Last updated: 9 October 2026

Privacy Policy

Who we are and who is responsible for your data

Framepx is AI-based software for ad production and product feeds, sold as a subscription. It turns a brand's product data into ad creatives and into product feeds that ad platforms read. This policy explains what personal data we handle on the website framepx.com, on the waitlist page at waitlist.framepx.com and in the customer panel at app.framepx.com. It is also our notice under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

Framepx is operated by Framepx - Ahmet Can Köybaşı, a registered sole proprietorship in Ankara, Türkiye. This business is the data controller for the personal data described in this policy. You can reach it at contact@framepx.com.

There is one exception. The product data a brand brings into Framepx stays the brand's own. For that data the brand decides what happens, and Framepx works on the brand's behalf (as a data processor), as described under "Product data a brand brings, and what we make from it".

What we collect on this website

You can read framepx.com without an account. When you visit, our hosting provider Cloudflare keeps request logs for us: your IP address, browser and device type, the pages you request and when, and an approximate location (country or city) derived from your IP address. We use these logs only to keep the site secure, for example to block abuse, and to find and fix errors.

To measure visits we use Google Analytics 4, loaded through Google Tag Manager. Google sets cookies in your browser for this and collects usage data such as the pages you open, the buttons you click and how far you scroll. Google may process this data outside Türkiye and outside the European Union.

Our own site sets one cookie: it remembers the language you choose, for one year. Your light or dark theme choice is kept in your browser's local storage. Cloudflare may also set a cookie of its own to tell people from automated traffic.

The site has two free tools. Feed Inspector fetches the public product feed at the address you enter and shows you a report on it. Creative Score sends the image you upload to an AI model, through the AI gateway described below, and shows you the score. We keep neither the feed address nor the image. To limit daily use, both tools keep a one-way digest of your IP address with a counter for the day, not the address itself.

If you join the waitlist at waitlist.framepx.com, we collect your email address, your brand name and website, the consents you give with their times, the campaign source and the site that referred you, and a keyed one-way digest of your IP address that we use against abuse. We send you an email to confirm your address. We send product news and offers only if you ticked that box. The waitlist form links to its own notice, which gives the full details.

If you book a demo through the link on this site, the booking runs on Google Calendar. We receive the name and email address you enter and the time you pick.

If you write to contact@framepx.com, we receive your email address and what you write, and we use them to answer you.

We do not sell personal data.

Your account at app.framepx.com

To use Framepx you sign in at app.framepx.com with your email address. We email you a one-time code. There is no password.

For your account we keep your email address, your name if you enter one, your language, the state of the account and when it was last used. We also keep the brand you work for in Framepx (its name, website, sector and country) and your role in it.

Each sign-in attempt leaves a record: the time, the email address entered, the IP address and whether it succeeded. We use these records to stop code guessing and other misuse of accounts.

While you are signed in, the panel keeps a sign-in cookie in your browser. The panel cannot work without it. It is not used for advertising or for following you on other sites.

Terms

Product data a brand brings, and what we make from it

A brand gives Framepx its product data by entering the address of a product feed or of its store, or by connecting its store (see Shopify below). From that source we read product fields such as title, description, price, sale price, availability, link and brand, and the product images.

We read product data only. We do not ask for orders or customer lists, and we write nothing back to the store.

From this data Framepx makes three things for the brand: a cleaned and labelled product list, built with the rules the brand sets; a feed for each ad channel the brand uses, published at a hosted address; and ad creatives rendered for the brand's products.

A hosted feed address and the creative images in it can be opened by anyone who has the full address. That is how ad platforms such as Google, Meta, TikTok and Pinterest fetch them after the brand pastes the address there. Each address contains a token, so share it only with the platforms you choose.

Product data is business data, and the brand remains responsible for it. If it holds personal data, for example a seller's name in a product description, Framepx processes that data only on the brand's behalf and only for what is described here. We do not use a brand's product data for any other purpose.

