No-Code Automation Setup: Tool Selection, Cost Model and the Limits of KVKK

Last updated: 10 September 2026Rules, fees and platform policies change. This guide is reviewed and kept current.

Almost every piece of content comparing no-code automation tools compares them on the wrong axis: how many integrations does it have, how easy is the interface, how many dollars a month. For a small e-commerce operation those are not what decides it. Two things decide it: what the billing unit is, and whether it actually connects to your Turkish systems.

There is a third subject too, and it is usually not discussed at all: sending customer data to a tool hosted abroad is, under Turkish data protection law, a transfer of personal data abroad. There is a procedure for that, and “I obtained explicit consent” is not a valid basis for a continuously running integration.

Below I work through those three subjects in order. The information is as of August 2026, from the platforms’ own pages and the official publications of Turkey’s data protection authority (KVKK). Because prices change constantly, I describe the model rather than the amount.

A note for international readers: the data protection section covers KVKK, Turkey’s personal data protection law — the framework that applies if you process customer data in Turkey. It is structurally similar to GDPR but the procedures, deadlines and forms are its own. The tool comparison itself is not Turkey-specific.

The billing unit: this is where the real cost difference lives

The four major tools calculate on completely different logic, and the same workflow can cost ten times more in one than in another.

Zapier: per step (task)

In Zapier’s own words: every step in a Zap and every external connector call uses a task. Which means multi-step workflows are penalised. A five-step automation costs two and a half times as much as a two-step one — even when it does the same job.

The pool is shared, too: tasks are shared across your account. Zap workflows, AI steps, code, MCP and the SDK all draw on the same task allocation. The free tier comes with 100 tasks a month and a two-step workflow limit — so building anything serious on the free tier is not possible.

On the AI side there is a separate meter: Agents are measured in “activity”, Chatbots are billed per chatbot, and for Zapier MCP the rule is explicit — one MCP tool call uses two tasks from your Zapier plan’s quota. So the AI features are a second meter running on top of tasks.

Make: per module (credit)

An important terminology change: Make now bills credits rather than “operations”. Every module action in your scenario — adding a Google Sheets row, pulling Gmail account data — counts as one credit. This is the concept that older Turkish content refers to as an “operation”.

The logic resembles Zapier’s (per module), but two limits on the free tier put Make in a particular position for a small operation: a 15-minute minimum scheduling interval and a maximum of two active scenarios. On paid plans the interval goes down to one minute. For a job like stock synchronisation a 15-minute interval is not practically sufficient — so on Make the free tier is not a real option, it is a test environment.

What Make officially offers on the AI side: Maia by Make (building automations and AI agents through natural conversation), Make AI Agents (in beta, on all plans, usable with your own LLM keys), the AI Toolkit, Make Grid, and the AI Content Extractor and AI Web Search modules.

n8n: per run (execution)

This is the most advantageous model for a small operation, and n8n’s own definition explains why: an execution is a single run of your entire workflow. It does not matter how many steps the workflow has or how much data it processes — it is still one execution.

So a complex 20-step workflow costs the same as a simple 2-step one. In an architecture where you will have to connect to Turkish systems with HTTP calls — and you will, as we will see below — that difference is decisive.

Power Automate: per user or per bot

Microsoft’s model is entirely different: not tasks or credits but a licence per user or per bot. Power Automate Premium is per user per month, Power Automate Process is per bot per month, and Hosted Process is per bot per month including a Microsoft-hosted VM. The AI side runs through Copilot Studio on a capacity basis (Copilot Credits).

Which Power Automate capability comes with a Microsoft 365 licence is not stated on the pricing page, and request limits are left to a separate page — so unless you are already in the Microsoft ecosystem, this tool requires additional research.

The decision rule

Simple: if your workflows are long and HTTP-heavy, n8n; if they are short, few-step and rich in ready-made connectors, Zapier; if you are somewhere in between and want visual scenario management, Make; if the company is already in the Microsoft ecosystem, Power Automate. Most Turkish e-commerce operations fall into the first group.

The n8n licence: a common misunderstanding

n8n is still distributed as fair-code under the Sustainable Use License. On the self-hosting side, the Community Edition is “completely free and unlimited” — no licence key required, usable indefinitely. Registering for free (Registered Community) additionally unlocks folders, editor debugging and custom execution data annotation. Items such as SSO, projects, git version control and external secret management are tied to a paid licence.

