decline, Google Analytics and Google Ads may still receive cookieless signals without identifiers (Google Consent Mode), which Google uses for aggregated, modelled reporting. LinkedIn and Meta tags do not run at all. Declining does not affect how the websites work.

Providers can change their cookie names and durations; the categories above stay the same.

We share personal data only with the parties that run these functions for us or that you connect yourself:

We may also disclose data to public authorities where the law requires it, and to our professional advisers under confidentiality.

Some recipients above process data outside Türkiye, including in the European Union and the United States. For transfers from Türkiye we rely on Article 9 of the KVKK: standard contracts approved by the Personal Data Protection Board and notified to the Authority, or your explicit consent where no other safeguard applies. For transfers from the EEA we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses.

• Enquiries: as long as needed to answer you and, if we work together, for the business relationship.
• Platform account and company data: for as long as your company's account is active; deleted within one year after the account is closed. You can ask for earlier deletion.
• Invoices, payment and accounting records: 10 years, as Turkish commercial and tax law requires.
• Content you create in the platform: until you or your company delete it, or the account is closed.
• Ad serving statistics: as long as needed to report on the campaign to the customer running it, and no longer than that customer's account.
• MCP request and security records: as long as needed for security, troubleshooting and support, and in any case no longer than your account data.
• Newsletter: until you unsubscribe or withdraw consent.
• Website cookies: for the durations in the cookie table; analytics data up to 14 months in Google Analytics.

Data is encrypted in transit (HTTPS/TLS). Access to personal data is limited to authorised staff who need it for their work, and access within the platform follows the roles and permissions your company assigns. Integration API keys are stored encrypted. Third parties that process data for us are bound to keep it confidential and secure. Our information management is certified to ISO/IEC 27001.

If a breach puts your data at risk, we notify the competent authority within 72 hours where the law requires it, and we tell you without undue delay when the breach is likely to result in a high risk to your rights and freedoms.

Under Article 11 of the KVKK you can ask us whether we process your data and request information about it; learn the purpose and whether it is used for that purpose; know the third parties it is transferred to in Türkiye or abroad; have incomplete or incorrect data corrected; have it deleted or destroyed under Article 7; have third parties notified of a correction or deletion; object to a result against you that comes solely from automated analysis; and claim compensation for damage caused by unlawful processing.

If you are in the EEA or the United Kingdom, you also have the GDPR rights of access, rectification, erasure, restriction, data portability and objection, including to processing based on our legitimate interests.

Where processing is based on consent you can withdraw it at any time, through Cookie settings or by writing to us, without affecting processing that took place before.

For data in ads served on a customer's behalf, or content a company stores in its own account, we pass your request to that company and help it respond.

To use any of these rights, write to privacy@adcropper.com or send a letter to the address in section 1. We answer within 30 days at the latest. If you are not satisfied, you can complain to the Personal Data Protection Authority of Türkiye (Kişisel Verileri Koruma Kurumu) or, in the EEA or the United Kingdom, to the data protection authority where you live or work.

Our websites, the platform and our AI integrations are intended for businesses and are not directed at children under 18. We do not knowingly collect personal data from children.

When we change how we handle personal data we update this page and the date at the top, and we tell platform users about significant changes by email or in the platform. If a change needs your consent, we will ask for it again.