How we process your personal data. This policy covers two areas: the rooacreative.com website together with our agency services, and ROOA Panel, a separate application.
This policy covers the following two areas operated by ROOA Creative:
Part 1 — ROOA Creative: the rooacreative.com website, its contact form and our agency services.
Part 2 — ROOA Panel: the reporting application we develop for agencies, running at panel.rooacreative.com. This part concerns registered panel users only.
ROOA Creative is the data controller for both areas. For any question, request or data subject enquiry: safaozturk@rooacreative.com
Part 1 — ROOA Creative website and agency services
1.1 Data we process on the website
Contact form: full name, e-mail address, phone number (optional) and your message. We process these fields only when you fill in and submit the form.
When the form is submitted, the message is both e-mailed to us and stored in a database on our server, so your request is not lost if e-mail delivery fails.
Server access logs: our hosting provider keeps standard access logs containing IP address, date/time and browser information, for the security and operation of the site.
The form contains a hidden check field (honeypot) to block automated spam; this field collects no personal data.
1.2 Why we process this data
To respond to your request, prepare a quotation and communicate with you.
To keep the website secure and to troubleshoot technical issues.
This data is not added to any marketing list, is not sold and is not shared with third parties.
1.3 Cookies and tracking technologies
rooacreative.com does not use cookies. The site contains no Google Analytics, Meta Pixel or comparable analytics/advertising tracking code.
Your visit is not profiled and is not tracked for behavioural advertising purposes.
1.4 Data processing as part of our agency services
When we manage advertising, social media or a website on behalf of a client, we may access data held in that client's accounts. In that context ROOA Creative acts as a data processor and only for the purpose set out in the agreement.
Credentials for client accounts are not shared with unauthorised persons; access is removed when the working relationship ends.
1.5 Retention
Contact form messages are kept for a reasonable period in order to handle the request and follow up on a possible working relationship, and are deleted once no longer needed.
Part 2 — ROOA Panel the panel.rooacreative.com application
2.1 Data we process in the panel
Account data: name, e-mail address, hashed password, role and permission data, two-factor authentication settings.
Agency and client records: business name, website, contact details, brand information and notes entered by the user.
Performance data retrieved from connected advertising and analytics accounts (see below).
Usage and audit records: sign-in times, IP address and critical actions performed, for security and troubleshooting purposes.
Billing and credit usage records.
We do not process or store payment card details; payments are handled by licensed payment providers (iyzico / PayTR).
2.2 Connected accounts and API access
With the explicit consent of the user, the panel connects to the following services and retrieves data on a read-only basis: Meta (Facebook/Instagram) Ads, Google Ads, Google Search Console, Google Analytics, Google Business Profile, Google Calendar, TikTok Ads, LinkedIn Ads.
When a LinkedIn connection is established, we read only advertising account and advertising performance reporting data. We do not read personal profile data, connection lists or messages, and we do not publish content on the member's behalf.
Access and refresh tokens are stored encrypted in the database and are used solely to retrieve data for the connected account.
You may disconnect at any time from within the panel, and you may also revoke access from the provider's own security settings. When a connection is removed, the token is deleted.
Data retrieved from these services is never shared with other customers; each agency sees only its own data.
2.3 AI processing and third-party providers
The panel uses artificial intelligence services to generate reports and insights. For this purpose, selected performance data and business descriptions are sent to the following providers: Anthropic, OpenAI, Google (Gemini) and DataForSEO.
Data sent to these providers is used to generate the report text and is subject to that provider's own privacy policy and data processing terms.
Account passwords, payment details and access tokens are never sent to AI providers.
Agencies may connect their own API keys; in that case the relevant calls are made through their own provider accounts.
2.4 Panel cookies and sessions
We use only cookies that are strictly necessary for the application to function: the session cookie, the CSRF security cookie and the "remember me" preference.
We do not use advertising or third-party tracking cookies, and we do not carry out profiling.
2.5 Retention and deletion
Data is retained while the account is active and for as long as the service requires.
When a client record is deleted, the reports and retrieved performance data belonging to that client are deleted as well.
You may request complete deletion of your account. Billing records subject to a statutory retention obligation are kept for the period required by applicable law.
Data created for testing purposes during the beta stage may be deleted as part of the development process.
Part 3 — Common provisions applicable to both areas
3.1 Security
All traffic is encrypted over HTTPS. Passwords are stored in an irreversible (hashed) form.
API access tokens and external account credentials are stored encrypted in the database.
Two-factor authentication is enforced for administrator accounts, critical operations require password re-authentication, and such operations are written to an audit log.
No system can offer absolute security; if you become aware of a security issue, please report it to us.
3.2 Your rights
Under the GDPR and Turkish Law No. 6698 (KVKK) you have the right to access your data, request its rectification or erasure, object to processing, and receive your data in a portable format.
Please send requests to safaozturk@rooacreative.com. We respond within the period prescribed by applicable law.
3.3 Changes to this policy
As our services and ROOA Panel evolve, this policy will be updated from time to time. The current version is always published at this address and the date above is updated accordingly.
3.4 Contact
For all questions regarding privacy, data processing and data subject rights:
