# Privacy Policy Last updated: 10 November 2026 ## In short - You sign in with a one-time code sent to your email address. There is no password. - We read product data only: never orders or customer lists. We write nothing back to your store. - Requests to AI models go through one gateway of ours, which does not store the text or image you send or the answer. - We do not sell personal data. - You can ask us to delete your data, or use your rights under KVKK, at any time. We answer within 30 days at the latest. ## Who we are and who is responsible for your data Framepx is AI-based software for ad production and product feeds, sold as a subscription. It turns a brand's product data into ad creatives and into product feeds that ad platforms read. This policy explains what personal data we handle on the website framepx.com and in the customer panel at app.framepx.com. It is also our notice under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). Framepx is operated by Framepx - Ahmet Can Köybaşı, a registered sole proprietorship in Ankara, Türkiye. This business is the data controller for the personal data described in this policy. You can reach it at contact@framepx.com. There is one exception. The product data a brand brings into Framepx stays the brand's own. For that data the brand decides what happens, and Framepx works on the brand's behalf (as a data processor), as described under "Product data a brand brings, and what we make from it". ## What we collect on this website You can read framepx.com without an account. When you visit, our hosting provider Cloudflare keeps request logs for us: your IP address, browser and device type, the pages you request and when, and an approximate location (country or city) derived from your IP address. We use these logs only to keep the site secure, for example to block abuse, and to find and fix errors. To measure visits we use Google Analytics 4, loaded through Google Tag Manager. Google sets cookies in your browser for this and collects usage data such as the pages you open, the buttons you click and how far you scroll. Google may process this data outside Türkiye and outside the European Union. Visitors in the European Economic Area, the United Kingdom and Switzerland are measured only after they accept analytics cookies in the banner on the site, and they can change this choice at any time from the cookie settings link at the foot of every page. Our own site sets one cookie for every visitor: it remembers the language you choose, for one year. Visitors in Türkiye, the European Economic Area, the United Kingdom and Switzerland get a second one, fpx_consent, which remembers whether you accepted or rejected analytics cookies, for 182 days (about six months). Your light or dark theme choice is kept in your browser's local storage. Cloudflare may also set a cookie of its own to tell people from automated traffic. The site has two free tools. Feed Inspector fetches the public product feed at the address you enter and shows you a report on it. Creative Score sends the image you upload to an AI model, through the AI gateway described below, and shows you the score. We keep neither the feed address nor the image. To limit daily use, both tools keep a one-way digest of your IP address with a counter for the day, not the address itself. If you book a demo through the link on this site, the booking runs on Google Calendar. We receive the name and email address you enter and the time you pick. If you write to contact@framepx.com, we receive your email address and what you write, and we use them to answer you. We do not sell personal data. ## Your account at app.framepx.com To use Framepx you sign in at app.framepx.com with your email address. We email you a one-time code. There is no password. For your account we keep your email address, your name if you enter one, your language, the state of the account and when it was last used. We also keep the brand you work for in Framepx (its name, website, sector and country) and your role in it. Each sign-in attempt leaves a record: the time, the email address entered, the IP address and whether it succeeded. We use these records to stop code guessing and other misuse of accounts. While you are signed in, the panel keeps a sign-in cookie in your browser. The panel cannot work without it. It is not used for advertising or for following you on other sites. We also measure visits to the panel with Google Analytics 4, loaded through Google Tag Manager, to see which screens are used. We send only the address of each screen, without its query or any code in it, and never your email address or your store's data. If you are in the European Economic Area, the United Kingdom or Switzerland, the panel measures your visits only after you accept analytics cookies. When you sign in for the first time, you accept our terms and confirm that you have read this policy on the sign-in page. We keep a record of the version of the terms you accepted, when you accepted it, how you signed in and a keyed digest of your IP address. - [Terms](https://framepx.com/terms.md) ## Product data a brand brings, and what we make from it A brand gives Framepx its product data by entering the address of a product feed or of its store, or by connecting its store (see Shopify below). From that source we read product fields such as title, description, price, sale price, availability, link and brand, and the product images. We read product data only. We do not ask for orders or customer lists, and we write nothing back to the store. From this data Framepx makes three things for the brand: a cleaned and labelled product list, built with the rules the brand sets; a feed for each ad channel the brand uses, published at a hosted address; and ad creatives rendered for the brand's products. A hosted feed address and the creative images in it can be opened by anyone who has the full address. That is how ad platforms such as Google, Meta, TikTok and Pinterest fetch them after the brand pastes the address there. Each address contains a token, so share it only with the platforms you choose. Product data is business data, and the brand remains responsible for it. If it