Who we are and what this policy covers
Ivmentum is the agency brand used for performance marketing and supporting software activities. Yiğit Büyüktuna and Eren Nalbant operate under this brand. No separate legal entity has yet been established; “Ivmentum”, “we” and “us” in this policy refer to their activities.
This policy covers ivmentum.com, the Ivmentum Panel at panel.ivmentum.com, client-specific setup links and related communications. Visiting the website alone does not grant access to your Google account or client files.
Yiğit Büyüktuna and Eren Nalbant are the data controllers for website visitors and the agency’s own client contacts. The role distinction below applies to business data processed for clients within the panel. Our privacy contact address is info@ivmentum.com.
Our roles
Ivmentum acts as a data controller when assessing website enquiries, conducting its own client communications and determining those activities’ purposes.
For client lead spreadsheets and advertising-account data processed within the panel, Ivmentum acts as a processor on the client’s behalf and instructions; the client retains its controller responsibilities.
Details are set out in the data processing agreement with the client.
Website visitors
Contact form and correspondence. You provide your name, email, phone number, optional brand or website information and message through the form. We use these to assess and respond to enquiries and conduct meetings and proposal discussions. Enquiries are recorded by our form service and notified to us by email. Information sent by phone, email or other channels is likewise handled only for the communication’s purpose.
Newsletter. The website’s newsletter field currently neither registers subscriptions nor sends newsletters. Entering an address alone does not add you to a mailing list. If the service launches, its purpose and preference controls will be explained beforehand.
Cookies and technical data. Google Analytics 4 loads for visitor analytics only after you accept the analytics choice. If you decline, this analytics tag does not load. Technical request information processed by infrastructure services for website delivery, fonts and security is a separate process.
Please avoid sending special-category data, such as health information, or irrelevant third-party information through contact fields.
Google Analytics and cookie preferences
With your permission, Google Analytics 4 produces statistics about page visits, browser/device and session information, traffic sources and campaigns, and contact interactions. The purpose is to understand and improve website use. Successful contact form submissions, phone or email link clicks, and opening the meeting calendar are measured as separate events. Opening the calendar does not mean a booking was completed.
The contact form’s name, email, phone, brand and message fields are not included in Analytics events. Full URL queries and fragments are not sent; appropriately formatted campaign tags may be used for measurement. Advertising personalisation and Google signals are disabled in this installation.
Analytics permission is requested through a separate choice; it is not required to use the site. You can change your decision using “Cookie preferences” at the bottom of the page. Withdrawing permission stops new analytics transmissions and deletes this installation’s analytics cookies from your browser. This does not automatically delete previously transmitted data; use the contact route below to exercise your rights.
With permission, the _ga and _ga_0LMC4RDN7V cookies may be used for up to 180 days to distinguish browsers and sessions. Your analytics choice is remembered for up to 180 days in the local storage record ivmentum_analytics_consent_v1; this record is for managing analytics preferences. Google Analytics user- and event-level data retention is set to 2 months, with reset on new activity disabled. This period differs from browser cookie lifetime; aggregate standard reports are not subject to the same retention control.
Analytics data is sent to the Google Analytics service and may be processed or transferred abroad. Your separate consent to website analytics is not general consent for other activities. International-transfer information and your rights are described below. For details of Google’s data use, see Google’s explanation of data use on partner sites.
Ivmentum Panel and platform connections
The Ivmentum Panel is currently the agency’s internal reporting and operations tool. Clients do not receive separate panel accounts; reports are shared by email. Client setup links are designed for clients to submit their own answers and approve access steps themselves.
Daily GA4 reading, client spreadsheet reading and AI-assisted report drafts are existing functions.
4.1 Google user data
The Google connection helps clients grant agency access to their chosen GA4 property, Tag Manager account and containers, and Merchant Center account, and select a lead spreadsheet for reporting. The application name on Google’s permission screen is Ivmentum.
