This Privacy Policy ("Policy") describes how Sonaco ("Company," "we," "us," or "our") collects, uses, and protects your personal information when you use our content scheduling and publishing platform.
For the purposes of this Policy:
By using the Service, you agree to the collection and processing of your personal data as described in this Policy. If you do not agree with any part of this Policy, please discontinue use of the Service.
| Data Type | Details | Purpose |
|---|---|---|
| Account Information | Email address, full name, password | Account creation, authentication, communication |
| Content | Text, media files (images, videos), notes | Core service functionality — scheduling and publishing |
| Workspace Data | Workspace name, logo, timezone, brand color | Multi-workspace organization |
| Channel Credentials | Telegram bot tokens, Instagram access tokens | Publishing to your social media channels |
| Support Communications | Ticket messages, attached files | Customer support |
| Payment Information | Transaction data processed by our payment provider | Subscription billing |
| Data Type | Details | Purpose |
|---|---|---|
| Device Token | Apple Push Notification Service (APNS) token | Delivering push notifications |
| Authentication Tokens | JWT access and refresh tokens | Maintaining your session |
| Usage Data | Feature usage and error logs | Service improvement, debugging |
| Calendar Cache | Calendar items cached locally on device (7-day TTL) | Offline access, performance |
| Photo Library | Photos selected by you for avatar upload | Profile customization |
We use your information for the following purposes:
kSecAttrAccessibleWhenUnlocked protectionWe use the following third-party services to provide the Service:
| Service | Purpose | Data Shared |
|---|---|---|
| Telegram Bot API | Publishing content to Telegram channels | Post content, media files |
| Instagram Graph API (Meta*) | Publishing content to Instagram | Post content, media files, access tokens |
| Google Gemini API | AI content generation | Your prompts and content text |
| Payment provider | Payment processing | Transaction data (we do not store card details) |
| Apple Push Notification Service | Push notifications on iOS | Device token, notification content |
| SMTP Provider | Transactional emails | Email address, message content |
| Google Analytics | Website traffic on sonacosan.com — only with your consent (see Section 12) | Anonymised page views and button clicks |
| Meta (Facebook) Pixel and Conversions API | Advertising performance — only with your consent to the “Marketing” category (see Section 12) | Page views, sign-up, checkout start; the fact and amount of a purchase from our server. The user identifier travels as an irreversible hash |
Each third-party service has its own privacy policy. We encourage you to review them. We only share the minimum data necessary for each service to function.
AI content generation is performed through the Google Gemini API on a paid (billed) tier, under which Google does not use submitted prompts or generated responses to train or improve its models. Sonaco's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google User Data obtained from Google APIs is never used to train or improve generalized or foundational AI/ML models.
When you connect a Telegram channel to the Service, we access the channel via the Telegram Bot API using the bot token you provide. We collect and display post metrics (views, forwards, comments) and channel subscriber counts for analytics purposes.
When you connect an Instagram account, we use the Instagram Graph API (Meta*) via OAuth to obtain an access token. We use this token to publish content and collect post metrics. You can revoke access at any time through Facebook Business Integrations settings.
The privacy policies of these platforms are available at:
You have the following rights regarding your personal data:
To exercise any of these rights, contact us at support@sonacosan.com.
The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected data from a child under 16, please contact us immediately and we will promptly delete such information.
Your data may be processed in countries other than your country of residence. We take appropriate measures to ensure your data is protected in accordance with this Policy regardless of where it is processed.
When you enable push notifications, we collect your APNS device token to deliver notifications about:
You can disable push notifications at any time through your iOS device settings. Your device token is removed from our servers when you log out or uninstall the app.
The web platform (my.sonacosan.com) uses essential cookies for authentication and session management (NextAuth session cookies). These cookies are strictly necessary for the Service to function and cannot be disabled.
The iOS application does not use cookies. Authentication tokens are stored securely in the iOS Keychain.
On the sonacosan.com website and in the my.sonacosan.com web platform we use Google Analytics to understand how many people visit, which sections they use and where their path breaks off. Page addresses inside the platform are anonymised before they are sent: workspace names, item identifiers and guest-review links are never passed to analytics. Analytics cookies (_ga, _ga_*) are set only after you consent: until you answer the cookie prompt, analytics runs without identifiers and writes nothing to your browser.
You can change or withdraw your choice at any time — the “Cookie settings” link in the site footer and the matching entry in your platform profile settings. The choice is shared between the site and the platform: you are asked only once. Withdrawal takes effect immediately and does not require contacting support.
The sonacosan.com website and the my.sonacosan.com web platform also run the Meta Pixel, which lets us measure how our advertising performs and show it to people our product may suit. It belongs to the “Marketing” category and is enabled only after your separate consent: until you answer the cookie prompt the pixel is loaded but sends no events and writes nothing to your browser. The cookies in this category are _fbp and _fbc. If you consented to marketing and then subscribed, the fact and amount of the purchase are sent to Meta from our server (Conversions API); your identifier travels as an irreversible hash, never as a plain value.
The iOS app contains no advertising counters — neither the Meta Pixel nor any other.
Declining the “Marketing” category does not affect how the website or the platform works: every feature stays available, only ad personalisation does not.
This Policy is governed by and construed in accordance with the laws of the Republic of Turkey. Any disputes arising from this Policy shall be resolved through good-faith negotiations. If a dispute cannot be resolved informally within 30 days, it shall be submitted to the competent courts of Istanbul, Republic of Turkey.
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date and, where appropriate, through in-app or email notifications. Your continued use of the Service after changes constitutes acceptance of the updated Policy.
If you have questions about this Privacy Policy or your personal data, contact us: