1"use strict";(self.webpackChunkPump=self.webpackChunkPump||[]).push([[9484],{99484(e,t,i){i.r(t),i.d(t,{default:()=>k});var r=i(65043),n=i(70579);const a="ChatPilots.AI",s="Cyber Istanbul INC",o="Istanbul, Republic of Turkey",c="chatpilots.ai",l="[email protected]",d="[email protected]",h="[email protected]",u="[email protected]",p="April 19, 2026",m="3.0",g='\n/* === Scroll fix: override AntD Layout / customerpanel parent === */\nhtml, body, #root { margin: 0; padding: 0; height: auto !important; min-height: 100vh; overflow-y: auto !important; overflow-x: hidden; background: #050814; color: var(--cp-text); font-family: \'Inter\', -apple-system, BlinkMacSystemFont, \'Segoe UI\', Roboto, sans-serif; -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; }\nbody { scroll-behavior: smooth; }\n.ant-layout, .ant-layout-content, .ant-layout-has-sider, [class*="container"], [class*="Container"] { height: auto !important; min-height: 100vh; overflow: visible !important; background: transparent !important; }\n\n/* === Page wrapper === */\n.lp-page { min-height: 100vh; width: 100%; position: relative; background:\n radial-gradient(1200px 600px at 15% -10%, rgba(139,92,246,0.18), transparent 60%),\n radial-gradient(900px 500px at 90% 10%, rgba(99,102,241,0.15), transparent 60%),\n radial-gradient(800px 400px at 50% 100%, rgba(236,72,153,0.08), transparent 60%),\n linear-gradient(180deg, #050814 0%, #08091a 50%, #050814 100%);\n color: var(--cp-text); overflow-x: hidden;\n}\n.lp-page::before { content: ""; position: absolute; inset: 0; background-image:\n linear-gradient(rgba(139,92,246,0.04) 1px, transparent 1px),\n linear-gradient(90deg, rgba(139,92,246,0.04) 1px, transparent 1px);\n background-size: 60px 60px; pointer-events: none; mask-image: radial-gradient(ellipse 80% 60% at 50% 0%, #000 30%, transparent 70%); }\n\n/* === Topbar === */\n.lp-topbar { position: sticky; top: 0; z-index: 50; background: rgba(8,9,26,0.75); backdrop-filter: blur(20px) saturate(180%); -webkit-backdrop-filter: blur(20px) saturate(180%); border-bottom: 1px solid rgba(139,92,246,0.12); }\n.lp-topbar-inner { max-width: 1200px; margin: 0 auto; display: flex; align-items: center; justify-content: space-between; padding: 14px 28px; gap: 16px; }\n.lp-logo { display: flex; align-items: center; gap: 12px; font-weight: 800; font-size: 17px; color: #f8fafc; text-decoration: none; letter-spacing: -0.02em; }\n.lp-logo-mark { width: 34px; height: 34px; border-radius: 10px; background: linear-gradient(135deg, #a855f7 0%, #6366f1 50%, #3b82f6 100%); display: flex; align-items: center; justify-content: center; color: #fff; font-weight: 900; font-size: 16px; box-shadow: 0 6px 24px rgba(139,92,246,0.45), inset 0 1px 0 rgba(255,255,255,0.25); }\n.lp-nav { display: flex; align-items: center; gap: 2px; flex-wrap: wrap; }\n.lp-nav a { padding: 8px 14px; border-radius: 9px; color: var(--cp-muted); font-size: 13px; font-weight: 500; text-decoration: none; transition: all 0.18s ease; }\n.lp-nav a:hover { background: rgba(139,92,246,0.10); color: var(--cp-violet); }\n.lp-nav a.active { background: rgba(139,92,246,0.15); color: var(--cp-violet); box-shadow: inset 0 0 0 1px rgba(139,92,246,0.25); }\n.lp-nav a.lp-cta { background: linear-gradient(135deg, #a855f7, #6366f1); color: #fff !important; padding: 9px 18px; box-shadow: 0 4px 18px rgba(139,92,246,0.4), inset 0 1px 0 rgba(255,255,255,0.2); font-weight: 600; }\n.lp-nav a.lp-cta:hover { transform: translateY(-1px); box-shadow: 0 8px 24px rgba(139,92,246,0.55); color: #fff !important; }\n\n/* === Hero === */\n.lp-hero { padding: 70px 24px 36px; max-width: 920px; margin: 0 auto; text-align: center; position: relative; }\n.lp-hero-eyebrow { display: inline-flex; align-items: center; gap: 8px; padding: 7px 16px; background: rgba(139,92,246,0.10); border: 1px solid rgba(139,92,246,0.25); border-radius: 999px; color: var(--cp-violet); font-size: 12px; font-weight: 600; letter-spacing: 0.6px; margin-bottom: 22px; text-transform: uppercase; backdrop-filter: blur(8px); }\n.lp-hero-eyebrow::before { content: ""; width: 6px; height: 6px; border-radius: 50%; background: #a855f7; box-shadow: 0 0 12px #a855f7; }\n.lp-hero h1 { font-size: 56px; font-weight: 800; line-height: 1.05; margin: 0 0 16px; letter-spacing: -0.04em;\n background: linear-gradient(180deg, #ffffff 0%, var(--cp-violet) 100%);\n -webkit-background-clip: text; background-clip: text; -webkit-text-fill-color: transparent;\n}\n.lp-hero-updated { color: var(--cp-muted); font-size: 13px; }\n.lp-hero-meta { display: inline-flex; gap: 8px; flex-wrap: wrap; justify-content: center; margin-top: 18px; }\n.lp-hero-meta span { background: rgba(139,92,246,0.06); border: 1px solid rgba(139,92,246,0.12); padding: 6px 14px; border-radius: 999px; font-size: 12px; color: var(--cp-muted); backdrop-filter: blur(4px); }\n\n/* === Body card === */\n.lp-body { max-width: 880px; margin: 0 auto; padding: 12px 24px 100px; position: relative; }\n.lp-card {\n background: linear-gradient(180deg, rgba(15,23,42,0.7) 0%, rgba(8,9,26,0.85) 100%);\n border: 1px solid rgba(139,92,246,0.14);\n border-radius: 22px; padding: 48px 52px;\n box-shadow:\n 0 1px 0 rgba(255,255,255,0.04) inset,\n 0 24px 70px rgba(0,0,0,0.55),\n 0 0 80px rgba(139,92,246,0.08);\n backdrop-filter: blur(20px);\n position: relative;\n}\n.lp-card::before { content: ""; position: absolute; top: 0; left: 30px; right: 30px; height: 1px;\n background: linear-gradient(90deg, transparent, rgba(168,85,247,0.4), transparent); }\n\n.lp-intro { font-size: 15px; line-height: 1.85; color: var(--cp-text2);\n background: linear-gradient(135deg, rgba(139,92,246,0.08), rgba(99,102,241,0.04));\n border: 1px solid rgba(139,92,246,0.18);\n border-left: 3px solid #a855f7;
1\n padding: 22px 26px; border-radius: 14px; margin-bottom: 28px;\n}\n.lp-intro p { margin: 0 0 14px; color: var(--cp-text2); }\n.lp-intro p:last-child { margin-bottom: 0; }\n.lp-intro a { color: var(--cp-violet); }\n\n.lp-info-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 12px 24px;\n padding: 22px 24px;\n background: rgba(255,255,255,0.02);\n border: 1px solid rgba(139,92,246,0.10);\n border-radius: 14px; margin-bottom: 28px; font-size: 13px;\n}\n.lp-info-grid .k { color: var(--cp-muted); font-weight: 500; font-size: 12px; text-transform: uppercase; letter-spacing: 0.5px; }\n.lp-info-grid .v { color: var(--cp-title); font-weight: 600; word-break: break-word; }\n\n/* === Table of Contents === */\n.lp-toc {\n background: rgba(139,92,246,0.04);\n border: 1px solid rgba(139,92,246,0.14);\n border-radius: 14px; padding: 22px 26px; margin-bottom: 36px;\n}\n.lp-toc h4 { font-size: 11px; font-weight: 700; color: #a855f7; text-transform: uppercase; letter-spacing: 1.4px; margin: 0 0 14px; display: flex; align-items: center; gap: 8px; }\n.lp-toc h4::before { content: ""; width: 14px; height: 2px; background: #a855f7; border-radius: 2px; }\n.lp-toc ul { margin: 0; padding-left: 0; columns: 2; column-gap: 28px; list-style: none; }\n.lp-toc li { font-size: 12.5px; padding: 4px 0; line-height: 1.55; break-inside: avoid; counter-increment: toc; }\n.lp-toc a { color: var(--cp-muted); text-decoration: none; transition: color 0.15s ease; display: block; padding: 2px 0; border-radius: 4px; }\n.lp-toc a:hover { color: var(--cp-violet); padding-left: 6px; }\n\n/* === Section content === */\n.lp-section h2 { font-size: 22px; font-weight: 800; color: #f8fafc; margin: 44px 0 16px; letter-spacing: -0.015em; display: flex; align-items: center; gap: 14px; scroll-margin-top: 90px; }\n.lp-section h2::before { content: ""; width: 5px; height: 24px; background: linear-gradient(180deg, #a855f7, #6366f1); border-radius: 3px; flex-shrink: 0; box-shadow: 0 0 12px rgba(168,85,247,0.5); }\n.lp-section h3 { font-size: 15px; font-weight: 700; color: var(--cp-text); margin: 24px 0 10px; }\n.lp-section p { font-size: 14.5px; line-height: 1.85; color: var(--cp-text2); margin: 0 0 14px; }\n.lp-section ul, .lp-section ol { padding-left: 22px; margin: 12px 0; }\n.lp-section li { font-size: 14px; line-height: 1.8; color: var(--cp-text2); margin-bottom: 8px; }\n.lp-section li::marker { color: #a855f7; }\n.lp-section li strong { color: var(--cp-title); font-weight: 600; }\n.lp-section a { color: var(--cp-violet); text-decoration: none; font-weight: 500; border-bottom: 1px dashed rgba(196,181,253,0.4); transition: all 0.15s ease; }\n.lp-section a:hover { color: #ddd6fe; border-bottom-color: var(--cp-violet); }\n.lp-section code { background: rgba(168,85,247,0.12); color: var(--cp-violet); padding: 2px 8px; border-radius: 5px; font-size: 12.5px; font-weight: 500; font-family: \'JetBrains Mono\', \'SF Mono\', Menlo, monospace; border: 1px solid rgba(168,85,247,0.18); }\n.lp-section table { width: 100%; border-collapse: separate; border-spacing: 0; margin: 18px 0; font-size: 13px; border: 1px solid rgba(139,92,246,0.14); border-radius: 10px; overflow: hidden; }\n.lp-section th { background: rgba(139,92,246,0.10); color: var(--cp-title); padding: 12px 14px; text-align: left; font-weight: 700; font-size: 12px; text-transform: uppercase; letter-spacing: 0.5px; border-bottom: 1px solid rgba(139,92,246,0.18); }\n.lp-section td { padding: 12px 14px; border-bottom: 1px solid rgba(139,92,246,0.06); color: var(--cp-text2); vertical-align: top; }\n.lp-section tr:last-child td { border-bottom: none; }\n.lp-section td strong { color: var(--cp-title); }\n\n/* === Highlight callouts === */\n.lp-highlight { padding: 16px 20px; border-radius: 12px; margin: 14px 0; font-size: 13.5px; line-height: 1.75; backdrop-filter: blur(8px); }\n.lp-highlight.info { background: rgba(59,130,246,0.08); border: 1px solid rgba(59,130,246,0.25); border-left: 3px solid #3b82f6; color: #bfdbfe; }\n.lp-highlight.warn { background: rgba(245,158,11,0.08); border: 1px solid rgba(245,158,11,0.25); border-left: 3px solid #f59e0b; color: #fde68a; }\n.lp-highlight.success { background: rgba(34,197,94,0.08); border: 1px solid rgba(34,197,94,0.25); border-left: 3px solid #22c55e; color: #bbf7d0; }\n.lp-highlight.danger { background: rgba(239,68,68,0.08); border: 1px solid rgba(239,68,68,0.25); border-left: 3px solid #ef4444; color: #fecaca; }\n\n/* === Contact CTA === */\n.lp-contact-card { margin-top: 44px; padding: 32px; background:\n linear-gradient(135deg, rgba(168,85,247,0.12) 0%, rgba(99,102,241,0.08) 100%);\n border: 1px solid rgba(168,85,247,0.25); border-radius: 18px; text-align: center; position: relative; overflow: hidden;\n}\n.lp-contact-card::before { content: ""; position: absolute; inset: 0;\n background: radial-gradient(circle at 50% 0%, rgba(168,85,247,0.18), transparent 70%); pointer-events: none; }\n.lp-contact-card h3 { font-size: 20px; font-weight: 800; color: #f8fafc; margin: 0 0 10px; letter-spacing: -0.01em; position: relative; }\n.lp-contact-card p { color: var(--cp-text2); font-size: 14px; margin: 0 0 18px; position: relative; }\n.lp-contact-btn { display: inline-flex; align-items: center; gap: 8px; padding: 12px 26px;
1\n background: linear-gradient(135deg, #a855f7, #6366f1);\n color: #fff !important; border: none; border-radius: 11px; font-weight: 600; font-size: 14px;\n text-decoration: none; box-shadow: 0 6px 20px rgba(168,85,247,0.4), inset 0 1px 0 rgba(255,255,255,0.2);\n transition: all 0.2s ease; position: relative;\n}\n.lp-contact-btn:hover { transform: translateY(-2px); box-shadow: 0 10px 28px rgba(168,85,247,0.55); color: #fff !important; }\n\n/* === Footer === */\n.lp-footer { background: linear-gradient(180deg, #050814 0%, #02030a 100%); color: var(--cp-muted); padding: 56px 24px 28px; margin-top: 60px; border-top: 1px solid rgba(139,92,246,0.12); position: relative; }\n.lp-footer-inner { max-width: 1200px; margin: 0 auto; display: grid; grid-template-columns: 2fr 1fr 1fr 1fr; gap: 48px; }\n.lp-footer-col h4 { font-size: 11px; font-weight: 700; color: var(--cp-title); text-transform: uppercase; letter-spacing: 1.2px; margin: 0 0 16px; }\n.lp-footer-col a, .lp-footer-col span { display: block; color: var(--cp-muted); font-size: 13px; text-decoration: none; padding: 4px 0; transition: color 0.15s ease; }\n.lp-footer-col a:hover { color: var(--cp-violet); }\n.lp-footer-brand { font-size: 22px; font-weight: 900; color: #f8fafc; margin-bottom: 12px; letter-spacing: -0.025em;\n background: linear-gradient(135deg, #fff, var(--cp-violet)); -webkit-background-clip: text; background-clip: text; -webkit-text-fill-color: transparent;\n}\n.lp-footer-desc { font-size: 13px; line-height: 1.7; color: var(--cp-muted); margin: 0 0 16px; max-width: 320px; }\n.lp-footer-bottom { max-width: 1200px; margin: 36px auto 0; padding-top: 24px; border-top: 1px solid rgba(139,92,246,0.10); text-align: center; font-size: 12px; color: var(--cp-faint); }\n\n/* === Custom scrollbar === */\n::-webkit-scrollbar { width: 10px; height: 10px; }\n::-webkit-scrollbar-track { background: #050814; }\n::-webkit-scrollbar-thumb { background: linear-gradient(180deg, rgba(139,92,246,0.4), rgba(99,102,241,0.4)); border-radius: 10px; border: 2px solid #050814; }\n::-webkit-scrollbar-thumb:hover { background: linear-gradient(180deg, rgba(139,92,246,0.7), rgba(99,102,241,0.7)); }\n\n/* === Selection === */\n::selection { background: rgba(168,85,247,0.35); color: #fff; }\n\n@media print {\n .lp-topbar, .lp-footer, .lp-contact-card { display: none !important; }\n .lp-page, body { background: #fff !important; color: #000 !important; }\n .lp-card { box-shadow: none; border: none; padding: 0; background: #fff !important; color: #000 !important; }\n .lp-section p, .lp-section li, .lp-intro, .lp-intro p { color: #000 !important; }\n .lp-section h2, .lp-section h3, .lp-hero h1 { color: #000 !important; -webkit-text-fill-color: #000 !important; }\n}\n\n@media(max-width: 900px) {\n .lp-toc ul { columns: 1; }\n .lp-nav { gap: 2px; }\n .lp-nav a { padding: 6px 9px; font-size: 12px; }\n .lp-card { padding: 32px 28px; }\n .lp-hero h1 { font-size: 40px; }\n}\n@media(max-width: 768px) {\n .lp-topbar-inner { padding: 12px 16px; flex-wrap: wrap; }\n .lp-logo { font-size: 15px; }\n .lp-nav { width: 100%; justify-content: flex-start; overflow-x: auto; flex-wrap: nowrap; padding: 4px 0; }\n .lp-nav a { white-space: nowrap; padding: 6px 11px; }\n .lp-hero { padding: 36px 16px 22px; }\n .lp-hero h1 { font-size: 30px; }\n .lp-body { padding: 0 14px 60px; }\n .lp-card { padding: 24px 20px; border-radius: 16px; }\n .lp-info-grid { grid-template-columns: 1fr; padding: 18px; }\n .lp-section h2 { font-size: 18px; }\n .lp-section p, .lp-section li { font-size: 13.5px; }\n .lp-footer-inner { grid-template-columns: 1fr 1fr; gap: 28px; }\n .lp-footer { padding: 36px 18px 24px; }\n .lp-intro { padding: 18px 20px; }\n}\n';function f(e){let{active:t}=e;return(0,n.jsx)("div",{className:"lp-topbar",children:(0,n.jsxs)("div",{className:"lp-topbar-inner",children:[(0,n.jsxs)("a",{href:"/",className:"lp-logo",children:[(0,n.jsx)("span",{className:"lp-logo-mark",children:"C"}),(0,n.jsx)("span",{children:"ChatPilots.ai"})]}),(0,n.jsxs)("nav",{className:"lp-nav",children:[(0,n.jsx)("a",{href:"/",className:"home"===t?"active":"",children:"Home"}),(0,n.jsx)("a",{href:"/privacy",className:"privacy"===t?"active":"",children:"Privacy"}),(0,n.jsx)("a",{href:"/terms",className:"terms"===t?"active":"",children:"Terms"}),(0,n.jsx)("a",{href:"/data-deletion",className:"data-deletion"===t?"active":"",children:"Data Deletion"}),(0,n.jsx)("a",{href:"/refund",className:"refund"===t?"active":"",children:"Refund"}),(0,n.jsx)("a",{href:"/signin",className:"lp-cta",children:"Sign In"})]})]})})}function y(){return(0,n.jsxs)("footer",{className:"lp-footer",children:[(0,n.jsxs)("div",{className:"lp-footer-inner",children:[(0,n.jsxs)("div",{className:"lp-footer-col",children:[(0,n.jsx)("div",{className:"lp-footer-brand",children:"ChatPilots.ai"}),(0,n.jsx)("p",{className:"lp-footer-desc",children:"Enterprise AI-powered customer communication platform. WhatsApp, Instagram, Telegram, voice call center, email automation."}),(0,n.jsxs)("span",{style:{color:"var(--cp-faint)"},children:["Operated by ",s]}),(0,n.jsx)("span",{style:{color:"var(--cp-faint)"},children:o})]}),(0,n.jsxs)("div",{className:"lp-footer-col",children:[(0,n.jsx)("h4",{children:"Product"}),(0,n.jsx)("a",{href:"/",children:"Home"}),(0,n.jsx)("a",{href:"/signin",children:"Sign In"}),(0,n.jsx)("a",{href:"/signup",children:"Sign Up"})]}),(0,n.jsxs)("div",{className:"lp-footer-col",children:[(0,n.jsx)("h4",{children:"Legal"}),(0,n.jsx)("a",{href:"/privacy",children:"Privacy Policy"}),(0,n.jsx)("a",{href:"/terms",children:"Terms of Service"}),(0,n.jsx)("a",{href:"/data-deletion",children:"Data Deletion"}),(0,n.jsx)("a",{href:"/refund",children:"Refund Policy"})]}),(0,n.jsxs)("div",{className:"lp-footer-col",children:[(0,n.jsx)("h4",{children:"Contact"}),(0,n.jsx)("a",{href:"mailto:".concat(l),children:l}),(0,n.jsx)("span",{children:s}),(0,n.jsx)("span",{children:o})]})]}),(0,n.jsxs)("div",{className:"lp-footer-bottom",children:["\xa9 ",(new Date).getFullYear()," ",s,". All rights reserved. \xb7 ",c," \xb7 Version ",m," \xb7 Effective ",p]})]})}function b(){return(0,n.jsxs)("div",{className:"lp-info-grid",children:[(0,n.jsx)("div",{className:"k",children:"Company (Data Controller)"}),(0,n.jsx)("div",{className:"v",children:s}),(0,n.jsx)("div",{className:"k",children:"Trading Name / Product"}),(0,n.jsx)("div",{className:"v",children:a}),(0,n.jsx)("div",{className:"k",children:"Registered Address"}),(0,n.jsx)("div",{className:"v",children:o}),(0,n.jsx)("div",{className:"k",children:"Website"}),(0,n.jsx)("div",{className:"v",children:c}),(0,n.jsx)("div",{className:"k",children:"Contact Email"}),(0,n.jsx)("div",{className:"v",children:l}),(0,n.jsx)("div",{className:"k",children:"Data Protection Officer (DPO)"}),(0,n.jsx)("div",{className:"v",children:u}),(0,n.jsx)("div",{className:"k",children:"Effective Date"}),(0,n.jsx)("div",{className:"v",children:p}),(0,n.jsx)("div",{className:"k",children:"Document Version"}),(0,n.jsx)("div",{className:"v",children:m}),(0,n.jsx)("div",{className:"k",children:"Governing Law"}),(0,n.jsx)("div",{className:"v",children:"Republic of Turkey"}),(0,n.jsx)("div",{className:"k",children:"Jurisdiction"}),(0,n.jsx)("div",{className:"v",children:"Istanbul, Turkey"})]})}function x(e){let{title:t,text:i}=e;return(0,n.jsxs)("div",{className:"lp-contact-card",children:[(0,n.jsx)("h3",{children:t||"Have questions?"}),(0,n.jsx)("p",{children:i||"Our team is ready to help. Contact us for any inquiry related to this policy."}),(0,n.jsx)("a",{href:"mailto:".concat(l),className:"lp-contact-btn",children:"Email Us \u2192"})]})}function w(){return(0,n.jsxs)("div",{className:"lp-section",children:[(0,n.jsxs)("div",{className:"lp-intro",children:[(0,n.jsxs)("p",{children:['This Privacy Policy ("Policy", "Notice", "Privacy Notice") is the primary public-facing document through which ',a,' ("we", "us", "our", "Platform", "Service"), operated by ',s," \u2014 a joint-stock company duly incorporated and registered under the laws of the Republic of Turkey, with its principal place of business in Istanbul \u2014 informs you in a transparent, accessible, and legally rigorous manner about every aspect of our personal-data handling practices. It explains what categories of personal information we collect about you and on behalf of your end-customers, the precise sources from which such information originates (whether directly from you, automatically through your interactions with our Platform, or from authorised third parties), the specific lawful purposes for which each category is processed, the legal bases on which we rely under applicable data-protection law, the named recipients and sub-processors with whom we share data and the safeguards governing those onward flows, the international transfers we carry out together with the legal mechanisms (Standard Contractual Clauses, adequacy decisions, derogations) that protect such transfers, the storage periods we apply and the deletion procedures we follow at the end of those peri
1ods, the technical and organisational security measures we have implemented to protect your data against unauthorised access and accidental loss, and \u2014 perhaps most importantly \u2014 the comprehensive set of rights you enjoy as a data subject and the practical mechanisms through which you may exercise them."]}),(0,n.jsx)("p",{children:'Our Platform is an enterprise-grade software-as-a-service that orchestrates artificial-intelligence-powered customer conversations, voice automation, marketing campaigns, and back-office operations across multiple channels \u2014 WhatsApp Business API, Instagram Direct Messaging, Telegram, Facebook Messenger, SMS, programmable voice, transactional email, and our embeddable web-chat widget \u2014 for businesses ranging from solo entrepreneurs to multinational enterprises. The volume and sensitivity of personal data flowing through such a Platform is substantial: customer phone numbers, conversation transcripts, voice recordings and AI-generated transcripts, marketing-segmentation attributes, transactional histories, payment confirmation references, support-ticket content, and the AI prompts and outputs generated by our eighteen specialised "AI Employees." We have therefore designed every layer of the system \u2014 architecture, encryption, access control, monitoring, sub-processor selection, employee training, incident response \u2014 around the proposition that data protection is not a compliance afterthought but a foundational engineering requirement. This Privacy Policy is the public expression of that commitment.'}),(0,n.jsx)("p",{children:"This Policy applies on a global basis and has been drafted with the explicit objective of meeting or exceeding the substantive requirements of every major data-protection framework that may govern our processing activities, regardless of where you, your end-customers, or our infrastructure happens to be located at any given moment. The frameworks against which we have benchmarked this Policy include, in particular: the European Union's General Data Protection Regulation 2016/679 (GDPR) together with the national implementing laws of each EU/EEA Member State; the United Kingdom's Data Protection Act 2018 and UK GDPR (as retained EU law following Brexit); the Republic of Turkey's Ki\u015fisel Verilerin Korunmas\u0131 Kanunu No. 6698 (KVKK) and its associated regulations, communiqu\xe9s, and KVKK Board decisions; the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA), and the corresponding regulations issued by the California Privacy Protection Agency; the Brazilian Lei Geral de Prote\xe7\xe3o de Dados Pessoais (LGPD, Law No. 13.709/2018); Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) together with Quebec's Law 25, Alberta's PIPA and British Columbia's PIPA; Japan's Act on the Protection of Personal Information (APPI); the Republic of Singapore's Personal Data Protection Act (PDPA); the Commonwealth of Australia's Privacy Act 1988 and the Australian Privacy Principles; the People's Republic of China's Personal Information Protection Law (PIPL) where applicable to data subjects in mainland China; the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL); and the Republic of South Africa's Protection of Personal Information Act (POPIA). In addition to these statutory frameworks, this Policy reflects and operationalises Meta Platforms' Platform Terms, Developer Policies, Commerce Policies, and WhatsApp Business Messaging Policy \u2014 contractual instruments to which we are bound as a Business Solution Provider integrated with WhatsApp Business API, Instagram Messaging API, and Facebook page integrations \u2014 together with the corresponding terms of every other platform we integrate with (Telegram, Twilio, Paddle, OpenAI, Google Cloud, AWS, Cloudflare, SendGrid)."}),(0,n.jsxs)("p",{children:["We are conscious that legal density can obscure rather than illuminate, and we have therefore attempted throughout this Policy to combine precise legal language with plain-English explanations of what each provision means in practical terms for you and your end-customers. The Table of Contents below provides quick navigation to the topic that matters most to you; the section headings are descriptive enough that you should be able to locate the right answer without reading the entire document end-to-e