holds personal data, for example a seller's name in a product description, Framepx processes that data only on the brand's behalf and only for what is described here. We do not use a brand's product data for any other purpose. On the Pro and Premium plans, if you give us the address of your website, Framepx reads its public pages to find your products, your logo and colours, and the campaigns shown there. We read only pages that are open to everyone. We follow the site's robots.txt, we say who we are when we fetch a page, and we do not sign in anywhere or get past a bot check. If a page cannot be read any other way, its text is sent through our AI gateway to an AI model that reads it. We keep a record that you confirmed the website is yours or that its owner agreed. ## The assistant and AI In the panel and in the free tools on this site, requests to AI models pass through one AI gateway that we run. The gateway sends the text or image needed for the task to one of the AI providers named under "Who processes data for us". The gateway does not log or store the text or image you send or the answer. It keeps a usage record: which feature asked, which model answered and what it cost. The panel has an assistant you can write to. Your message, and any brand data the panel adds so that the answer fits your brand, is sent to an AI provider, which returns the answer. Your messages, and files if you attach any, are kept in your conversation in the panel. Please do not put other people's personal data into the assistant. Nothing Framepx does needs it. You can also speak to the assistant. A voice note is held in memory only and sent through our AI gateway to OpenAI to be written out as text, or to Cloudflare's AI models if OpenAI fails. We keep neither the recording nor the text made from it; the text is kept only if you send it as a message. The assistant can also do things for you in the panel, with your approval. Each step it takes is recorded: who asked for it, what was done and the result. Framepx also uses AI models for product work. When you write a product rule as a sentence, only that sentence is sent to an AI model to turn it into a rule, never your product list. When you ask the assistant about your products, a limited set of their details goes with that one turn. These requests go through the same gateway. ## Connected platforms Framepx works with online stores and ad platforms that other companies run. We call them connected platforms. Each part below says what we access, why, what we keep and how to end the connection. A part applies to you only if you use that platform with Framepx. Ending a connection stops our access from that moment. It does not delete what we already hold. To have data deleted, see "Deleting your data". Shopify is the one exception, described under Shopify. ## Sign in with Google If you choose Sign in with Google, Google asks you to approve sharing your basic account details with Framepx (the openid, email and profile scopes). Google then gives us your Google account identifier, your email address and your basic profile details, such as your name. We use them only to open your Framepx account and to recognise you when you sign in. We keep the identifier and the email address with your account. We ask for no other Google data at sign-in. We do not sell this data and do not use it for advertising. To stop, open the page in your Google Account that lists the apps linked to it, choose Framepx and remove its access. This stops the Google sign-in. It does not delete your Framepx account or its data. ## Google Analytics and Merchant Center A brand can connect its Google Analytics (GA4) property and its Merchant Center account to Framepx in the panel. Each is its own approval on Google's consent screen. We ask for the openid and email scopes, read-only access to Analytics (analytics.readonly) and Merchant Center's content scope. That content scope is the only one Google offers for the Merchant Center API and it allows changes, but we use it only to read, and we write nothing to your Merchant Center. Through these connections we read the lists of your Analytics properties and Merchant Center accounts so that you can pick one, the sessions of the last seven days, and the number and names of your products in Merchant Center (up to 5,000). We use them only to show your traffic and your products next to your feeds in the panel. We keep the Google account identifier, its email address as a label, the scopes you granted, the account or property you picked and the access tokens, encrypted and tied to your brand. We do not store the numbers we read; they stay in memory for a few minutes. The connection lasts until you end it. When you disconnect in the panel, we delete the stored access and revoke it at Google, unless another connection of ours uses the same Google account. You can also remove Framepx's access on the page of your Google Account that lists the apps linked to it. Framepx does not connect to Google Ads. ## Google user data and Limited Use Framepx's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. We do not sell, rent or trade the data we receive from Google APIs, and we do not use it for advertising. Inside Framepx it is shown only to the people who have access to your brand in the panel. We disclose it to no other company, except the providers that run Framepx for us, and only so they can do that work: Amazon Web Services keeps the encrypted access and the connection details in our database in its European Union regions, and Cloudflare carries the data between our servers and your browser when the panel shows it. We do not send Google user data to AI models. We hand it to a court or a public authority only when the law requires us to. We protect Google user data as follows. The access Google gives us is encrypted with our own key before it is stored, and the key is kept apart from the database. Our connections to Google and to your browser are encrypted in transit. The numbers we read from Analytics and Merchant Center stay in memory for a few minutes and are never written to our database. Only the people who run Framepx can reach the systems that hold this data. When you