The licence’s two functional limits read as follows:

You may use or modify the software only for your own internal business purposes or for non-commercial or personal use.

You may distribute the software or provide it to others only if you do so free of charge for non-commercial purposes.

The meaning of this is the opposite of a much-repeated error: the sentence “the Sustainable Use License does not permit commercial use” is not true. Running self-hosted n8n to automate your own e-commerce operation falls squarely within “your own internal business purposes” — no licence fee, no execution limit. The restriction is about providing the software to others: reselling n8n, hosting it as a service for other people, or embedding it inside a commercial product is not permitted.

There is a grey area, and it should be stated honestly: is an agency running client automations on its own n8n server covered by “internal business purposes”? The licence text does not resolve this and I could not find an official clarification. If you work on an agency model you need to ask n8n or your own legal adviser — do not rely on opinions found online.

The Turkish reality: there are no ready-made connectors

This is the most concrete constraint, and it determines the architecture. What can be verified in the four platforms’ official integration directories:

What exists:

• WooCommerce: available in Zapier, Make and n8n. On the Zapier side, triggers for orders, customers, products (including variations), coupons, subscriptions and bookings; on the n8n side, full CRUD for customers, orders and products.
• Shopify: present in all four. The connector on the Power Automate side is Independent Publisher, Premium class and in Preview status, offering only four actions. So it is not a first-party Microsoft connector — plan with that in mind.
• ikas: has a native app in Zapier — the only Turkish e-commerce platform with a native app across the four directories. Triggers: new customer, new product, new order, updated order.

Not found in the official directories: Trendyol, Hepsiburada, Ticimax, İdeaSoft, Paraşüt, Logo, Netsis and the Turkish e-invoice providers (Nilvera, Sovos, BirFatura, Foriba and similar) have no counterpart in the Zapier, Make or n8n directories. (I could not verify Power Automate’s full connector list; for those tools I am not saying “there is none”, I am saying “I could not confirm”.)

That looks like bad news but it actually clarifies the architecture. The realistic setup is:

• A native connector for the store side: Shopify, WooCommerce or ikas.
• A generic HTTP module for the Turkish providers: Paraşüt has a documented public API (Parasut API V4). Trendyol and Hepsiburada also have official developer portals and seller APIs. So these systems are reachable; there is simply no ready-made box, and you have to write the HTTP request.

And this is exactly where n8n’s execution-based billing wins: in an HTTP-heavy workflow, Zapier counts every call as a task while n8n counts the whole flow as a single execution. The same integration, doing the same job, produces very different costs in the two tools.

An additional note: ikas’s own app marketplace and integration documentation cover ground the automation platforms do not — accounting, shipping and logistics, marketing and marketplace categories, with separate support articles for the Zapier and Paraşüt integrations. If you use ikas, looking there before going to an automation platform saves time.

KVKK: sending customer data to a tool hosted abroad

From here on the heading is operational rather than legal — because the work to be done is defined, and there are sanctions when it is not done.

First, let us frame the concept correctly: sending a prompt containing a customer’s name, email, phone number or order details to a US or EU-based language model or automation platform is not “using” it — it is a transfer abroad. The same applies to running scenarios on an automation platform that holds customer data.

The legal framework

Article 9 of KVKK was amended by Law No. 7499 (Official Gazette 12.03.2024, issue 32487) and the changes took effect on 01.06.2024. By decision 2024/959 of 04.06.2024, the Board adopted the standard contractual clauses and the application forms for binding corporate rules. What emerged is a tiered regime:

• An adequacy decision — which can now be issued not only per country but also for a sector within a country or for an international organisation.
• Appropriate safeguards — where there is no adequacy decision: an agreement between public institutions plus Board authorisation; binding corporate rules (for intra-group transfers, pre-approved by the Board, with no separate authorisation needed per transfer); a standard contract (requiring no additional authorisation, but notification to the Authority is mandatory); or an undertaking plus Board approval.
• Incidental cases — a limited list including explicit consent, performance of a contract, overriding public interest and similar.