The client initiates the connection, selects the property, account or file and approves the relevant step. Partial permissions may be granted; operations requiring ungranted permissions are not performed. Requesting a permission does not mean that every operation it allows will be performed.
Permissions are used as follows:
- analytics.readonly: GA4 account and property names and identifiers are read so the client can select a property. This permission does not read traffic or conversion reports during setup.
- analytics.manage.users: The selected property’s current user/access list is checked for existing agency access. With client approval, the panel’s reporting account is added as Viewer and operations@ivmentum.com as Editor. The client must be authorised to do this. Other users’ access is not changed or removed.
- tagmanager.readonly: Tag Manager account and container names and identifiers are read for client selection. Tag, trigger and variable contents are not read.
- tagmanager.manage.users: The selected account’s user permissions are checked for existing agency access. With client approval, the agency user is added. Selected containers receive read permission by default, or edit if chosen. Other users’ permissions are not changed or removed.
- Merchant Center — auth/content: Account names, identifiers and the selected account’s user list are read. With client approval, the agency user is invited with STANDARD permission; access remains pending until acceptance. Products, prices, stock and feeds are not read or changed.
- drive.file: The client selects one Google Spreadsheet using Google’s file picker. Its type and sheet information are checked; with approval, it is shared with the panel’s spreadsheet reader as Viewer. Other files are not accessed. Files are not created, edited or deleted.
Account, property, container and user lists read during setup are not persistently stored or logged. Granted-access identifiers, statuses and operation results are recorded. The Google access token is held temporarily only for setup, for at most 10 minutes, then deleted on completion or expiry. It is not persistently stored; no refresh token is requested.
After setup, the panel’s reporting account reads the authorised GA4 property daily. Data comprises daily channel totals for sessions, active users, events, key events and total revenue. User and transaction identifiers are not read; campaign-level or source/medium GA4 data is not collected. These totals provide traffic and conversion context and are excluded from paid-advertising ROAS.
This client connection does not request Google Ads OAuth permission. Google Ads access uses a separate manager-account (MCC) invitation. The Merchant Center–Google Ads link also uses that separate authorisation.
Ivmentum does not sell Google data, provide it to data brokers, or use it for ad serving, targeting, retargeting or advertising-related personal profiling. It does not use or share it to train any AI model, including its own. Setup and panel operations do not create or change campaign, ad, bid, budget or audience settings. Separate advertising measurement is described below.
You can revoke Ivmentum’s application permission through your Google account’s permissions page. This does not automatically remove previously added agency/reporting-account access or spreadsheet sharing. To stop daily reading, also remove the GA4 reporting account’s access and the spreadsheet reader’s sharing permission. Manage agency access in the relevant Google product’s user settings or ask us to end the connection. Stored-data deletion can be requested separately.
Our commitment concerning Google data covers the Google API Services User Data Policy and Limited Use requirements:
Ivmentum's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4.2 Lead spreadsheet and advertising measurement
Mapped fields in the first sheet of the client’s shared lead spreadsheet are read daily. Reporting uses dates, lead identifiers, source, medium, campaign, ad identifiers, lead stage, revenue, currency and available advertising click identifiers. Names, phone numbers, email addresses, addresses and free text are not stored as reporting data.
These fields connect advertising activity with lead and sales outcomes. Omitting names and contact details does not automatically anonymise lead or click identifiers; these identifiers remain subject to the relevant data protection measures.
When the separate offline conversion feature is enabled at the client’s request and approval, click identifiers and lead stages are sent to Google Ads for advertising measurement. It is disabled by default and never enabled for healthcare or finance clients. Click identifiers are deleted 90 days after the relevant lead date.
4.3 AI-assisted report drafts
When an agency employee initiates report preparation or analysis assistance, the panel’s calculated report summaries may be sent to AI services. They include client strategy and objectives, report totals, campaign names, spend and outcomes, unmatched-record summaries, budget pacing, creative assessments and notes with personal information masked.
Alerts derived from GA4 session or conversion totals may also be included. Account and user lists obtained during setup are not sent. Lead spreadsheet names, phone numbers, email addresses and addresses are not inputs to this report-drafting flow.