1nd. If at any point a provision is unclear, you have additional questions, or you wish to exercise any right under this Policy, you can reach our independent Data Protection Officer at ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u})," and a substantive response will follow within the statutory deadlines outlined in Section 18. By accessing, registering for, or otherwise using the Platform you acknowledge that you have read and understood this Policy in its entirety; your continued use of the Service constitutes ongoing acceptance of the practices described herein, subject to your inalienable statutory rights and the right to withdraw any consent you may have given."]})]}),(0,n.jsx)(b,{}),(0,n.jsxs)("div",{className:"lp-toc",children:[(0,n.jsx)("h4",{children:"Table of Contents"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-1",children:"1. Introduction & Scope"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-2",children:"2. Definitions"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-3",children:"3. Data Controller & DPO"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-4",children:"4. Data Sources"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-5",children:"5. Categories of Personal Data"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-6",children:"6. Purposes of Processing"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-7",children:"7. Legal Basis (GDPR Art. 6)"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-8",children:"8. Legal Basis (KVKK Art. 5/6)"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-9",children:"9. Special Category Data"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-10",children:"10. Automated Decision-Making"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-11",children:"11. AI Processing & OpenAI"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-12",children:"12. Sub-Processors List"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-13",children:"13. International Data Transfers"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-14",children:"14. Data Retention"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-15",children:"15. Security Measures"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-16",children:"16. Data Breach Notification"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-17",children:"17. Your Rights"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-18",children:"18. How to Exercise Rights"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-19",children:"19. Children's Privacy"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-20",children:"20. Marketing Communications"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-21",children:"21. Cookies & Tracking"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-22",children:"22. Meta Platform Compliance"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-23",children:"23. WhatsApp Specific"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-24",children:"24. CCPA/CPRA (California)"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-25",children:"25. LGPD (Brazil)"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-26",children:"26. PIPEDA (Canada)"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-27",children:"27. Supervisory Authorities"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-28",children:"28. EU Representative (Art. 27)"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-29",children:"29. Changes to Policy"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-30",children:"30. Languages"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-31",children:"31. Version History"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-32",children:"32. Governing Law"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#sec-33",children:"33. Contact Us"})})]})]}),(0,n.jsx)("h2",{id:"sec-1",children:"1. Introduction & Scope"}),(0,n.jsxs)("p",{children:["At ",s,', we take your privacy, data protection, and trust extremely seriously. As an enterprise AI-powered customer communication platform handling millions of messages across WhatsApp, Instagram, Telegram, email, SMS, voice, and web channels every month, we understand that the personal data you entrust to us \u2014 and the personal data of your end-customers that flows through our Platform \u2014 is the most sensitive asset we handle. This Privacy Policy ("Policy") is a comprehensive, legally binding document that explains in extensive detail what personal information we collect about you and on your behalf, why we collect each specific category of data, how we use it, who we share it with (including named sub-processors and their roles), how we secure it with industry-leading technical and organizational measures, how long we retain each category of data, what rights you have under applicable data protection laws, and how you can exercise those rights. We have drafted this Policy with plain-language explanations alongside specific legal citations, so that both regulators and non-technical readers can understand our practices in full.']}),(0,n.jsxs)("p",{children:["The scope of this Policy is comprehensive and applies to all interactions you may have with ",a," and its various touchpoints. Specifically, this Policy governs:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:["Our main marketing website at ",(0,n.jsx)("a",{href:"https://".concat(c),children:c}),", along with all current and future subdomains (such as app.",c,", api.",c,", status.",c,", and docs.",c,") through which you may access our services or marketing content."]}),(0,n.jsx)("li",{children:"The customer dashboard, administrative control panels, tenant workspaces, and web-based application interfaces used by account holders, administrators, and team members to configure bots, manage conversations, and review anal
1ytics."}),(0,n.jsx)("li",{children:"Our public REST APIs, GraphQL endpoints, webhooks, software development kits (SDKs), command-line tools, and all developer-facing interfaces provided to programmatically interact with our Platform."}),(0,n.jsx)("li",{children:"Our mobile-optimized web interfaces accessed from smartphones and tablets, including any future native iOS or Android applications we may publish."}),(0,n.jsx)("li",{children:"All integrations with third-party platforms that process data through our Platform \u2014 including but not limited to Meta (WhatsApp Business API, Instagram Messaging, Facebook Pages), Telegram (Bot API), Twilio (SMS and programmable voice), Paddle (payment processing and merchant-of-record), OpenAI (GPT inference), Google (Maps, OAuth, Workspace email), Amazon Web Services (cloud infrastructure), Cloudflare (content delivery and DDoS mitigation), SendGrid (transactional email), and others listed in Section 12."}),(0,n.jsx)("li",{children:"Our outbound marketing emails, transactional communications (such as invoices, receipts, security alerts, password resets, and service notifications), in-app messaging, customer support conversations via email or chat, and any other communication channels we may use to engage with you."}),(0,n.jsx)("li",{children:"Data processing activities we carry out at events, webinars, trade shows, sales demos, and other in-person or virtual interactions where we may collect contact information or discuss business opportunities."})]}),(0,n.jsxs)("p",{children:["This Policy does ",(0,n.jsx)("strong",{children:"not"})," govern your use of third-party websites, applications, or services that may be linked from or integrated with our Platform. When you click a link to an external website or connect an external service, that third party's own privacy policy applies \u2014 we encourage you to read those policies carefully. Similarly, this Policy does not apply to the processing activities of your own customers when they interact with businesses other than yours, even if those businesses also use our Platform."]}),(0,n.jsxs)("p",{children:["By accessing, registering for, or using any part of ",a,", you acknowledge that you have read, understood, and agree to the data practices described in this Policy. This acknowledgment constitutes your informed consent to our processing of your personal data as described herein, subject to any rights you retain under applicable law (including the right to withdraw consent at any time). If you do not agree with any part of this Policy, you must not use our Service. We recommend that you return to this Policy periodically to stay informed of any changes, and we will notify you of material changes as described in Section 29."]}),(0,n.jsx)("h2",{id:"sec-2",children:"2. Definitions"}),(0,n.jsx)("p",{children:"To ensure that this Privacy Policy can be read and understood unambiguously by both legal professionals and ordinary users, we provide below a comprehensive glossary of the technical and legal terms used throughout the document. These definitions are aligned with the GDPR (Article 4), the Turkish KVKK (Article 3), and other applicable data protection frameworks. Where a term is used differently in another context, we have noted the variation. Reading these definitions before proceeding through the rest of this Policy will significantly improve your comprehension of your rights, our obligations, and the technical concepts that govern data processing in our Platform."}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Personal Data"'}),' means any information relating to an identified or identifiable natural person ("Data Subject").']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Data Subject"'})," means the individual to whom the Personal Data relates (you, your employees, or your end-customers)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Data Controller"'})," means the entity that determines the purposes and means of processing personal data. For your account data, we are the Controller. For end-customer data you process through our Platform, you are the Controller."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Data Processor"'})," means the entity that processes personal data on behalf of a Controller. We act as Processor for your end-customer data."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Sub-Processor"'})," means a third-party entity we engage to process data on our behalf (e.g., hosting, AI, payment processors)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"End-User"'})," means any individual who interacts with your business through our Platform (your customers, prospects, etc.)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Processing"'})," means any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Profiling"'})," means automated processing of personal data to evaluate personal aspects."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Pseudonymization"'})," means processing in a way that data can no longer be attributed to a specific individual without additional information kept separately."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Consent"'}
1)," means freely given, specific, informed, and unambiguous indication of the data subject's wishes."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Legitimate Interest"'})," means processing necessary for our or a third party's legitimate interests, balanced against the data subject's rights."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Platform", "Service"'})," means ",a," and all associated features, APIs, and tools."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Tenant"'})," means a customer account/workspace within our multi-tenant SaaS architecture."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Account Holder"'})," means the individual or legal entity that registered for a ",a," account."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Content"'})," means any data, messages, files, or information transmitted through or stored on our Platform."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Communication Data"'})," means messages, voice recordings, transcripts, and interaction logs."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Cookie"'})," means a small text file placed on your device by our website."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Supervisory Authority"'})," means the independent public authority responsible for monitoring compliance with data protection law (e.g., KVKK in Turkey, ICO in UK)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"DPA"'})," means Data Processing Agreement \u2014 a contract between Controller and Processor."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"SCC"'})," means Standard Contractual Clauses \u2014 approved by the European Commission for international data transfers."]})]}),(0,n.jsx)("h2",{id:"sec-3",children:"3. Data Controller & Data Protection Officer"}),(0,n.jsx)("p",{children:'Under the terminology of GDPR, KVKK, and other global data protection frameworks, the "Data Controller" is the entity that determines the purposes and means of processing personal data. When we process your account data \u2014 that is, data about you as the Customer who signed up for and uses our Platform \u2014 we act as the Data Controller. When we process data about your end-customers on your behalf (for example, WhatsApp messages your customers send you, contact details you store in your CRM, voice recordings of calls to your business), we act as the Data Processor, and you are the Data Controller for that data. The distinction is important because it affects who has primary responsibility for legal compliance, consent collection, and response to data subject rights requests. For all Controller-role activities described in this Policy, the legal entity and contact details are as follows:'}),(0,n.jsxs)("div",{className:"lp-info-grid",children:[(0,n.jsx)("div",{className:"k",children:"Legal Entity Name"}),(0,n.jsx)("div",{className:"v",children:s}),(0,n.jsx)("div",{className:"k",children:"Product / Trading Name"}),(0,n.jsx)("div",{className:"v",children:a}),(0,n.jsx)("div",{className:"k",children:"Jurisdiction of Incorporation"}),(0,n.jsx)("div",{className:"v",children:"Republic of Turkey"}),(0,n.jsx)("div",{className:"k",children:"Registered Address"}),(0,n.jsx)("div",{className:"v",children:o}),(0,n.jsx)("div",{className:"k",children:"Primary Contact Email"}),(0,n.jsx)("div",{className:"v",children:l}),(0,n.jsx)("div",{className:"k",children:"Privacy/DPO Email"}),(0,n.jsx)("div",{className:"v",children:u}),(0,n.jsx)("div",{className:"k",children:"Security Email"}),(0,n.jsx)("div",{className:"v",children:h}),(0,n.jsx)("div",{className:"k",children:"Website"}),(0,n.jsxs)("div",{className:"v",children:["https://",c]})]}),(0,n.jsxs)("p",{children:["We have appointed a Data Protection Officer (DPO) whose responsibilities include monitoring our compliance with the General Data Protection Regulation and other applicable data protection laws, c