The critical point: KVKK’s page on “countries with adequate protection” still states that no determination has been made — meaning there is no adequacy decision for any country. The first route is closed. (Because this is the whole basis of the practical advice, verify it yourself at kvkk.gov.tr before transacting.)

The second critical point: explicit consent is not the right basis for a continuously running integration. Explicit consent sits in the “incidental cases” layer, and KVKK explicitly limits that layer to transfers that are “incidental, non-regular, non-continuous and rarely occurring”. A permanently open AI integration is not incidental. So “I got the user’s consent” does not legitimise this structure.

What you actually need to do

Since there is no adequacy decision, you need to put an appropriate safeguard in place. For a small business the normal route is a standard contract. There are four types: SS-1 (controller to controller), SS-2 (controller to processor), SS-3 (processor to processor), SS-4 (processor to controller). For an e-commerce company sending customer data to a foreign AI or automation provider, SS-2 is normally the relevant one. (That mapping is an interpretation, not KVKK’s own statement — take advice for your own situation.)

Notification deadline: within five business days of completing signature, notification to the Authority. KVKK’s public announcement of 5 February 2025 lists the errors it actually sees, and they are entirely procedural:

• Both parties (or duly authorised signatories) must sign; a missing signature invalidates the contract.
• If it is also drawn up in a foreign language, both parties must sign the Turkish text; in a two-column contract the signatures must be in the Turkish column.
• Documents evidencing signature authority must be submitted with the contract and must name the actual signatories.
• Party names must be complete and identical to the documents.
• Notification must be physical, by registered electronic mail (KEP) or through the Standard Contract Notification Module; both parties must write the signature date so that compliance with the deadline can be checked.
• Consular approval or an apostille for foreign official documents; notarised Turkish translation for documents in a foreign language.
• A retroactive effective date cannot be used.
• “No additions, deletions or amendments may be made to the standard contract texts, other than optional or alternative clauses.”

None of these are difficult, but all of them are easy to skip. One more note: a provider’s “we do not use your data for training” statement or a zero data retention setting does not change this analysis — a transfer is still a transfer. I have not come across a specific KVKK decision on this point, but it is clear that it does not eliminate the transfer.

Separately: KVKK Article 10 requires the disclosure obligation to name the transfer and its recipients, and Article 12 security measures apply.

The new announcement on the marketing side

There is a text that directly concerns any e-commerce operation building automations: KVKK’s public announcement of 21 July 2026 on the use of personal data obtained from third parties for advertising and marketing purposes. The core findings:

• The fact that personal data was obtained from third parties does not by itself provide data controllers with a legal basis for processing that data for advertising and marketing. Referral, brand ambassadorship and “recommend a friend” constructions are named directly.
• Timing of disclosure when data is not collected directly from the data subject: within a reasonable period; at first contact if contact is to be made; and at the latest at the first transfer if it is to be transferred.
• Implied conduct is not explicit consent: staying on the line during a call, asking a question, or not replying “STOP” to an SMS do not count as consent.
• Disclosure and explicit consent are separate operations and must be carried out independently.
• Non-compliance can give rise to administrative sanctions under Article 18 of Law 6698.

The practical conclusion: if the input to the automation you built for growing an email list is “the email address of a customer’s friend”, you need to switch that automation off.

KVKK’s AI guidance

KVKK has two publications in this area. The older one is “Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence” — privacy by design, data minimisation, continuous monitoring of model accuracy, rights of objection and erasure, human oversight in automated decision-making. The current and directly relevant one is the “Guide to Generative Artificial Intelligence and the Protection of Personal Data (in 15 Questions)”, published on 24 November 2025. It aims to guide actors acting as data controllers in personal data processing across the generative AI lifecycle. This is the text to read before building an automation.

Is there an AI law in Turkey?

No. There is an “Artificial Intelligence Bill” in the Grand National Assembly (file no. 2/2234, submitted 24/06/2024) which has been in committee for more than two years; it is an opposition member’s bill. Other AI-related bills were referred to committees in 2026 as well, but none have been enacted.

The real development of 2026 is on the executive rather than the legislative side: Presidential Circular No. 2026/9 on the Turkey Artificial Intelligence Action Plan (2026–2030) was published in the Official Gazette of 18 August 2026, issue 33344. But this needs framing correctly: a Presidential Circular is a policy and coordination instrument; it is not a law imposing obligations on private companies in the manner of the EU AI Act. Be wary of content that conflates the two.