The purpose is to support preparing and evaluating the client’s report. Drafts undergo human review; they are not automatically sent to clients and do not independently change platforms. Ivmentum does not use the data for model training.
Who do we share data with?
Data is shared as necessary to deliver services with providers of hosting, website delivery and backup; AI-assisted analysis and report drafting; email and team communications; fonts; and relevant advertising and analytics platforms. Sharing supports operating the service, preparing reports, communicating or performing the measurement described above.
Information may also be shared with competent public authorities when legally required. This policy does not authorise selling Google data or using it for other purposes. Specific providers and processing terms on clients’ behalf will be detailed in the forthcoming client documents.
International transfers
Some service providers operate abroad; data is transferred outside Türkiye when delivering services. International transfers must comply with Article 9 of Türkiye’s Personal Data Protection Law (KVKK). The applicable transfer arrangement must be determined for the actual recipient and processing activity.
Recipients, processing countries and transfer arrangements will be described in disclosure and data processing documents to be prepared for client onboarding.
Retention and security
Our adopted retention policy is to retain panel client data during the client relationship and delete it from active systems within 30 days after the relationship ends or the client requests deletion. Backup deletion cycles will complete within 90 days. Click identifiers have a separate 90-day period starting on the lead date.
This policy covers reporting data, fields collected from lead spreadsheets, access records, report drafts and activity records. The Google setup token’s maximum 10-minute temporary-use period is separate. Revoking access and requesting deletion of previously stored information are different actions.
Enquiries without a client relationship are retained only as long as necessary for assessment and correspondence. Platform access credentials and backups are encrypted; panel access is role-based and restricted. Reasonable technical and organisational measures protect against unauthorised access and loss; no internet service can guarantee absolute security.
Your rights
Subject to the conditions of KVKK Article 11, you may exercise the following rights:
- Learn whether your data is processed; request information if it is, learn the purpose and whether use complies with that purpose.
- Learn which third parties receive your data within or outside Türkiye.
- Request correction of incomplete or inaccurate data, deletion or destruction where legally applicable, and notification of these actions to recipients.
- Object to adverse outcomes arising solely from automated analysis and seek compensation for damage caused by unlawful processing.
People outside KVKK’s scope may also contact us to request access, correction, deletion or object to processing. Requests are assessed under the applicable law and processing context; we do not claim identical statutory rights apply in every country.
A request concerning a lead record processed for a client may need to be handled with that client as controller. Contact us for help routing it appropriately. Additional information may be requested only as necessary to verify identity or representative authority; an in-person meeting is not a general requirement.
Children
Our services are business-oriented and not designed for people under 18. We do not invite children to submit marketing or panel-use enquiries. This does not guarantee that a client-supplied dataset can never contain children’s data.
If you believe a child’s information has been processed inappropriately, notify us through the channels below. We assess notifications considering the data’s source and the relevant client’s responsibilities. We ask clients not to share children’s data or sensitive information unnecessary for the service.
Changes and effective date
This version is dated 14 October 2026. The policy is updated when services or data practices change; the current version and date are published here. Information and any required permission step must precede new data uses or additional Google permissions.
External services have their own privacy practices. The Turkish text is the original; the English version is its translation.
Contact and requests
For privacy questions, ending connections and deletion requests, email info@ivmentum.com. You can also contact us by phone or WhatsApp at +90 532 552 12 30 or +90 533 408 62 66.
Contact and postal address: ODTÜ TEKNOKENT Information Technologies Innovation Center, Mustafa Kemal District, Dumlupınar Boulevard 280/G, Ground Floor, Çankaya / Ankara, Türkiye. Address requests to Yiğit Büyüktuna and Eren Nalbant, identifying the Ivmentum brand.
Provide enough information to locate the relevant service, account or record and explain your request; do not send passwords or access tokens. These channels receive requests; KVKK formal application procedures remain applicable. Properly submitted applications are answered within statutory periods.