Registration and payment verification serve different purposes.

Start with proportionate registration

Name, verified email, country, role and accepted terms can provide an initial registration frame. Google sign-in should display the permissions requested.

It does not prove ownership of an Instagram or TikTok account. Public profile links and campaign fit require a separate review; social-media passwords are not an application requirement.

Explain why identity checks are needed

KVKK's biometric guidance discusses necessity, purpose and proportionality when evaluating biometric processing. KVKK biometric guidance. Requiring every applicant to record a video selfie does not itself establish a safe or lawful process.

Assess the verification purpose, legal basis, provider and less intrusive alternatives rather than collecting more data by default.

Use a suitable provider flow

Reklamatic currently has no connected identity provider and does not collect raw IDs or selfies. Stripe Identity illustrates provider-managed verification data. Stripe Identity.

It is not necessarily available or suitable for every Turkish business. Any future integration needs confirmed suitability and contracts, provider-hosted capture and minimum result/reference retention in the campaign portal.

Do not send ID images to campaign chat or general uploads.

Provider use still requires governance

Stripe's legal guidance asks businesses to assess use, retention and deletion of sensitive verification information. Stripe identity-data considerations. Explain access, cross-border processing, retention and appeals.

Hosting documents elsewhere does not require unrestricted administrator access. Keep a deletion process and a route for failed checks to receive appropriate review.

IBAN syntax does not prove ownership

İş Bankası explains that Turkish IBANs contain 26 characters and describes validation to detect input errors. İş Bankası IBAN guidance. A correctly formatted number alone does not identify its owner.

Beneficiary verification must be evaluated separately. Mask IBANs in routine views and protect changes with re-verification and an audit history.

Show the withdrawal process honestly

Display the withdrawable amount, charges, currency, destination and status. In Reklamatic's current flow, Cem checks eligible views and corresponding Whop settlement, then transfers funds manually.

There is no automatic cashout. Keep request, bank submission and completion timestamps separate.

A 1–3 business-day target needs a start point and exceptions. Explain missing information or bank rejection instead of marking it paid.

Define support-chat boundaries

Support can help with briefs, public post URLs, approval states and payout progress. It should not request banking passwords, raw identity documents, session tokens or confidential customer files.

An AI assistant should route unresolved cases to people instead of inventing acceptance or payment promises. Members must not see another person's private payment details.

Check the route before sharing data

Review the domain, privacy notice, contact route and permissions before joining. Check the provider address before identity capture.

Avoid leaving sessions open on shared devices or lending out your account and beneficiary details. Tax and invoicing obligations depend on individual circumstances; a portal approval does not settle every obligation.