Setup order

1. Write the process down first, choose the tool second. Which step takes data from which system, and writes to which? If you cannot see that on one page, it is too early to automate it.
2. Mark the steps where personal data passes through. For those steps, put the transfer-abroad procedure in place (standard contract, signature, supporting documents, five-business-day notification) — or redesign the step so no personal data passes through it. The second is usually cheaper: an order number instead of a customer name, an anonymous identifier instead of an email address.
3. Choose the tool by billing unit. HTTP-heavy, long flows → n8n; short flows with ready-made connectors → Zapier; visual scenario management → Make.
4. Start with a single flow and run it with human approval for two weeks. Read the automation’s output before it goes out. Note the errors.
5. Set up failure alerting. An automation that quietly stops working is more dangerous than one that was never built — because you think it is running. Attach a failure notification to every flow.
6. Pick a single metric. Time saved, errors reduced, response time shortened — whatever it is. You cannot know whether an automation you do not measure is working.

Four mistakes to avoid

• Going to production on a free tier. Make’s 15-minute interval and two-scenario limit, and Zapier’s two-step workflow limit, do not carry real work. The free tier is a test environment; build production on it and it gets abandoned in week three.
• Full synchronisation on a fixed interval. It burns credits and tasks needlessly and runs into marketplace API limits. Build an architecture that sends only what changed.
• Automating customer-facing messages without approval. This is the single point where the gain turns into risk. Generate a draft; let a human approve it.
• Putting the transfer procedure on the “we will sort it later” list. A standard contract has to be notified within five business days of signature and a retroactive effective date cannot be used. So it cannot be fixed afterwards — it has to be done again.

Setting the expectation correctly

No-code automation does save real time in a small e-commerce operation — but the place it saves it may not be where you think. The highest-return flows are usually the boring ones: order data flowing into accounting, a stock alert, opening a return record, writing the invoice number into the dashboard. These are not exciting, but they repeat every day and the error rate is high.

By contrast the most-discussed flows — an AI agent, automated content, automated customer replies — are the ones that need the most control. Starting both in the same setup ends with both left half-finished.

Start with the boring one. Watch it for two weeks to see whether it works. And choose the tool according to whether the billing unit suits the shape of your workflow — not according to how attractive the interface is.

Related reading

• Five practical examples of building automation on human approval: AI automation in small e-commerce.
• The search-side limits of AI content production: the limits of AI content production.
• Marketplace API limits and the reality of stock synchronisation: marketplace catalogue management.

Sources: zapier.com/pricing, make.com/en/pricing, n8n.io/pricing and the n8n Sustainable Use License text, microsoft.com Power Automate pricing, the relevant official integration directories, apidocs.parasut.com; KVKK’s transfer-abroad page, standard contracts page, the public announcements of 5 February 2025 and 21 July 2026, and the “Guide to Generative Artificial Intelligence and the Protection of Personal Data (in 15 Questions)” (24 November 2025); Grand National Assembly bill record 2/2234; Official Gazette 18 August 2026 – 33344. All as of August 2026. Price and quota information can be changed by providers without notice. This post is not legal advice; consult your own legal adviser on personal data transfers.

Sources and official links

• Turkish DPA (KVKK) — Guide on cross-border transfer of personal data — Adequacy decisions, appropriate safeguards and incidental cases for transfers abroad
• Turkish DPA (KVKK) — Cross-border transfers — The official summary of the three-tier structure of Article 9
• Turkish DPA (KVKK) — Public notice on standard contractual clauses — Using standard contractual clauses and the notification duty
• Ministry of Trade ETBİS — E-commerce legislation index — The official, current index of e-commerce legislation
• Official Gazette — Regulation on e-commerce intermediary and e-commerce service providers — The regulation setting out marketplace and service provider obligations

Rules, fee schedules and platform policies change. The figures in this post reflect the position at the time of writing; confirm the current position from the official sources above before you act.

About the author

Toros Panos

I work on e-commerce and marketplace operations. On this site I publish practical guides on Trendyol, Hepsiburada and Amazon operations, unit economics, micro-export and no-code automation — each built on official platform documentation and current regulation.

Consulting . All articles . LinkedIn