1ooperating with supervisory authorities such as KVKK (the Turkish Data Protection Authority) and the national data protection authorities of EU member states, serving as the primary point of contact for data subjects exercising their rights, conducting Data Protection Impact Assessments (DPIAs) for high-risk processing activities, maintaining records of processing activities (ROPA) as required by GDPR Article 30, advising our engineering and product teams on privacy-by-design principles, and supervising employee training on data protection matters. Our DPO operates with independence and reports directly to senior management to avoid conflicts of interest, in line with GDPR Article 38. You can reach our DPO with any privacy-related inquiry, concern, complaint, or request by emailing ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u}),". We endeavor to respond to all DPO inquiries within five (5) business days, with formal rights requests handled within the statutory 30-day window."]}),(0,n.jsx)("p",{children:"For data subjects based in the European Economic Area or the United Kingdom, GDPR Article 27 requires non-EU/UK-based controllers to appoint a representative within those territories when certain processing thresholds are met. At our current scale, we appoint an EU Representative upon formal request from any regulatory authority or as required by our processing volume. Contact our DPO to request the current EU Representative contact details, which will be provided promptly. UK-based data subjects should note that following Brexit, a separate UK Representative may be designated; we maintain this information up-to-date and share it upon request. See Section 28 for further details on our EU/UK representation arrangements."}),(0,n.jsx)("h2",{id:"sec-4",children:"4. Sources of Personal Data"}),(0,n.jsx)("p",{children:"We collect personal data from a variety of sources, each with different legal implications for how that data may be used. Transparency about these sources is a core principle of GDPR (Article 14) and KVKK (Article 10). Below we describe in detail each source category, what kind of data flows from it, and the safeguards we apply."}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Directly from you:"})," The vast majority of personal data we hold comes from information you voluntarily provide to us. This includes registration details when you create an account (name, business email, company name, phone number, billing address), account configuration choices as you set up bots and integrations (preferences, role assignments, knowledge base content), responses to our customer support inquiries, participation in surveys or beta testing programs, content you post in our community forums or feedback channels, and information shared during sales conversations or onboarding calls. You have full control over whether and how much of this information you share."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Automatically through use:"})," When you interact with our Platform, certain information is generated and collected automatically by our systems. This includes server logs recording API requests and responses (with timestamps and IP addresses), cookies and similar tracking technologies stored on your browser, device information reported by your browser user-agent string, usage analytics events tracking which features you access and for how long, performance metrics measuring response times and error rates, and security telemetry used for fraud detection and abuse prevention. The specific types of automatically collected data are detailed in Section 5."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"From your end-customers:"})," When your customers contact your business through integrations we provide (WhatsApp, Instagram, Telegram, email, web chat, voice), their messages, voice recordings, media attachments, and metadata flow through our Platform. For this data, ",(0,n.jsx)("strong",{children:"you are the Data Controller"})," (you determine why and how to process it) and ",(0,n.jsx)("strong",{children:"we are the Data Processor"})," (we handle it only per your instructions and our Data Processing Agreement). You are responsible for ensuring your end-customers have been properly informed and have given appropriate consent where required."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"From third-party integrations you authorize:"})," When you connect third-party platforms to your ",a," account (for example, logging in with Facebook, linking your WhatsApp Business Account, connecting a Google Worksp
1ace email inbox, or authorizing Paddle for billing), those services share limited personal data with us as required for the integration to function. Meta provides business profile data, WhatsApp Business Account IDs, phone number IDs, and message template approvals. Google OAuth provides your email address and display name. Paddle provides transaction IDs and invoice data. We process this data only as necessary to deliver the integration and in accordance with each provider's terms."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"From partners, resellers, and affiliates:"})," If you signed up through one of our authorized resellers, affiliates, or referral partners, we may receive your contact information and referral attribution data from that partner. These partners operate under contracts requiring them to obtain appropriate consent before sharing your data with us. We treat referral data with the same care as data collected directly."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"From publicly available sources:"})," For business verification and fraud prevention purposes, we may supplement your account data with information from publicly available sources such as business registries (Turkish MERSIS, EU Central Register of Beneficial Owners, Companies House in the UK), tax identification databases, corporate LinkedIn profiles, and publicly listed company websites. This helps us verify that businesses signing up are legitimate."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"From referrals and word-of-mouth:"})," When an existing customer, partner, or prospect refers you to our Platform, we may receive your contact information along with a referral note. We will only contact you if the referrer has indicated you expect to hear from us, and you can opt out of further contact at any time."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"From security and fraud-prevention vendors:"})," We may receive data from third-party security providers (such as Cloudflare's threat intelligence, email reputation databases, or anti-fraud networks) to help us identify and block malicious actors attempting to abuse our Platform. This data is used solely for security purposes and retained only as long as necessary."]})]}),(0,n.jsx)("p",{children:"We never purchase personal data from data brokers for marketing purposes, and we do not enrich your profile with behavioral data from third parties to build advertising audiences. Our data collection is purposeful, minimal, and limited to what is genuinely necessary to deliver the Service you requested."}),(0,n.jsx)("h2",{id:"sec-5",children:"5. Categories of Personal Data We Collect"}),(0,n.jsxs)("p",{children:["Modern data protection laws (GDPR Article 30, KVKK Article 16) require data controllers to maintain detailed records of processing activities, including a clear description of the categories of personal data processed. We have organized our data inventory into fifteen distinct categories below, each with specific examples of data fields, the purposes for which we collect it, and the safeguards we apply. This granular disclosure enables you to understand exactly what information we hold and to assess whether you are comfortable with our processing of each category. If you have questions about any specific data point that is not explicitly listed below, please contact our DPO at ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u}),' for a detailed answer. We follow the principle of data minimization (GDPR Article 5(1)(c)), collecting only what is necessary for the specific, stated purpose. Categories below labeled "you provide" are collected directly from you; "automatically collected" indicates background telemetry; "from end-users" indicates data that flows through our Platform from your customers to you.']}
1),(0,n.jsx)("h3",{children:"5.1. Identity Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Full name, title, preferred name"}),(0,n.jsx)("li",{children:"Date of birth (optional)"}),(0,n.jsx)("li",{children:"National ID or tax number (only when required for VAT/invoicing)"}),(0,n.jsx)("li",{children:"Business registration number (for WhatsApp Business onboarding)"})]}),(0,n.jsx)("h3",{children:"5.2. Contact Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Business email address"}),(0,n.jsx)("li",{children:"Phone number (including WhatsApp Business number)"}),(0,n.jsx)("li",{children:"Billing address, business address"}),(0,n.jsx)("li",{children:"Company name, industry, size"})]}),(0,n.jsx)("h3",{children:"5.3. Financial Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Paddle transaction IDs, subscription IDs, invoice numbers"}),(0,n.jsx)("li",{children:"Billing history, refund records"}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"We do NOT store credit card numbers, CVV codes, or bank account details."})," All payment card data is tokenized and handled by Paddle (PCI-DSS Level 1 certified)."]})]}),(0,n.jsx)("h3",{children:"5.4. Transaction Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Subscription plan, billing cycle, renewal dates"}),(0,n.jsx)("li",{children:"Feature usage metrics for billing purposes"}),(0,n.jsx)("li",{children:"Credit consumption, SMS/voice usage records"})]}),(0,n.jsx)("h3",{children:"5.5. Technical Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"IP address, approximate geolocation (country/city level)"}),(0,n.jsx)("li",{children:"Browser type, version, and user agent"}),(0,n.jsx)("li",{children:"Operating system, device type (desktop/mobile/tablet)"}),(0,n.jsx)("li",{children:"Screen resolution, timezone, language preference"}),(0,n.jsx)("li",{children:"Internet Service Provider (ISP)"})]}),(0,n.jsx)("h3",{children:"5.6. Profile Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Account preferences, UI settings (theme, language)"}),(0,n.jsx)("li",{children:"User roles and permissions within your workspace"}),(0,n.jsx)("li",{children:"Saved searches, pinned items, shortcuts"}),(0,n.jsx)("li",{children:"Notification preferences"})]}),(0,n.jsx)("h3",{children:"5.7. Usage Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Pages visited, features used, buttons clicked"}),(0,n.jsx)("li",{children:"Session duration, page view counts"}),(0,n.jsx)("li",{children:"API call logs, rate limit records"}),(0,n.jsx)("li",{children:"Error logs, crash reports"}),(0,n.jsx)("li",{children:"Performance metrics (response times, load times)"})]}),(0,n.jsx)("h3",{children:"5.8. Marketing & Communications Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Marketing consent records (opt-in/opt-out history)"}),(0,n.jsx)("li",{children:"Email open rates, click-through rates"}),(0,n.jsx)("li",{children:"Survey responses, feedback forms"}),(0,n.jsx)("li",{children:"Referral source tracking (UTM parameters)"})]}),(0,n.jsx)("h3",{children:"5.9. Business Content Data (Customer-Controlled)"}),(0,n.jsx)("p",{children:"When you use our Platform to communicate with your end-customers, we process the following on your behalf:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Text messages sent/received through WhatsApp, Instagram, Telegram, and web chat"}),(0,n.jsx)("li",{children:"Attached media (images, documents, audio files, videos)"}),(0,n.jsx)("li",{children:"Contact details of your end-customers (names, phone numbers, emails)"}),(0,n.jsx)("li",{children:"CRM notes, tags, and annotations you create"}),(0,n.jsx)("li",{children:"Orders, appointments, transactions managed through the Platform"})]}),(0,n.jsxs)("p",{children:[(0,n.jsx)("strong",{children:"Important:"})," For this data, ",(0,n.jsx)("strong",{children:"you are the Data Controller"})," and ",(0,n.jsx)("strong",{children:"we are the Data Processor"}),". You must have a lawful basis and appropriate consent to process end-user data through our Platform."]}
1),(0,n.jsx)("h3",{children:"5.10. Voice & Call Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Voice recordings (inbound/outbound AI voice calls)"}),(0,n.jsx)("li",{children:"Call metadata (duration, timestamps, caller/callee numbers)"}),(0,n.jsx)("li",{children:"Automated transcripts generated by speech-to-text"}),(0,n.jsx)("li",{children:"Call quality metrics"})]}),(0,n.jsx)("p",{children:"Voice recordings are stored for 30 days by default (configurable). Transcripts are retained for the account lifetime."}),(0,n.jsx)("h3",{children:"5.11. AI Interaction Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Prompts sent to AI models"}),(0,n.jsx)("li",{children:"AI-generated responses"}),(0,n.jsx)("li",{children:"Intent classifications, sentiment scores"}),(0,n.jsx)("li",{children:"Training feedback (thumbs up/down on AI responses)"})]}),(0,n.jsx)("h3",{children:"5.12. Location Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Approximate location derived from IP address (country, city)"}),(0,n.jsx)("li",{children:"We do NOT collect precise GPS coordinates."}),(0,n.jsx)("li",{children:"Location is used for fraud prevention, analytics, and tax calculation."})]}
