Onay: Content Approval — Privacy policy

Last updated: · Version 1

1. What does the app do?

Onay: Content Approval lets social media agencies get the content they prepare (images, carousels, videos, Reels, stories) approved by their clients. The agency uploads the content; the client reviews it in the iOS app or on the web, leaves notes, approves it or requests changes. The service is provided by Lydros (Hanifi Ertuğrul Aslan).

2. What data do we process?

  • Account: name, email address and an irreversible hash of your password (the password itself is never stored).
  • Memberships and roles: which agency or client workspace you belong to and in which role.
  • Content: images and videos uploaded by the agency, captions, scheduled publish dates and versions.
  • Review records: the notes you write (with their position on the image or second in the video), your approval and change-request decisions, and their timestamps.
  • Notifications: in-app notifications; if push is enabled, your device's push token and your notification preference.
  • Security: to prevent abuse, sign-in and sign-up attempts are counted per IP address and email in short-lived counters (at most 24 hours); IP addresses are not stored permanently. An activity history (who did what, when, on which content) is kept as the agency's audit log.

The app shows no ads, does not track you across apps or websites, and does not use your location, contacts or camera. Photo library access is only used by agency staff to upload a new version, and only the files you pick are sent.

3. Who can see the data?

Each agency's data is separated from other agencies, and each client's data from the same agency's other clients, at the database level. Client users only see the content of their own client workspace. Client content and decisions are records of the agency using the service; the agency is the data controller for them and Lydros processes them on the agency's behalf.

4. Retention and closing your account

You can close your account in the app under Profile → Close my account. Once closed, all your sessions end, you can no longer sign in to any workspace and no notifications are sent to your device. Your review history (notes and decisions) stays in the agency's account as its business record. To request full deletion of your personal information, use the support form below.

5. Sub-processors

  • Hosting and database: Hetzner Online GmbH (Almanya, AB)
  • Push delivery: Expo (650 Industries, USA) via Apple Push Notification service — only the notification title, text and related content ID are transmitted.

No data is sent to any other third party, and no data is sold.

6. Contact

  • Service provider: Lydros (Hanifi Ertuğrul Aslan)
  • Address: İsmetpaşa Mah. Kenar Cad. Gün Işığı K1 Blok No: 4B İç Kapı No: 51, Bayrampaşa / İstanbul, Türkiye
  • Email: ertugrul.aslan@outlook.com.tr
  • Support: support form