disconnect, we delete the stored access and revoke it at Google, as described above. If we want to use Google user data in a new way, we will first update this policy and ask for your consent. ## Meta (Facebook and Instagram) A brand can connect its Meta business account to Framepx in the panel, on Meta's own consent screen. We ask for two permissions: catalog_management and business_management. We read your Meta person id, the businesses you can manage and their product catalogs (id, name and product count), and after we send products, Meta's review state for them. We write only to the one catalog you pick: we add your brand's products there (each product's id, title, description, price, availability, condition, link, image, brand and the optional product fields) and remove a product that has left your feed. We never delete a catalog. We ask you each time before we send. We keep the access Meta gives us encrypted under our own key, your Meta person id, the business and catalog you picked with their names, and for each product only its id, a fingerprint of what we sent and its review state, never the product content itself. We keep this until you disconnect; after that the connection stays in our records as history, without the access. To end the connection, disconnect in the panel: we delete the stored access and withdraw our permissions at Meta, unless another brand of ours is connected by the same Meta person. If you remove Framepx in your Facebook settings, Meta tells us, and we end your connections and delete the stored access. If you ask Meta to have your data deleted, we also delete your Meta person id and unlink the accounts, and Meta shows you the status with a confirmation code. The products already in your Meta catalog stay there; the catalog is yours. - [Data deletion](https://framepx.com/data-deletion.md) ## TikTok Today Framepx does not connect to your TikTok account. You paste the address of your Framepx feed into TikTok Catalog Manager yourself, and TikTok fetches the feed from that address. We receive no data from your TikTok account this way. A direct connection is planned. ## Pinterest A brand can connect its Pinterest business account to Framepx in the panel, on Pinterest's own consent screen. We ask for ads:read, catalogs:read and catalogs:write. Today we only read your ad accounts and catalogs and write nothing at Pinterest, although the catalogs:write permission is asked for. You still add the address of your Framepx feed to Pinterest yourself, as a data source. We keep the access and refresh tokens Pinterest gives us, encrypted. When you disconnect in the panel, we delete them. Pinterest offers no way for us to withdraw this access ourselves, so to end it fully, also remove Framepx in your Pinterest settings. ## Shopify A Shopify store connects to Framepx by installing a Framepx app. Today our team sends the store owner an install link made for that store. On the install screen Shopify shows the one permission the app asks for: read_products. Through it we receive your store's address and your product data: titles, descriptions, images, prices, availability and links. Shopify also tells us when a product changes and when the app is uninstalled. We do not ask for orders or customer data, and we write nothing to your store. We use this data only to build and refresh your feeds and ad creatives. To end the connection, uninstall the app in your Shopify admin, under Settings and then Apps. This stops our access to your store. When you uninstall, we clear the access Shopify gave us and take the feed we made for your store offline. 48 hours later Shopify sends us an erasure request for your store. We then erase that store's data within 30 days: its feed files, its feed source, its record and its products; the ad pictures and background-removed cutouts made for those products; its render orders and their outputs; and the brand's channel connections, with their access withdrawn, when the store was the brand's only source. Paid billing and credit records stay, as the law requires, with their product details removed. The brand's own Meta catalog and the products in it stay; they belong to the brand. You can also ask us for deletion yourself at any time at contact@framepx.com. Shopify can also send us requests about a store's customers. Framepx holds no data about your customers, so we have nothing to hand over or erase, and we confirm each request to Shopify. ## Who processes data for us We use the companies below to run Framepx. Each one is listed with the task we use it for. Cloudflare delivers the website and the panel, and keeps the website's request logs. It sends our emails (sign-in codes), stores creative images and feeds, runs some of the AI models we use and relays our requests to the other AI providers. Cloudflare is based in the United States and runs a worldwide network. The storage our render engine uses is located in Western Europe. Amazon Web Services (AWS) hosts our databases and the servers that run Framepx, in its European Union regions in Stockholm (Sweden) and Frankfurt (Germany). Dodo Payments sells our plans and credit packs as merchant of record. You pay on Dodo's own checkout page, where you enter your card and billing details. We send Dodo your email address and a reference to your brand, and we keep the purchase and receipt records it returns: amount, tax, currency, dates and refunds. We never see or store your card details. A store that uses Framepx through its Shopify app pays through Shopify Billing. We keep the charge record (plan, period, amount and status), never card details. Google has three roles. Google Analytics and Google Tag Manager measure visits to our website and the panel. Google Workspace hosts our company mailboxes, so the emails you send us are kept there. Google's Gemini models are among the AI models behind our AI gateway. Google is based in the United States. OpenAI is an AI model provider behind our AI gateway. OpenAI is based in the United States. OpenAI's models answer the assistant in the panel, summarise long conversations, write out voice notes as text and read a store page that cannot be read any other way. Anthropic is an