1),(0,n.jsx)("h3",{children:"5.13. Device Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:["Cookies (see our ",(0,n.jsx)("a",{href:"/cookie-policy",children:"Cookie Policy"}),")"]}),(0,n.jsx)("li",{children:"Local storage, session storage items"}),(0,n.jsx)("li",{children:"Device IDs (for session management)"})]}),(0,n.jsx)("h3",{children:"5.14. Meta-Specific Data"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"WhatsApp Business Account (WABA) ID"}),(0,n.jsx)("li",{children:"Meta Business Manager ID, Facebook Page ID, Instagram Business Account ID"}),(0,n.jsx)("li",{children:"Meta User Access Tokens (encrypted)"}),(0,n.jsx)("li",{children:"Phone Number IDs, display phone numbers, business display names"}),(0,n.jsx)("li",{children:"Message template approvals, quality ratings"})]}),(0,n.jsx)("h3",{children:"5.15. Employee & Admin Data (for Multi-User Accounts)"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Names and emails of team members invited to your workspace"}),(0,n.jsx)("li",{children:"Role assignments (owner, admin, agent, viewer)"}),(0,n.jsx)("li",{children:"Activity logs (who did what and when)"})]}),(0,n.jsx)("h2",{id:"sec-6",children:"6. Purposes of Processing"}),(0,n.jsx)("p",{children:'Under GDPR Article 5(1)(b) and KVKK Article 4, personal data must be collected for specified, explicit, and legitimate purposes, and must not be further processed in a manner incompatible with those purposes (the "purpose limitation" principle). We have documented every processing purpose in our Records of Processing Activities (ROPA), and we disclose them in full here so you can understand exactly how your data is used. Each purpose below is linked to the legal basis that justifies it (see Section 7) and the categories of data it involves (see Section 5).'}),(0,n.jsxs)("ol",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Service provision and authentication:"})," The core reason we collect data is to provide you with the Service you signed up for. This includes authenticating your account when you log in (validating credentials, issuing session tokens, applying multi-factor authentication checks), providing access to the specific features included in your subscription tier, handling the API requests you make, routing messages through integrated channels, executing AI inferences, delivering voice calls, generating analytics dashboards, and performing all other functions advertised on our website. Without processing the essential data needed for these functions, we cannot deliver the Service."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Account management and configuration:"})," We process data to maintain your user profile, save your personalization preferences (theme, language, timezone), manage your subscription details and billing records, track your role-based permissions within a multi-user workspace, synchronize settings across devices, and preserve your configuration over time. This enables the personalized experience that makes our Service useful."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Billing, payments, and financial operations:"})," We process financial and transaction data to charge subscription fees on your renewal dates, generate invoices and e-ar\u015fiv fatura (Turkish electronic invoices), calculate and collect VAT/GST/sales tax applicable to your jurisdiction, process refunds when authorized, reconcile payments with our accounting systems, prevent fraudulent transactions, respond to chargebacks, and report to tax authorities as required by law. Our payment processor Paddle handles the actual card data, but we receive transaction metadata to maintain your billing history."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"AI processing and automated response generation:"})," When enabled in your configuration, we send message content, context from the conversation, and your knowledge base to AI models (primarily OpenAI GPT) via encrypted APIs to generate responses. We also use AI for intent classification, sentiment analysis, language detection, and transcription of voice messages. Under our enterprise agreement with OpenAI, your data is not retained beyond the API call and is never used to train their models. See Section 11 for full details."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Communication routing and delivery:"})," We process your end-customers' phone numbers, message identifiers, and content to route communications through the appropriate channels (WhatsApp Business API, Instagram Messaging, Telegram Bot API, Twilio SMS and voice, SendGrid email). We also track delivery receipts, read receipts, bounce codes, and quality metrics to report on message status in your dashboard."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Customer support and relationship management:"})," When you contact our support team through email, in-app chat, or phone, we process your inquiry details, account state, recent activity, and any diagnostic information you voluntarily share to help us troubleshoot and respond. We also maintain support ticket history so follow-up conversations have context. Our support agents are bound by confidentiality agreements and access account data only on a need-to-know basis."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Platform improvement and quality assurance:"})," We analyze aggregated, anonymized usage data to understand which features are most valuable, identify pain points in the user experience, prioritize roadmap decisions, detect bugs and performance issues, and improve the overall quality of the Service. Wherever possible, this analysis uses statistical aggregates or pseudonymized data rather than raw personal data."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Security monitoring, fraud prevention, and abuse detection:"})," To protect the Platform and all users from malicious activity, we continuously monitor login patterns for signs of account takeover, detect unusual API usage that may indicate credential theft or scraping, block IP addresses associated with abuse, review suspicious payment transactions, enforce rate limits, and investigate reports of policy violations. This is one of our strongest legitimate interests under GDPR Article 6(1)(f)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Legal and regulatory compliance:"})," We process data to meet our legal obligations, including retaining invoices for ten years under the Turkish Commercial Code, responding to valid court orders and law enforcement requests (subject to applicable due process), maintaining records of marketing consent for three years as proof of compliance, reporting suspicious financial activity under anti-money laundering rules where applicable, and cooperating with regulatory audits from KVKK or equivalent authorities."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Marketing and promotional communications (with consent):"})," Where you have opted in, we send you newsletters, product updates, feature announcements, educational content, event invitations, and occasional promotional offers. You can unsubscribe at any time, and we respect unsubscribe requests immediately. We do not share your email with third-party marketers and do not sell your data."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Transactional and service communications:"})," Regardless of marketing preferences, we send you transactional emails that are necessary for the Service: invoices and payment receipts, password reset links, security alerts about your account, billing reminders before charges, service degradation notices, scheduled maintenance announcements, and major policy changes. These cannot be opted out of while your account is active."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Analytics, business intelligence, and research:"})," We conduct internal analytics to understand market fit, identify successful customer segments, track product metrics (MRR, churn, NPS), and inform strategic decisions. Where this involves personal data, we apply data minimization and pseudonymization. Aggregated statistics may be shared publicly (for example, in transparency reports), but never at an individual level."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Legal claims and defense:"})," If a legal dispute arises involving your account or conduct on the Platform, we may
1need to retain and process relevant data to investigate the claim, prepare legal arguments, respond to discovery requests, and defend our rights in court or arbitration. We process only data necessary and proportionate to the legal proceeding."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Business operations and internal use:"})," We process limited data for internal business operations including vendor management (tracking our contracts with sub-processors), accounting and financial reporting, internal audit, human resources (for our own employees, not customer data), and strategic planning. Our employees who handle such data are bound by confidentiality obligations."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Corporate transactions and due diligence:"})," In the event of a merger, acquisition, financing round, or sale of assets, we may need to share limited personal data with potential acquirers, investors, or their advisors for due diligence purposes. Any such sharing is governed by confidentiality agreements, and acquirers will be bound by the commitments in this Policy or provide at least equivalent protections. We will notify you of any change in ownership that materially affects the processing of your data."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Product integrity and platform safety:"})," We may process data to ensure the Platform operates safely and responsibly \u2014 including moderating content that may violate our Acceptable Use Policy, preventing the Platform from being used for illegal activities, detecting child sexual abuse material (CSAM) and reporting to authorities as legally required, and enforcing Meta/WhatsApp/Instagram terms to maintain access to upstream APIs."]})]}),(0,n.jsx)("h2",{id:"sec-7",children:"7. Legal Basis for Processing under GDPR (Article 6)"}),(0,n.jsx)("p",{children:"Under the EU General Data Protection Regulation, the lawfulness of any personal data processing depends on identifying at least one of six specific legal bases enumerated in Article 6(1). We have carefully mapped each of our processing activities to the appropriate legal basis and documented this in our internal Records of Processing Activities (ROPA), as required by GDPR Article 30. Below we explain each legal basis we rely on, the kinds of processing it covers in our context, and the implications for your rights. Importantly, you have different rights depending on the legal basis: if processing is based on your consent, you can withdraw it at any time; if based on legitimate interest, you can object and force a balancing test; if based on contract or legal obligation, your withdrawal options are more limited because the processing is essential to the service or required by law. Understanding the basis for each processing activity empowers you to exercise your rights effectively."}),(0,n.jsxs)("table",{children:[(0,n.jsx)("thead",{children:(0,n.jsxs)("tr",{children:[(0,n.jsx)("th",{children:"Article 6(1)"}),(0,n.jsx)("th",{children:"Legal Basis"}),(0,n.jsx)("th",{children:"Our Use"})]})}),(0,n.jsxs)("tbody",{children:[(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"(a)"})}),(0,n.jsx)("td",{children:"Consent"}),(0,n.jsx)("td",{children:"Marketing emails, non-essential cookies, optional features"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"(b)"})}),(0,n.jsx)("td",{children:"Contract Performance"}),(0,n.jsx)("td",{children:"Providing the Platform, processing your subscription, delivering features you requested"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"(c)"})}),(0,n.jsx)("td",{children:"Legal Obligation"}),(0,n.jsx)("td",{children:"Tax records, accounting, responding to court orders, KVKK/GDPR compliance records"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"(d)"})}),(0,n.jsx)("td",{children:"Vital Interests"}),(0,n.jsx)("td",{children:"Emergency situations involving life or health (extremely rare)"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"(e)"})}),(0,n.jsx)("td",{children:"Public Interest"}),(0,n.jsx)("td",{children:"Not typically used by us"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"(f)"})}),(0,n.jsx)("td",{children:"Legitimate Interest"}),(0,n.jsx)("td",{children:"Fraud prevention, security, product improvement, analytics (balanced with your rights)"})]})]})]}),(0,n.jsx)("p",{children:"For processing based on consent (Art. 6(1)(a)), you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal."}),(0,n.jsx)("h2",{id:"sec-8",children:"8. Legal Basis under KVKK (Turkish Data Protection Law)"}),(0,n.jsxs)("p",{children:['T\xfcrkiye Cumhuriyeti\'nin Ki\u015fisel Verileri Koruma Kanunu (KVKK, Kanun No. 6698, y\xfcr\xfcrl\xfck tarihi 7 Nisan 2016), T\xfcrkiye\'de mukim veri sahiplerinin ki\u015fisel verilerinin i\u015flenmesini kapsaml\u0131 \u015fekilde d\xfczenleyen temel yasad\u0131r. KVKK b\xfcy\xfck \xf6l\xe7\xfcde GDPR ile uyumlu olmakla birlikte baz\u0131 kendine \xf6zg\xfc h\xfck\xfcmler i\xe7erir; \xf6zellikle "a\xe7\u0131k r\u0131za" (explicit consent) ve "a\xe7\u0131klanma" (data subject made public) gibi farkl\u0131 yasal zeminleri vard\u0131r. As a Turkey-incorporated data controller, we are subject to KVKK and are registered (or in the process of registering) with the Veri Sorumlular\u0131 Sicili (VERB\u0130S \u2014 Data Controllers\' Registry) as required by Turkish law. Below we identify each KVKK legal basis we rely upon and the corresponding processing activities. For Turkish-speaking data subjects who require disclosure exclusively in Turkish (as is your right under KVKK Articles 10 and 11), we maintain a separate KVKK Ayd\u0131nlatma Metni (Privacy Notice in Turkish) available upon request from ',(0,n.jsx)("a",{href:"mailto:".concat(u),children:u}),". This English-language document is intended for international users and KVKK-EU compliance crossover."]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Article 5(1) \u2014 A\xe7\u0131k R\u0131za (Explicit Consent):"})," Where you have given clear, informed, and freely-given consent for a specific purpose. Examples in our context: subscribing to marketing communications, enabling optional analytics cookies, opting into certain
