Bulbul Lab Privacy Policy

Last updated: October 30, 2026

1. Who we are

Bulbul Lab is provided by Nutrikey Gıda Ürünleri Tarım Hayvancılık Yemcilik ve Danışmanlık Sanayi Ticaret Limited Şirketi (“Nutrikey”, “we”), a limited liability company registered in Türkiye (İzmir Trade Registry No. 169155, MERSİS No. 0632044265400001), with its registered address at Kazımdirik Mah. Fevzi Çakmak Cad. Pehlivanlar No: 4 İç Kapı No: 3, 35100 Bornova/İzmir, Türkiye. Nutrikey is the controller of the personal data described here.

Bulbul Lab is a service for businesses. It researches a business’s market and target audience, prepares a content plan and content based on that research, publishes the content the business approves to the platforms it connects, and shows how that content performs.

This policy applies to the website at https://bulbul-lab.com and the dashboard at https://bulbul-lab.com/app/ (together, the “Service”) for users and visitors outside the Russian Federation.

Contact for privacy questions and requests: milan1982.ym@gmail.com.

2. What we collect

• Account: email address; password (stored only as an irreversible hash); dates of sign-up and sign-in; IP address; browser and device information.
• Service data: project and brief information; content prepared, approved or rejected and the records of those decisions; the Telegram username or name of people the user adds to the approval group.
• Connected platforms: access tokens (in encrypted storage); the ID and name of the connected channel, page, board, community or account; links to published content; daily numbers for the business’s own publications and account, described in section 4. These numbers contain no personal data.
• Public sources: quotes from publicly available web pages, reviews, discussions and public channels, and the numbers of public channels and posts, for market research. Quotes are used in reports without the authors’ names or account details.
• Enquiries: name, email address and message.
• Security logs: IP address, date and time, requested page, browser information.

Business information a user enters (business name, website, industry, market, products) is not personal data unless it identifies a person. We do not collect sensitive personal data. The Service is intended for people aged 18 or over acting on behalf of a business.

3. Why we use it

• To open and secure accounts and provide the Service: research, content plan, content, approval, publishing and performance reports — to perform our contract with the user.
• To keep the Service secure and record who approved content — our legitimate interests.
• To research the market from public sources and suggest topics — our legitimate interests; the data was made public by the people concerned.
• To answer enquiries and privacy requests — our contract with the user and our legal obligations.
• Analytics cookies, if any — only with consent.

We do not sell personal data and do not use it for advertising or for training models. We do not make decisions with legal or similarly significant effects based solely on automated processing.

4. Connected platforms

A user connects a platform account personally, by signing in on the platform and granting access. The Service never publishes anything the business has not approved, and reads only the numbers of the business’s own publications and account. It does not read private messages or the names or lists of followers, subscribers, viewers or members.

YouTube: the Service uploads videos to the channel and reads the channel name and ID to show where videos will go. Once a day it reads the views, likes and comment counts of the videos it published (YouTube Data API), how many times they were shared (YouTube Analytics API), the channel’s subscriber count and views of its recent videos. It deletes a video it published only when the owner presses “Remove from platform”. With the same access it looks at public videos of channels on the business’s topic and their numbers to suggest topics. It does not read comment texts or watch history.

Pinterest: the Service reads the list of boards to find or create a board named after the brand, publishes Pins to it and deletes them when the owner asks. Once a day it reads the impressions, reactions, comments and saves of the Pins it published, the account’s follower count and the numbers of its recent Pins.

VK: the owner connects with VK ID. The Service publishes posts, photos and videos to a community the owner administers and deletes them when the owner asks. Once a day it reads views, likes, reposts and comment counts of the published posts, the community’s member count and views of its recent posts. With the same access it looks at public communities on the business’s topic and their posts with numbers to suggest topics.

Instagram, Facebook, Threads, TikTok and LinkedIn: the Service prepares content for these platforms, and the business publishes it itself; the Service does not publish to them or delete from them. If the business connects one of these accounts, the Service reads, once a day, only these numbers:

• Instagram professional account: follower count; for each post — views, reach, likes, comments, shares and saves.
• Facebook Page: follower count; for each post — views, reactions, comments and shares.
• Threads: follower count; for each post — views, likes, replies, reposts and quotes.
• TikTok: follower count; for each video — views, likes, comments and shares.
• LinkedIn company page: follower count; for each post — impressions, clicks, reactions, comments and reposts.

To let the owner choose which page or account to connect, the Service may read the list of pages or accounts the owner manages (name and ID only).

Telegram and MAX: the Service publishes content to the channel the owner specifies and deletes it when asked. For a public Telegram channel it reads the numbers from the channel’s public page.

Aggregate metrics, such as typical views per post or responses per 1,000 views, are calculated by the Service itself from the platforms’ numbers; they are not platform data.

The Service uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service; the Google Privacy Policy applies. Bulbul Lab’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share it with

We share personal data only with the recipients below, for the stated purpose and as far as that purpose requires. Contractors process data on our behalf and may not use it for their own purposes.

• Hosting and server provider — running the Service (Germany).
• Database and authentication provider — storing account and project data.
• Email delivery provider — sign-in and notification emails (United States).
• AI language model providers — processing briefs, public source texts and drafts to prepare research and content (United States).
• The platforms the business connects — publishing and reading numbers on the business’s instruction.
• Advisers and competent authorities — where the law requires.

Because the Service runs on servers in several countries, personal data is transferred outside the user’s country, with the safeguards the applicable law requires.

6. How long we keep it and how we delete it

• Account data — while the account is open and up to 30 days after it is closed.
• Numbers of the business’s publications and accounts — while access is active and for no longer than 36 months.
• Public videos of other YouTube channels — no longer than 30 days.
• Enquiries — up to 12 months after the reply.

When the owner presses “Disconnect” in “My platforms”, the access token is deleted immediately and everything obtained through that connection is deleted immediately (YouTube, Pinterest) or within one day (other platforms); for YouTube, access is also revoked at Google immediately. Access can also be revoked on the platform itself, in its settings for connected apps (for Google: myaccount.google.com/permissions). If there has been no access to YouTube for more than 30 days, all numbers obtained from it are deleted. On request, we delete access tokens and related data within 7 days. Step-by-step instructions: How to delete your data.

7. Your rights

Depending on where you live, you may have the right to access your personal data and receive a copy, correct it, delete it, restrict or object to its processing, withdraw consent, and complain to your data protection authority. To use these rights, email milan1982.ym@gmail.com from the address registered in the Service. We reply within 30 days.

8. Cookies

Strictly necessary browser storage keeps you signed in to the dashboard and remembers your language and settings. Analytics cookies, if used, are loaded only with your consent.

9. Security

Connections are encrypted (HTTPS). Passwords are stored only as irreversible hashes and platform access tokens in encrypted storage. In the database each user can see only their own data.

10. Changes

We may update this policy and will publish the new version on this page with its date. If we start using personal data for a new purpose, we will inform users before doing so.