Data Processing Agreement
Last updated: 6 July 2026
1. Roles
In respect of the personal data of a store's own customers, the store is the data controller and denebak.com is the data processor. We process that data only on the store's documented instructions, which are given by the store's use of the service.
2. Scope of processing
Subject matter: providing virtual try-on inside Instagram DMs. Categories of data: the customer's Instagram user id, their consent statement, and — transiently — the photograph they send. Duration: for as long as the store's account is active.
3. Security
Access tokens are encrypted at rest. Transport is encrypted throughout. Customer photographs are never persisted, which removes the largest category of risk rather than managing it. Administrative actions on the platform are recorded in an audit trail.
4. Sub-processors
The AI try-on provider, the payment provider and the e-mail provider act as sub-processors within the scope described in the privacy policy. We remain responsible for their performance.
5. On termination
When a store closes its account, its customers' records are anonymised after thirty days. Payment records are retained for the statutory period and for no other purpose.
6. Governing version
This is an English rendering provided for convenience. The Turkish text governs.