1non-essential features. Consent must be explicit (no pre-checked boxes) and can be withdrawn at any time."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Article 5(2)(a) \u2014 Explicitly Provided for in Law:"})," Where Turkish law specifically authorizes processing without consent. Examples: tax record retention under Turkish Tax Procedure Law, anti-money laundering reporting obligations."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Article 5(2)(c) \u2014 Performance of a Contract:"})," Where processing is necessary to fulfill a contract you have entered into with us, or to take steps at your request before entering a contract. Examples: providing the Platform features you subscribed to, processing your payments, sending service notifications."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Article 5(2)(\xe7) \u2014 Compliance with Legal Obligation:"})," Where we must process data to comply with a Turkish legal requirement. Examples: maintaining e-ar\u015fiv fatura records for tax authorities, responding to court orders or law enforcement requests, retaining evidence for fraud investigations."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Article 5(2)(d) \u2014 Made Public by the Data Subject:"})," Where you have voluntarily made your personal data publicly available. Rarely used in our context; might apply to publicly listed business information."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Article 5(2)(e) \u2014 Establishment/Exercise/Defense of a Right:"})," Where processing is necessary to establish, exercise, or protect a legal right. Examples: investigating breach of contract, defending against lawsuits, gathering evidence for arbitration."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Article 5(2)(f) \u2014 Legitimate Interest:"})," Where processing is necessary for our legitimate interests, provided that your fundamental rights and freedoms are not unduly prejudiced. We perform a balancing test for each such processing activity. Examples: fraud prevention, network security monitoring, internal analytics for product improvement."]})]}),(0,n.jsx)("p",{children:"KVKK also imposes additional requirements such as VERB\u0130S registration for entities meeting the threshold (we comply), notifying the Ki\u015fisel Verileri Koruma Kurulu (KVK Kurulu) of data breaches within 72 hours (we comply), and enabling data subjects to exercise their KVKK Article 11 rights (which closely parallel GDPR rights). For full details of KVKK-specific compliance, including data subject rights procedures in Turkish, please contact our DPO. We treat KVKK and GDPR as overlapping rather than conflicting frameworks, providing the highest standard of protection where they differ."}),(0,n.jsx)("h2",{id:"sec-9",children:"9. Special Category Data (GDPR Art. 9 / KVKK Art. 6)"}),(0,n.jsx)("p",{children:'Both the GDPR and the Turkish KVKK recognize that certain categories of personal data are particularly sensitive and require enhanced protection due to the elevated risks they pose to fundamental rights and freedoms if mishandled. GDPR Article 9 prohibits the processing of these "special categories" by default, allowing it only in narrowly defined circumstances such as explicit consent for a specific purpose, employment law obligations, vital interests of the data subject, public health emergencies, and a handful of other carefully circumscribed exceptions. KVKK Article 6 contains a similar but slightly different list. Because of these stringent rules, we have designed our Platform to avoid the routine collection and processing of special category data wherever possible. As a general policy, we do NOT knowingly collect, process, or store the following categories of sensitive personal data through our Platform\'s standard features:'}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Racial or ethnic origin:"})," We do not ask for, infer, or store data revealing race, ethnicity, or national origin in any form."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Political opinions:"})," Our Platform does not solicit political views, party affiliations, or related data."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Religious or philosophical beliefs:"})," No collection of religious denomination, beliefs, or related practices."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Trade union membership:"})," Not relevant to our service and not collected."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Genetic data:"})," No DNA, gene sequencing, or hereditary biomarkers processed."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Biometric data for identification:"})," We do not perform fingerprint, facial recognition, voiceprint identification, or iris scan based identification. (Note: voice recordings of phone calls may be collected for transcription, but they are not used to uniquely identify individuals biometrically.)"]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Health data:"})," No medical records, diagnoses, treatments, or health insurance information processed by default."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Sex life or sexual orientation:"})," Not collected or inferred."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Criminal convictions or offences (Art. 10 GDPR):"})," We do not process criminal record data."]})]}),(0,n.jsxs)("p",{children:["However, we recognize that some of our customers operate in industries where the routine business activities may incidentally involve special category data. For example: healthcare clinics scheduling appointments may capture medical conditions or symptoms in chat messages;
1 HR consultants may discuss employee health or religious accommodation needs; legal services may discuss criminal proceedings; political organizations may discuss member affiliations. When special category data flows through our Platform incidentally as part of customer messages or business operations, we process it as a data processor on behalf of you (the data controller), and you bear the primary responsibility for ensuring you have a valid legal basis under Article 9 GDPR (typically explicit consent under Article 9(2)(a), or one of the other exceptions). You must inform your end-users about any sensitive data processing and obtain appropriate consent. For high-volume or systematic processing of special category data, we strongly recommend executing a supplementary Data Processing Agreement that specifically addresses Article 9 obligations including additional security measures, restricted access controls, and limited retention periods. Contact our DPO at ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u})," if your use case involves regular special category data processing."]}),(0,n.jsx)("h2",{id:"sec-10",children:"10. Automated Decision-Making and Profiling (GDPR Art. 22)"}),(0,n.jsx)("p",{children:'GDPR Article 22 provides individuals with a specific right not to be subject to a decision based solely on automated processing \u2014 including profiling \u2014 that produces legal effects concerning them or similarly significantly affects them. This right exists because automated decisions, especially those involving artificial intelligence and machine learning, can sometimes produce unfair, biased, or harmful outcomes if not properly governed by human oversight. As a Platform that integrates AI extensively for customer communication automation, we have carefully considered how Article 22 applies to our service and have designed our architecture to ensure compliance. The key point is the distinction between AI-assisted operations (which use AI to help humans make decisions or to handle routine tasks under human supervision) and "solely automated" decisions producing legal or significant effects (which are restricted under Article 22). We do NOT use AI to make decisions of the latter type. Specifically, our practices are as follows:'}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"AI conversational responses are informational, not decisional:"})," When our AI generates a response to an end-customer message \u2014 answering a FAQ, suggesting a product, scheduling an appointment, providing support information \u2014 the AI is providing information or facilitating communication, not making a binding legal decision about the customer. The end-customer receives information; they decide whether and how to act on it. This falls outside Article 22's scope."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Significant business decisions involve human review:"}),' Any decision in our system that could have a "legal or similarly significant effect" \u2014 such as denying service to a user, suspending an account for policy violation, refusing payment, terminating a subscription, or imposing rate limits beyond standard tiers \u2014 involves review by a human member of our team before final implementation. Our automated systems may flag candidates for such actions, but the decision itself is made by a human with the ability to consider context, exceptions, and your perspective.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"You can always override AI responses and take manual control:"}),' Our Platform provides explicit "takeover" controls allowing you (the business customer) to interrupt any AI-managed conversation and resume manual control at any time. This human-in-the-loop design ensures that AI never makes irreversible commitments or significant decisions on behalf of your business without you having the ability to intervene.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Limited use of automated profiling:"})," We do not engage in profiling of individuals to make significant decisions about them. We perform basic aggregated analytics (such as identifying which features are popular or which industries have the highest engagement) but do not build individual psychographic profiles, predict individual behavior for high-stakes decisions, or use machine learning to deny opportunities to specific people."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Fraud detection uses automated screening with human verification:"})," We use automated systems to flag potentially fraudulent transactions, accounts, or messaging patterns. However, when an automated system flags an account for suspension or restriction, the decision is reviewed by our trust and safety team within 24 hours before becoming final, except in cases of imminent and severe abuse where temporary restrictions may apply pending review."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to human review:"})," If you believe that any decision affecting you was made solely by automated processing and produces a significant effect, you have the right under GDPR Article 22(3) to: (a) obtain human intervention to review the decision; (b) express your point of view on the matter; and (c) contest the decision. To exercise this right, contact our DPO at ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u}),". We will assign a human reviewer who has the authority to override the automated decision if appropriate."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Transparency about AI logic:"})," Where we use AI, we are committed to providing meaningful information about the logic involved when you exercise your right to access (Article 15(1)(h)). For our chatbot AI, this means we will explain that responses are generated by large language models trained on broad text data, conditioned by your specific knowledge base and prompt configuration. We do not believe AI processing in our Platform creates significant individual harm risks, but we are transparent about what we use and why."]})]}),(0,n.jsx)("p",{children:"If your business uses our Platform's AI features in ways that could have significant effects on individuals (for example, using AI chatbots to make initial credit assessments, determine eligibility for services, or deny benefits), you must implement your own human review processes and provide your end-users with the rights guaranteed under Article 22. Our standard Platform use does not require this, but specialized use cases may."}),(0,n.jsx)("h2",{id:"sec-11",children:"11. AI Processing & OpenAI Integration"}),(0,n.jsx)("p",{children:"A core capability of our Platform is AI-powered conversation automation, sentiment analysis, c
1ontent generation, and voice transcription. We partner with OpenAI as our primary AI provider, using their GPT family of large language models via their Enterprise API. We may also integrate additional AI providers (such as Anthropic's Claude, Google's Gemini, or open-source models we host ourselves) as our product evolves, with corresponding updates to this Policy. Because AI processing involves sending your content to third-party services, we want to be fully transparent about what happens to your data."}),(0,n.jsx)("p",{children:"When a message is received through any of your connected channels (WhatsApp, Instagram, Telegram, web chat, email, or voice), our servers process the message content through the following AI-related pipeline: the message text (along with limited context such as recent conversation history, relevant knowledge base entries, and your system prompt configuration) is sent to OpenAI's API over a TLS-encrypted connection; OpenAI processes the request and returns a generated response; our system receives the response and delivers it to your end-customer through the appropriate channel. This entire round-trip typically completes in 1-3 seconds. For voice calls, audio is first transcribed using OpenAI's Whisper model (or equivalent speech-to-text service), and the resulting text is then processed by the language model."}),(0,n.jsxs)("p",{children:["Regarding data retention at OpenAI, we operate under their Enterprise API Data Usage Policy, which provides significantly stronger protections than their consumer ChatGPT service. Under this policy: your data is ",(0,n.jsx)("strong",{children:"not used to train OpenAI's models"})," \u2014 this is a contractual commitment, not just a setting; your API inputs and outputs are retained by OpenAI for a maximum of 30 days for abuse monitoring purposes, after which they are permanently deleted; for Enterprise tier customers of our Platform, we can enable ",(0,n.jsx)("strong",{children:"Zero Data Retention (ZDR) mode"})," where OpenAI deletes data immediately after the API call completes with no retention period; OpenAI is contractually bound by confidentiality obligations equivalent to those of our employees; and OpenAI's infrastructure is SOC 2 Type II certified with annual third-party audits."]}),(0,n.jsx)("p",{children:"We strongly recommend that you avoid including highly sensitive personal data (such as government ID numbers, full credit card details, passwords, health information, or biometric data) in AI prompts, even though our safeguards are robust. Where your business involves processing sensitive categories of data, consider using pseudonyms, reference codes, or anonymized identifiers in AI prompts instead of actual sensitive values. Our Platform includes tools to help you sanitize inputs where appropriate. We also provide options to disable AI features entirely for specific workflows if your compliance requirements demand it."}),(0,n.jsxs)("p",{children:["OpenAI, L.L.C. is a US-based company. Data transfers to OpenAI are governed by Standard Contractual Clauses (SCCs) approved by the European Commission for transfers of personal data to countries without an adequacy decision. OpenAI provides a Data Processing Addendum (DPA) that implements GDPR Article 28 requirements. For a copy of OpenAI's sub-processor list and compliance documentation, see ",(0,n.jsx)("a",{href:"https://openai.com/enterprise-privacy",target:"_blank",rel:"noreferrer",children:"openai.com/enterprise-privacy"}),". In addition to OpenAI, our AI infrastructure may use specialized services for tasks like vector embeddings (e.g., Pinecone for semantic search), speech synthesis (e.g., ElevenLabs for voice output), or image analysis \u2014 each subject to its own DPA and listed in our sub-processor table in Section 12."]}),(0,n.jsx)("h3",{children:"11.1 The ChatPilots mobile app (iOS and Android): what is sent, to whom, and your consent"}),(0,n.jsx)("p",{children:"The ChatPilots mobile app includes an AI assistant that you operate through a command box. Because that assistant runs on third-party AI services rather than on our own servers, using it means part of your data leaves our infrastru
1cture. Before the app sends anything to those services, it shows you a dedicated in-app consent screen naming the data and the recipients, and it asks for your explicit permission. No AI request leaves the app until you grant that permission, and you can withdraw it at any time under Settings \u2192 AI data sharing. If you decline, the rest of the app keeps working \u2014 customers, appointments, orders, invoices and reports remain fully available \u2014 and only the AI features are disabled."}),(0,n.jsxs)("p",{children:[(0,n.jsx)("strong",{children:"What the app sends to third-party AI services:"})," (a) the commands and chat messages you type into the assistant; (b) the voice recording you make when you use voice input; (c) photos and documents you attach (for example invoices, contracts or screenshots); and (d) the business records your command requires in order to be answered \u2014 such as customer name, phone number, email address, appointment, order and invoice lines held in your workspace."]}),(0,n.jsxs)("p",{children:[(0,n.jsx)("strong",{children:"Who receives it:"})," ",(0,n.jsx)("strong",{children:"OpenAI, L.L.C."})," (United States) understands your command and writes the answer, transcribes your voice recording, reads answers aloud, and reads documents you attach. ",(0,n.jsx)("strong",{children:"ElevenLabs Inc."})," (United States) receives your script text only when you generate an AI video, and produces the voice-over. ",(0,n.jsx)("strong",{children:"Replicate, Inc."})," (United States) receives your prompt and any source image only when you generate an AI video or image, and produces the visuals."]}),(0,n.jsxs)("p",{children:[(0,n.jsx)("strong",{children:"How it is used:"})," the data is used solely to fulfil the request you made. It is not used to train these providers' AI models, is not used for advertising, and is never sold. Each of these providers is engaged under a Data Processing Agreement that binds them to protections equivalent to those we provide, and transfers to the United States are covered by Standard Contractual Clauses as described in Section 13."]}),(0,n.jsx)("h2",{id:"sec-12",children:"12. Sub-Processors List"}),(0,n.jsx)("p",{children:'To deliver the Platform reliably, securely, and at scale, we engage carefully selected third-party service providers ("sub-processors") who process personal data on our behalf for specific purposes. Under GDPR Article 28(2-4), Processors (us) must obtain authorization from Controllers (you) before engaging Sub-Processors and must impose contractual obligations equivalent to those in our agreement with you. We comply with these requirements through several mechanisms: (1) we maintain comprehensive Data Processing Agreements (DPAs) with each sub-processor that flow down GDPR/KVKK obligations; (2) we conduct thorough vendor security and privacy due diligence before engaging any new sub-processor, including review of their certifications, compliance posture, and incident history; (3) we maintain this public list of sub-processors and notify customers of material changes; (4) for Enterprise customers with executed DPAs, we provide advance notice (typically 30 days) of new sub-processor additions, allowing you to object; and (5) we periodically reassess sub-processor relationships based on performance, security, and customer needs. The complete current sub-processor list is below; we update this list when we make changes and notify customers as appropriate. Each entry shows the sub-processor name, the specific purpose for which we use them, the geographic location of their primary processing, and any major security/compliance certifications they hold.'}),(0,n.jsxs)("p",{children:["For each sub-processor, you can exercise your right to request a copy of the underlying Data Processing Agreement and our security assessment of that vendor. While the contractual documents are confidential, we provide summary information sufficient for you to understand the protections in place. Contact ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u})," for sub-processor inquiries or to request an updated list."]}),(0,n.jsxs)("table",{children:[(0,n.jsx)("thead",{children:(0,n.jsxs)("tr",{children:[(0,n.jsx)("th",{children:"Sub-Processor"}),(0,n.jsx)("th",{children:"Purpose"}),(0,n.jsx)("th",{children:"Location"}),(0,n.jsx)("th",{children:"Certifications"})]})}),(0,n.jsxs)("tbody",{children:[(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Meta Platforms, Inc."})}),(0,n.jsx)("td",{children:"WhatsApp Business API, Instagram, Facebook Login"}),(0,n.jsx)("td",{children:"USA, Ireland (EU data)"}),(0,n.jsx)("td",{children:"SOC 2, ISO 27001"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Telegram FZ-LLC"})}),(0,n.jsx)("td",{children:"Telegram Bot API integration"}),(0,n.jsx)("td",{children:"UAE"}),(0,n.jsx)("td",{children:"\u2014"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Twilio Inc."})}
1),(0,n.jsx)("td",{children:"SMS, voice telephony, phone verification"}),(0,n.jsx)("td",{children:"USA, EU"}),(0,n.jsx)("td",{children:"SOC 2 Type II, HIPAA, ISO 27001"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Paddle.com Market Ltd."})}),(0,n.jsx)("td",{children:"Payment processing, billing, tax"}),(0,n.jsx)("td",{children:"UK, USA"}),(0,n.jsx)("td",{children:"PCI-DSS Level 1, SOC 2"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"OpenAI, L.L.C."})}),(0,n.jsx)("td",{children:"AI model inference (GPT)"}),(0,n.jsx)("td",{children:"USA"}),(0,n.jsx)("td",{children:"SOC 2 Type II"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"ElevenLabs Inc."})}),(0,n.jsx)("td",{children:"Speech synthesis for AI video voice-over"}),(0,n.jsx)("td",{children:"USA"}),(0,n.jsx)("td",{children:"SOC 2 Type II, GDPR DPA"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Replicate, Inc."})}),(0,n.jsx)("td",{children:"AI image and video generation"}),(0,n.jsx)("td",{children:"USA"}),(0,n.jsx)("td",{children:"SOC 2 Type II, GDPR DPA"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Google LLC"})}),(0,n.jsx)("td",{children:"Maps API, OAuth, Workspace integration (optional)"}),(0,n.jsx)("td",{children:"USA, EU"}),(0,n.jsx)("td",{children:"ISO 27001, SOC 2/3, HIPAA"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Amazon Web Services"})}),(0,n.jsx)("td",{children:"Cloud infrastructure (compute, storage)"}),(0,n.jsx)("td",{children:"EU (Frankfurt, Ireland)"}),(0,n.jsx)("td",{children:"SOC 1/2/3, ISO 27001, HIPAA, FedRAMP"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"SendGrid (Twilio)"})}),(0,n.jsx)("td",{children:"Transactional and marketing email delivery"}),(0,n.jsx)("td",{children:"USA"}),(0,n.jsx)("td",{children:"SOC 2, ISO 27001"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Browserless.io"})}),(0,n.jsx)("td",{children:"Headless browser for web scraping (Spider feature)"}),(0,n.jsx)("td",{children:"USA"}),(0,n.jsx)("td",{children:"\u2014"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Cloudflare Inc."})}),(0,n.jsx)("td",{children:"CDN, DDoS protection, DNS"}),(0,n.jsx)("td",{children:"Global edge"}),(0,n.jsx)("td",{children:"SOC 2, ISO 27001"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Redis Ltd."})}),(0,n.jsx)("td",{children:"In-memory data store (session, queue)"}),(0,n.jsx)("td",{children:"EU"}),(0,n.jsx)("td",{children:"SOC 2, ISO 27001"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"GitHub Inc."})}),(0,n.jsx)("td",{children:"Source code hosting (internal use)"}),(0,n.jsx)("td",{children:"USA"}),(0,n.jsx)("td",{children:"SOC 1/2, ISO 27001"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:(0,n.jsx)("strong",{children:"Stripe Inc."})}),(0,n.jsx)("td",{children:"Alternative payment processor (select regions)"}),(0,n.jsx)("td",{children:"USA, EU"}),(0,n.jsx)("td",{children:"PCI-DSS Level 1"})]})]})]}),(0,n.jsx)("p",{children:"We notify customers of material changes to our sub-processor list at least 30 days in advance. Enterprise customers may object to new sub-processors under the terms of their DPA."}),(0,n.jsx)("h2",{id:"sec-13",children:"13. International Data Transfers"}),(0,n.jsx)("p",{children:"The internet operates across national borders, and modern SaaS platforms inevitably involve data transfers across multiple jurisdictions to deliver high-performance, reliable services. The GDPR (Chapter V, Articles 44-50) and similar laws like KVKK and the UK GDPR impose specific restrictions on transfers of personal data outside their respective protected territories. This section explains where your data may be processed, the legal mechanisms we use to ensure that international transfers comply with applicable data protection law, and the safeguards in place when data crosses borders. Our commitment is to ensure that personal data receives essentially equivalent protection regardless of where it is physically processed, in line with the principles established by the European Court of Justice in landmark cases including Schrems I and Schrems II."}