AI model provider behind our AI gateway. Its models answer the assistant when OpenAI cannot. Anthropic is based in the United States. Cloudflare's own AI models (Workers AI) turn a product rule you write as a sentence into a rule, and they stand in for the assistant and for voice notes when OpenAI fails. Our servers are in the European Union, and some of these companies are based in the United States. So your data is stored and processed outside Türkiye, and for people in the European Union part of it is processed outside the EU. For these transfers we rely on the safeguards in our providers' data processing terms, including the European Commission's standard contractual clauses where they apply; to ask which safeguard covers a transfer, write to contact@framepx.com. We give personal data to a court or a public authority only when the law requires us to. We do not sell personal data. ## Why we use personal data, and on what legal ground We collect personal data by electronic means: through the website, the panel, the connections you approve and the emails you send us. We use it to open your account, to sign you in, to provide Framepx to you and to answer you when you write to us. The legal ground is that this is needed to set up and perform our contract with you (KVKK article 5/2-c). We use it to keep the website and the accounts secure, to prevent abuse and to find and fix errors. This is why we keep request logs, sign-in records and IP digests. The legal ground is our legitimate interest in running a safe product (KVKK article 5/2-f). We use it to measure visits to the website and the panel with Google Analytics. The legal ground is our legitimate interest in knowing which pages are used (KVKK article 5/2-f). On the website, visitors in Türkiye, the European Economic Area, the United Kingdom and Switzerland are measured only with their consent. In the panel, visitors in the European Economic Area, the United Kingdom and Switzerland are measured only with their consent. We send product news and offers by email only if you gave your consent, as Law No. 6563 on the Regulation of Electronic Commerce requires. You can withdraw it at any time by writing to contact@framepx.com. We use it to meet our legal duties, such as keeping invoices and answering lawful requests from authorities (KVKK article 5/2-ç). For people in the European Union the same grounds exist under the GDPR: contract, legitimate interests, legal obligation and consent. You need to give an email address to have an account, because we sign you in through it. What else you give us is your choice. ## How long we keep data Request logs for this website are deleted automatically after 7 days at most. Account data is kept while your account is open. We have not yet set a fixed period for the records of sign-in attempts and for the daily counters of the free tools, and today they are not removed automatically. Sign-in records are removed when you ask us to delete your data. A brand's product data, feeds and ad creatives are kept while we work for the brand. They are not deleted automatically when a brand stops using Framepx or ends a connection. We delete them when the brand asks. Shopify is the one exception, described under Shopify. Emails you send us stay in our mailbox until we no longer need them or you ask us to delete them. Invoices and the accounting records behind them are kept for as long as Turkish tax and commercial law require, even after a deletion request. Where no fixed period is given above, the test is whether we still need the data for the purpose it was collected for, or whether a law requires us to keep it. ## Deleting your data You can ask us to delete your data at any time by writing to contact@framepx.com. Our data deletion page says what to write, what happens to each kind of data and what the law makes us keep. Signing out only ends your session in the panel. Ending a connection or removing Framepx on a platform stops our access, but does not delete what we already hold. Shopify is the one exception, described under Shopify. - [Data deletion](https://framepx.com/data-deletion.md) ## Your rights Under article 11 of the Turkish Personal Data Protection Law (KVKK) you can ask us: whether we process personal data about you; for information about it if we do; why it is processed and whether it is used for that purpose; who it is transferred to, in Türkiye or abroad; to correct it if it is incomplete or wrong; to delete or destroy it under the conditions of article 7 of KVKK; to tell the third parties it was transferred to about a correction or deletion; to object to a result against you that comes only from automated analysis; and to be compensated if you suffer damage because your data was processed unlawfully. If you are in the European Union, the GDPR also gives you the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, to withdraw a consent you gave, and to complain to the data protection authority of your country. To use a right, write to contact@framepx.com, if you can from the email address of your account, and say what you ask for. We may ask for more information to be sure it is you. We deal with your request free of charge as soon as we can and within 30 days at the latest, as article 13 of KVKK requires. If answering needs an extra cost, the law allows the fee set by the Personal Data Protection Board. If we refuse your request, if you find our answer insufficient or if we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your request. ## Security If you find a security problem in Framepx, please tell us at contact@framepx.com. ## Children Framepx is made for businesses. It is not meant for children, and we do not knowingly collect personal data from them. If you think a child has given us personal data, write to contact@framepx.com. ## Changes to this policy We may change this policy. The current version is always on this page, with the date of the last change at the top. ## Contact For any question about this policy or about your data, write to contact@framepx.com. - [Contact](https://framepx.com/contact.md) - [Data deletion](https://framepx.com/data-deletion.md) - [Terms](https://framepx.com/terms.md)