Privacy Policy

1. Controller and processor

Favenda is operated by Mehmet Emin SARI. Address: Meydankavağı Mah. 1575. Sok. Nazmi Aksu 2 Sitesi Floor 5, Muratpaşa / Antalya, Türkiye. Contact: info@favenda.com.

Favenda is an e-commerce software service that businesses use to build and run their own online stores; on request, Favenda also sets up the store and provides related services.

Favenda is the controller for the account and subscription data of the business using it (the merchant) and its staff. For people who buy from, register with or fill in forms on a merchant's store, the merchant is the controller; Favenda processes that data on the merchant's behalf and instructions as a processor. Store customers should also read the privacy notice the merchant publishes on its own store.

2. Data we process

• Merchant account: name, email, company and role (Enda account centre); subscription amount, period and payment method: for sign-in, permissions, invoicing and notifications.
• Merchant connection details: payment provider (POS) and shipping keys: to collect payments and create shipments with the merchant's own accounts.
• Store customers (on the merchant's behalf): name, company, phone, email, delivery and billing address, tax office and tax or national ID number (if entered for invoicing), order contents, the source the store was visited from (campaign data), membership, cart reminders, reviews, withdrawal requests and contact form messages: to take, deliver and invoice orders and respond to the customer.
• Store visitors: a monthly total visit count (not linked to a person); for reviews, the IP address is kept only as an irreversible hash.
• Assistant conversations: what merchants write to the panel assistant and what store visitors ask the storefront assistant. Storefront assistant conversations are not stored on our servers.
• Sign-in attempts, IP address and activity logs (system): for security, abuse prevention and legal obligations.

Card details never reach Favenda: payment is taken on the secure page of the payment provider the merchant chooses (iyzico, PayTR or Stripe).

3. Purposes and legal bases

• Performance of the contract: merchant account, running the store, taking and delivering orders.
• Legal obligation: invoicing and accounting records, distance-selling rules, requests from authorities.
• Legitimate interest: security, debugging and improving the service (with aggregate measurements).
• Consent: for marketing messages and for advertising and measurement cookies on stores; store customers give or refuse this separately at checkout and in the cookie banner.

4. Use of store data

• Store customers' data is used only to run the merchant's store; it is not sold, not used in Favenda's own advertising and not shared with other merchants.
• Each company sees only its own data; this separation is also enforced at database level.
• Measurement tools a merchant adds to its store, such as Google Analytics, Google Ads, Meta Pixel or Google Tag Manager, are the merchant's own accounts; they are set up so that no cookies are written until the visitor accepts in the cookie banner.

5. Transfers

• Hosting: our servers are in Türkiye (Netinternet); images and files are stored on the same servers. Fonts are served from our own server, so visitor IPs are not sent to a third party.
• Payment providers: the order and customer details needed for payment are passed to the merchant's chosen provider (iyzico, PayTR or Stripe).
• Shipping: the recipient's name, address and phone are passed to the carrier or shipping service the merchant chooses (e.g. Geliver, Yurtiçi, Aras, MNG, PTT, DHL, UPS, FedEx).
• Google Merchant Center: if the merchant enables it, only product information (not customer data) is sent to Google.
• AI: assistant messages and the store and product summaries needed are sent to our AI provider (Anthropic PBC, USA; Google LLC as a fallback) to generate a reply.
• Email delivery: for order and notification emails, the recipient's email address is passed to our email delivery service.
• Authorities: only where the law requires it.

6. Retention

• Store and order data: for the duration of the subscription; after it ends the merchant can export its data, and the data is deleted within 90 days. Records the merchant must keep by law (such as invoices) are handed over to the merchant.
• Database backups: 14 days.
• Assistant conversations: 12 months. Sign-in and security logs: 2 years. Favenda's own invoicing records: the statutory period (10 years).

7. Data deletion

• Merchants: email info@favenda.com from your registered address with the subject "Delete my Favenda data". Your request is completed within 30 days and you are notified.
• Store customers: send requests about your data to the store you bought from. When the merchant forwards a request to us, we carry it out on the merchant's behalf. If you cannot reach the store, write to us and we will pass your request on to the merchant.

8. Your rights

You may ask whether your data is processed, request information, learn whether it is used for its purpose, know the third parties it is transferred to, request correction, deletion or destruction and notification of these to recipients, object to a result against you arising from automated analysis, and claim compensation for damage. Under the GDPR you also have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your supervisory authority.

Requests: by email to info@favenda.com or in writing to Meydankavağı Mah. 1575. Sok. Nazmi Aksu 2 Sitesi Floor 5, Muratpaşa / Antalya, Türkiye. We reply within 30 days.

9. Security

Connections are encrypted with HTTPS (a certificate for each store domain); payment and shipping keys are stored encrypted; panel sign-in goes through the account centre and repeated failed attempts are blocked. Support access is time-limited, read-only and logged.

10. Cookies

• favenda.com and the merchant panel: only strictly necessary cookies for the session and security (CSRF); no advertising or tracking cookies.
• Stores: strictly necessary cookies for the cart, member session and country or currency choice (60 days; country choice 1 year).
• Measurement and advertising cookies on stores: written only if the merchant has added these tools and the visitor accepts in the cookie banner; if refused, they are not written. The choice is stored in the visitor's browser and can be changed from the banner.

11. Changes

When we update this policy we change its date and announce important changes to merchants by email.