Last updated: November 2, 2026 This Privacy Policy explains how Anatolian Organics Ltd. ("we", "us"), operator of Tombi at tombi.tr, collects, uses and protects your personal data. 1. Information we collect - Account information: your name, email address and password (stored as a one-way hash, never in plain text). - Connected platform data: when you connect a social media account (WordPress, Facebook Pages, Instagram, Threads, X/Twitter, LinkedIn, Bluesky, TikTok), we store the platform account identifier/name and the OAuth access/refresh tokens needed to publish on your behalf. Tokens are encrypted at rest (AES-256-GCM) and are never visible in plain text, even to us. - Content you create: post text, uploaded images/media, and keywords you enter to be published to your connected accounts. - Optional AI feature: if you use the AI keyword-suggestion feature, the text you submit is sent to our AI provider (DeepSeek) to generate suggestions; the request and response are logged for quality/troubleshooting purposes, visible only to our admins. - Technical/usage data: basic error and activity logs (e.g. which action failed and why) used to operate and troubleshoot the service. 2. How we use your information We use this information solely to operate Tombi: authenticating you, publishing your content to the platforms you connect, and troubleshooting problems with your account. We do not sell your personal data, and we do not use your content for advertising. 3. Who we share data with We only share data with: (a) the social media platforms you explicitly connect, as required to publish your content there, and (b) our AI subprocessor (DeepSeek), only for the text you submit to the optional keyword-suggestion feature. We do not share your data with any other third party. 4. Data retention and deletion We retain your account and content data for as long as your account is active. Posts you delete are marked as deleted and hidden from you, but may be kept for internal accounting purposes; you can request a permanent deletion at any time (see our Data Deletion Instructions page). Disconnecting a social account immediately and permanently deletes its stored access tokens. 5. Security Social platform tokens and other secrets are encrypted at rest. Passwords are hashed and never stored in plain text. Access to administrative tools is restricted to authorized staff. 6. Your rights You may request access to, correction of, or deletion of your personal data at any time by emailing support@tombi.tr. See our Data Deletion Instructions page for the fastest way to remove specific platform connections yourself. 7. Children Tombi is not directed at individuals under 16, and we do not knowingly collect personal data from them. 8. Changes to this policy We may update this Privacy Policy from time to time; material changes will be reflected on this page with an updated date. 9. Contact For any privacy question or request, contact support@tombi.tr.