Privacy Policy

Data controller / service provider

Gülvi Kömür Celep (Tospika)

Sole trader / sole proprietorship without a registered trade name. Business commencement date: 01.10.2026.

Address: Güzeloluk Mah. 1820 Sk. Lara Tatilya Evleri A Blok No: 4 İç Kapı No: 4, Muratpaşa / Antalya

Tax office: Kalekapı V.D.

KVKK applications and contact email: merhaba@tospika.com

Account and profile information

Contact information provided during membership is used to manage your account, communicate about support and transactions and maintain security. Information you add to your public maker profile—such as profile name, biography, city, products and selected Instagram/WhatsApp links—is visible to visitors. Do not add information you do not want published.

Products, sales and visitor communication

Tospika does not provide sales, payment, ordering or messaging services within the site. When you follow a maker's Instagram, WhatsApp or other link, that third party's privacy rules apply. Tospika is not responsible for data you share with those services or your relationship with the maker.

Security and retention

We seek to implement appropriate technical and organisational measures to protect accounts, content and transactions. Data may be retained while your account is active, content is published, a dispute risk persists or for a statutory period. At the end of that period, data is erased, destroyed or anonymised.

Service providers, third parties and international transfers

Providers access data only to the extent necessary for their service. Data may be shared with competent authorities where legally required. Services identified in the code and their processing-region verification status are:

• Lovable Cloud — database, authentication, file storage and first-party analytics records. Connection configuration contains the region indicator eu-central-1; this alone does not establish where data is processed or stored. Processing and storage countries/regions require separate confirmation. Purpose: storing accounts, profile and product content, files, support and usage records and operating the service.
• Lovable hosting / Cloudflare delivery infrastructure — website delivery, request processing and content distribution. The infrastructure supports global delivery; no single request-processing country is fixed in the code and exact processing countries have not been verified. Purpose: delivering pages and images, availability and technical security.
• Lovable managed email service — sending transactional, support and consented commercial emails; processing email addresses, message content and delivery records. Processing country/region and underlying provider could not be verified from the code. Purpose: account and application communications, support replies and notifications consistent with communication preferences.
• OpenAI models through Lovable AI Gateway — administrator-initiated translation and text generation. Product, profile and event text and personal data included in it may be processed. Processing country/region could not be verified from the code; the model name does not establish data residency. Purpose: multilingual content and administrative text assistance.
• Meta (Facebook / Instagram / WhatsApp) — Meta Pixel for advertising measurement only after cookie acceptance; images, captions and maker usernames for administrator-initiated social posts; phone numbers, messages and submitted media in WhatsApp workflows. Exact processing countries/regions could not be verified from the code. Purpose: measuring advertising impact, promoting makers/products and user-initiated WhatsApp communication.
• Google / YouTube — Google sign-in if selected by the user; YouTube player after the user starts playback; video uploads and channel reads through authorised publishing workflows. Depending on the service selected, identity/account details, IP/device information or video and its description may be processed. Processing countries/regions could not be verified from the code. Purpose: authentication, video viewing and authorised video publication. Google Analytics and Google Tag Manager are not used.
• Pinterest — product images, titles, descriptions and links are sent during administrator-initiated or configured automatic Pin publishing. Processing country/region could not be verified from the code. Purpose: product promotion on Pinterest. No Pinterest tracking tag is loaded when the site opens.

Meta Pixel loads only after explicit cookie acceptance, regardless of country. You can reopen the preference panel using “Cookie preferences” in the footer. These choices do not automatically satisfy the separate requirements for international transfers. The relevant Article 9 KVKK mechanism and any necessary safeguards require provider-specific legal verification; no unverified transfer arrangement is claimed.

Your rights

Send personal-data applications to merhaba@tospika.com. Please see the Data Protection Notice for details.

In the event of a dispute, the Turkish text shall prevail.