The assistant and AI

In the panel and in the free tools on this site, requests to AI models pass through one AI gateway that we run. The gateway sends the text or image needed for the task to one of the AI providers named under "Who processes data for us". The gateway does not log or store the text or image you send or the answer. It keeps a usage record: which feature asked, which model answered and what it cost.

Connected platforms

Framepx works with online stores and ad platforms that other companies run. We call them connected platforms. Each part below says what we access, why, what we keep and how to end the connection. A part applies to you only if you use that platform with Framepx.

Ending a connection stops our access from that moment. It does not delete what we already hold. To have data deleted, see "Deleting your data".

Sign in with Google

If you choose Sign in with Google, Google asks you to approve sharing your basic account details with Framepx (the openid, email and profile scopes). Google then gives us your Google account identifier, your email address and your basic profile details, such as your name.

We use them only to open your Framepx account and to recognise you when you sign in. We keep the identifier and the email address with your account. We ask for no other Google data at sign-in. We do not sell this data and do not use it for advertising.

To stop, open the page in your Google Account that lists the apps linked to it, choose Framepx and remove its access. This stops the Google sign-in. It does not delete your Framepx account or its data.

Google Merchant Center

Today Framepx does not connect to your Merchant Center account. You paste the address of your Framepx feed into Merchant Center yourself, and Google fetches the feed from that address. We receive no data from your Google account this way. A direct connection is planned.

Google user data and Limited Use

Framepx's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

If we want to use Google user data in a new way, we will first update this policy and ask for your consent.

Meta (Facebook and Instagram)

Today Framepx does not connect to your Meta account. You paste the address of your Framepx feed into Meta Commerce Manager yourself, and Meta fetches the feed from that address. We receive no data from your Meta account this way. A direct connection is planned.

Data deletion

TikTok

Today Framepx does not connect to your TikTok account. You paste the address of your Framepx feed into TikTok Catalog Manager yourself, and TikTok fetches the feed from that address. We receive no data from your TikTok account this way. A direct connection is planned.

Today Framepx does not connect to your Pinterest account. You add the address of your Framepx feed to your Pinterest business account yourself, as a data source, and Pinterest fetches the feed from that address. We receive no data from your Pinterest account this way. A direct connection is planned.

Shopify

A Shopify store connects to Framepx by installing a Framepx app. Today our team sends the store owner an install link made for that store. On the install screen Shopify shows the one permission the app asks for: read_products.

Through it we receive your store's address and your product data: titles, descriptions, images, prices, availability and links. Shopify also tells us when a product changes and when the app is uninstalled. We do not ask for orders or customer data, and we write nothing to your store.

We use this data only to build and refresh your feeds and ad creatives.

To end the connection, uninstall the app in your Shopify admin, under Settings and then Apps. This stops our access to your store.

To have your store's data deleted, write to contact@framepx.com.

Who processes data for us

We use the companies below to run Framepx. Each one is listed with the task we use it for.

Cloudflare delivers the website, the waitlist page and the panel, and keeps the website's request logs. It runs the human check on the waitlist form (Turnstile), sends our emails (sign-in codes and waitlist confirmations), stores creative images and feeds, runs some of the AI models we use and relays our requests to the other AI providers. Cloudflare is based in the United States and runs a worldwide network. The storage our render engine uses is located in Western Europe.

Amazon Web Services (AWS) hosts our databases and the servers that run Framepx, in its European Union regions in Stockholm (Sweden) and Frankfurt (Germany).

Google has three roles. Google Analytics and Google Tag Manager measure visits to our website and waitlist page. Google Workspace hosts our company mailboxes, so the emails you send us are kept there. Google's Gemini models are among the AI models behind our AI gateway. Google is based in the United States.

OpenAI is an AI model provider behind our AI gateway. OpenAI is based in the United States.

Our servers are in the European Union, and some of these companies are based in the United States. So your data is stored and processed outside Türkiye, and for people in the European Union part of it is processed outside the EU.

We give personal data to a court or a public authority only when the law requires us to.

We do not sell personal data.

Why we use personal data, and on what legal ground

We collect personal data by electronic means: through the website, the waitlist form, the panel, the connections you approve and the emails you send us.

We use it to open your account, to sign you in, to provide Framepx to you and to answer you when you write to us. The legal ground is that this is needed to set up and perform our contract with you (KVKK article 5/2-c).

We use it to keep the website and the accounts secure, to prevent abuse and to find and fix errors. This is why we keep request logs, sign-in records and IP digests. The legal ground is our legitimate interest in running a safe product (KVKK article 5/2-f).

We use it to measure visits to the website with Google Analytics. The legal ground is our legitimate interest in knowing which pages are used (KVKK article 5/2-f).

We send product news and offers by email only if you gave your consent, as Law No. 6563 on the Regulation of Electronic Commerce requires. You can withdraw it at any time by writing to contact@framepx.com.

We use it to meet our legal duties, such as keeping invoices and answering lawful requests from authorities (KVKK article 5/2-ç).

For people in the European Union the same grounds exist under the GDPR: contract, legitimate interests, legal obligation and consent.

You need to give an email address to have an account, because we sign you in through it. What else you give us is your choice.

How long we keep data

Request logs for this website are deleted automatically after 7 days at most.

Waitlist data is kept while the waitlist runs, for 12 months at most, and deleted sooner if you ask. The IP digest of the waitlist form is deleted within a day.

Account data is kept while your account is open.

We have not yet set a fixed period for the records of sign-in attempts and for the daily counters of the free tools, and today they are not removed automatically. Sign-in records are removed when you ask us to delete your data.

A brand's product data, feeds and ad creatives are kept while we work for the brand. They are not deleted automatically when a brand stops using Framepx or ends a connection. We delete them when the brand asks.

Emails you send us stay in our mailbox until we no longer need them or you ask us to delete them.

Invoices and the accounting records behind them are kept for as long as Turkish tax and commercial law require, even after a deletion request.

Where no fixed period is given above, the test is whether we still need the data for the purpose it was collected for, or whether a law requires us to keep it.

Deleting your data

You can ask us to delete your data at any time by writing to contact@framepx.com. Our data deletion page says what to write, what happens to each kind of data and what the law makes us keep.

Signing out, ending a connection or removing Framepx on a platform does not delete anything by itself. It only stops our access.

Data deletion

Your rights

Under article 11 of the Turkish Personal Data Protection Law (KVKK) you can ask us: whether we process personal data about you; for information about it if we do; why it is processed and whether it is used for that purpose; who it is transferred to, in Türkiye or abroad; to correct it if it is incomplete or wrong; to delete or destroy it under the conditions of article 7 of KVKK; to tell the third parties it was transferred to about a correction or deletion; to object to a result against you that comes only from automated analysis; and to be compensated if you suffer damage because your data was processed unlawfully.

If you are in the European Union, the GDPR also gives you the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, to withdraw a consent you gave, and to complain to the data protection authority of your country.

To use a right, write to contact@framepx.com, if you can from the email address of your account, and say what you ask for. We may ask for more information to be sure it is you. We deal with your request free of charge as soon as we can and within 30 days at the latest, as article 13 of KVKK requires. If answering needs an extra cost, the law allows the fee set by the Personal Data Protection Board.

If we refuse your request, if you find our answer insufficient or if we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your request.

Security

If you find a security problem in Framepx, please tell us at contact@framepx.com.

Children

Framepx is made for businesses. It is not meant for children, and we do not knowingly collect personal data from them. If you think a child has given us personal data, write to contact@framepx.com.

Changes to this policy

We may change this policy. The current version is always on this page, with the date of the last change at the top.

Contact

For any question about this policy or about your data, write to contact@framepx.com.