Last updated: July 13, 2026
This Privacy Policy explains which personal data is processed when you use the KOLHub platform, for which purposes and on which legal bases, and with whom it is shared, as well as your rights. It is based on Turkish Law No. 6698 (KVKK) and, for users in the EU, the GDPR.
The data controller is the operator of the KOLHub platform. (The operator's legal entity name, address and contact email will be published in this section before commercial launch; until then, requests can be submitted via the in-platform support channels.)
Account data: email address and authentication identifiers (via Privy). Profile data: display name, bio, niches, languages, price range, avatar. Social account data: the X/Telegram handles you connect and follower/view metrics retrieved from their APIs. Wallet data: wallet addresses you verify with a signature (private keys are never collected). Transaction data: deals, offers, deliveries, reviews, package purchases and their on-chain transaction identifiers. KYB data (only for company applications): legal name, registration number, country and uploaded documents. Communication data: in-platform messages and notification preferences. Technical data: IP address, browser information and security/error logs.
Data is processed to create and manage your account, provide matching and discovery features, verify metrics, record escrow flows, resolve disputes, ensure security (abuse and fraud prevention, rate limiting), fulfil legal obligations and improve the service. Marketing emails are strictly opt-in and you can unsubscribe from each category separately.
Under KVKK Art. 5 and GDPR Art. 6: performance of a contract (account, deals, escrow records); legitimate interest (security, fraud prevention, service improvement); legal obligation (record keeping, responding to official requests); and consent (connecting social accounts, optional notifications). Where processing is based on consent, you may withdraw it at any time.
The following processors are used to provide the service: Privy (authentication), Supabase (database and file storage), Resend (email), Upstash (rate limiting), Sentry (error monitoring), the X and Telegram APIs (metric verification) and blockchain RPC providers. These providers' servers may be located abroad; transfers are made with the safeguards required under KVKK Art. 9 and GDPR Chapter V. Your personal data is NOT sold to third parties.
Escrow transactions are written to public blockchain networks. Wallet addresses and transaction records are PERMANENT by the nature of blockchains and cannot be deleted or altered by anyone, including the Platform. The right to erasure can only be applied to data in the Platform's database.
Account data is kept for as long as your account remains open; deal and payment records are kept after account closure for the statutory limitation periods due to legal retention obligations and potential disputes; security logs are kept for a limited period. When the periods expire, data is deleted or anonymized.
Under KVKK Art. 11 and the GDPR you have the rights of access, rectification, erasure (subject to the blockchain exception), restriction of processing, objection, portability and withdrawal of consent. Requests can be submitted via the in-platform support channel; they are answered within the statutory period after identity verification. You may also lodge a complaint with the Turkish Personal Data Protection Board (KVKK) or your local supervisory authority (GDPR).
The Platform uses only strictly necessary/functional cookies: your language preference (NEXT_LOCALE) and Privy session information. NO advertising or third-party tracking cookies are used; for this reason no separate cookie consent is requested.
Data is encrypted in transit with TLS; access is restricted on a role basis; hidden-profile masking is applied server-side; KYB documents are kept in a separate store with restricted access. No system is 100% secure; in the event of a breach, the notifications required by law will be made.
The Platform is not directed at persons under 18 and we do not knowingly collect data from children. If a user under 18 is identified, the account will be closed and their data deleted.
This Policy may be updated; material changes will be announced on the Platform. The current version is always published on this page.