1),(0,n.jsx)("p",{children:"Our primary processing infrastructure is located in the European Union (specifically in EU-region cloud data centers operated by AWS in Frankfurt and Ireland) and in the Republic of Turkey (for customers and data subjects within the Turkish jurisdiction, served by our dedicated infrastructure). This regional approach minimizes the need for international transfers for the bulk of our operations. However, due to the global architecture of certain sub-processors that we depend on (such as Meta for WhatsApp/Instagram, OpenAI for AI inference, and Twilio for telephony), some personal data is necessarily transferred to other jurisdictions including the United States (most major cloud and AI providers), the United Kingdom (Paddle, our payment processor), the United Arab Emirates (Telegram), and other countries depending on the geographic distribution of our sub-processors' services. We have evaluated these transfers against the protections required by GDPR Chapter V and have implemented appropriate safeguards for each."}),(0,n.jsx)("p",{children:"When we transfer personal data outside the EEA, UK, or Turkey, we ensure at least one of the following safeguards is in place:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Adequacy Decision:"})," Transfers to countries deemed to provide adequate protection (UK, Switzerland, Canada commercial, Japan, Argentina, Israel, New Zealand, Uruguay)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Standard Contractual Clauses (SCCs):"})," EU Commission-approved contractual safeguards for transfers to the US and other countries (2021 SCCs)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"EU-US Data Privacy Framework:"})," Certification-based transfer mechanism for certified US recipients."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Binding Corporate Rules (BCRs):"})," For intra-group transfers where applicable."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Your Explicit Consent:"})," In limited cases where other mechanisms are not available."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Necessary for Contract Performance:"})," Where processing is necessary for performance of a contract with you."]})]}),(0,n.jsx)("p",{children:"We perform Transfer Impact Assessments (TIAs) for transfers to third countries to ensure your data receives essentially equivalent protection."}),(0,n.jsx)("h2",{id:"sec-14",children:"14. Data Retention Periods"}),(0,n.jsx)("p",{children:"The principle of storage limitation under GDPR Article 5(1)(e) and KVKK Article 4(d) requires that personal data be kept in identifiable form for no longer than necessary for the purposes for which it was collected. We have established detailed retention schedules for each category of data we process, balancing several competing considerations: the legitimate operational need to retain data while it is being actively used for the Service; legal obligations to preserve certain records (especially financial and tax records under Turkish Commercial Code and Tax Procedure Law); the practical necessity of backups for disaster recovery; the data subject's right to erasure; and the security best practice of minimizing the data inventory at risk. The table below provides a granular breakdown of our retention periods. After the specified periods, data is securely deleted (overwritten and removed from active and backup systems) or, where appropriate, irreversibly anonymized so that it can no longer be used to identify any individual."}),(0,n.jsx)("p",{children:'Two important nuances to understand: First, "active retention" applies to data in our production databases used for serving the Service. "Backup retention" is separate \u2014 backups are rotated on a 30-day cycle, so even after data is deleted from production it may persist in encrypted backups for up to 30 additional days before final removal. Second, certain "legal hold" exceptions can extend retention beyond the standard schedule when we are required to preserve evidence for ongoing legal proceedings, regulatory investigations, or tax audits. In such cases, the data is segregated, access-restricted, and processed only for the purpose of the legal matter, then deleted when the matter is resolved.'}),(0,n.jsxs)("table",{children:[(0,n.jsx)("thead",{children:(0,n.jsxs)("tr",{children:[(0,n.jsx)("th",{children:"Data Category"}),(0,n.jsx)("th",{children:"Retention Period"}),(0,n.jsx)("th",{children:"Legal Basis"})]})}),(0,n.jsxs)("tbody",{children:[(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Account data (name, email)"}),(0,n.jsx)("td",{children:"Active account + 30 days post-deletion"}),(0,n.jsx)("td",{children:"Contract"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Authentication credentials"}
1),(0,n.jsx)("td",{children:"Until account deletion"}),(0,n.jsx)("td",{children:"Contract"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Message content (chats)"}),(0,n.jsx)("td",{children:"Active account; deleted 30 days after account closure"}),(0,n.jsx)("td",{children:"Contract"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Voice recordings"}),(0,n.jsx)("td",{children:"30 days (configurable 7-90)"}),(0,n.jsx)("td",{children:"Contract + Consent"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Call transcripts"}),(0,n.jsx)("td",{children:"Account lifetime"}),(0,n.jsx)("td",{children:"Contract"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Invoices & tax records"}),(0,n.jsx)("td",{children:"10 years"}),(0,n.jsx)("td",{children:"Turkish Commercial Code Art. 82"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Tax identifier info"}),(0,n.jsx)("td",{children:"5 years after last transaction"}),(0,n.jsx)("td",{children:"Turkish Tax Procedure Law"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Audit logs (admin actions)"}),(0,n.jsx)("td",{children:"2 years"}),(0,n.jsx)("td",{children:"Legitimate Interest (security)"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Security event logs"}),(0,n.jsx)("td",{children:"90 days"}),(0,n.jsx)("td",{children:"Legitimate Interest"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Backup data"}),(0,n.jsx)("td",{children:"30 days rolling"}),(0,n.jsx)("td",{children:"Legitimate Interest (disaster recovery)"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Marketing consent records"}),(0,n.jsx)("td",{children:"3 years after withdrawal"}),(0,n.jsx)("td",{children:"Proof of consent (GDPR Art. 7(1))"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Support ticket history"}),(0,n.jsx)("td",{children:"3 years"}),(0,n.jsx)("td",{children:"Legitimate Interest"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Anti-fraud data"}),(0,n.jsx)("td",{children:"5 years"}),(0,n.jsx)("td",{children:"Legitimate Interest"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Website analytics"}),(0,n.jsx)("td",{children:"26 months anonymized"}),(0,n.jsx)("td",{children:"Legitimate Interest"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Cookies"}),(0,n.jsx)("td",{children:"Per cookie lifespan (see Cookie Policy)"}),(0,n.jsx)("td",{children:"Consent / Essential"})]})]})]}),(0,n.jsx)("p",{children:"After these periods, data is securely deleted or irreversibly anonymized. Deletion from backups may take up to an additional 90 days."}),(0,n.jsx)("h2",{id:"sec-15",children:"15. Technical & Organizational Security Measures"}),(0,n.jsxs)("p",{children:["Protecting your personal data is a fundamental priority and a continuous engineering effort at ",s,". We implement a layered defense-in-depth strategy combining industry-leading technical controls, strict organizational policies, external audits, and ongoing security investment. Under GDPR Article 32 and KVKK Article 12, data controllers and processors must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Our approach meets or exceeds the requirements of these articles, and we benchmark our practices against internationally recognized frameworks such as ISO/IEC 27001, SOC 2 Type II, NIST Cybersecurity Framework, and OWASP application security standards. Below we describe in detail the specific controls we have implemented."]}),(0,n.jsx)("h3",{children:"15.1. Encryption and Cryptographic Protections"}),(0,n.jsxs)("p",{children:["All data in transit between your browser/device and our servers, between our servers and sub-processor APIs, and between components of our internal infrastructure is encrypted using ",(0,n.jsx)("strong",{children:"Transport Layer Security (TLS) version 1.3"})," with forward secrecy and modern cipher suites (ECDHE-based key exchange, AEAD ciphers such as AES-GCM and ChaCha20-Poly1305). We enforce HTTP Strict Transport Security (HSTS) with long max-age and preloading, disable legacy TLS versions (TLS 1.0/1.1, SSL), and maintain an A+ rating on industry SSL testing tools. For data at rest, we apply ",(0,n.jsx)("strong",{children:"AES-256 encryption"})," on database volumes, object storage (S3-compatible), and backup archives. Particularly sensitive fields \u2014 such as OAuth access tokens, API keys, webhook secrets, and customer-supplied credentials \u2014 receive an additional layer of ",(0,n.jsx)("strong",{children:"field-level encryption"})," with tenant-specific encryption keys managed through a cloud KMS (Key Management Service) with automatic key rotation. Passwords are never stored in reversible form; instead we hash them using ",(0,n.jsx)("strong",{children:"bcrypt"})," with a work factor of 12 or higher and unique per-user salts, making brute-force attacks computationally infeasible even if a hash ever leaked."]}
1),(0,n.jsx)("h3",{children:"15.2. Access Control and Identity Management"}),(0,n.jsxs)("p",{children:["Access to production systems and customer data is governed by the principle of least privilege, meaning employees and automated systems receive only the minimum permissions necessary to perform their role. We implement ",(0,n.jsx)("strong",{children:"Role-Based Access Control (RBAC)"})," where permissions are assigned to roles (not individuals), roles are assigned to users, and changes are logged. All administrative accounts require ",(0,n.jsx)("strong",{children:"multi-factor authentication (MFA)"})," using FIDO2 security keys, TOTP authenticator apps, or hardware tokens \u2014 SMS-based 2FA is not accepted for admin access. We use Single Sign-On (SSO) with our identity provider for employee access to internal tools, enabling centralized onboarding and offboarding. All access is logged and regularly audited; dormant accounts are automatically disabled after 60 days of inactivity, and privileged access is reviewed quarterly."]}),(0,n.jsx)("h3",{children:"15.3. Network and Infrastructure Security"}),(0,n.jsxs)("p",{children:["Our infrastructure runs on enterprise-grade cloud providers (primarily AWS and our dedicated data center infrastructure) in the European Union and Turkey. We use ",(0,n.jsx)("strong",{children:"virtual private clouds (VPCs)"})," with strict network segmentation, placing database servers and internal services in private subnets that are not directly accessible from the internet. Traffic flows through ",(0,n.jsx)("strong",{children:"load balancers and Web Application Firewalls (WAF)"})," (Cloudflare) that filter malicious requests, block known attack patterns (OWASP Top 10), mitigate DDoS attacks at the edge, and enforce rate limits. We maintain a comprehensive inventory of all assets, apply security patches automatically within 24-72 hours of release (faster for critical CVEs), and perform regular vulnerability scans on our infrastructure using both internal tools and external services. Our network uses modern security standards including IPv6-ready configurations, TLS termination at the edge, and zero-trust principles for inter-service communication."]}),(0,n.jsx)("h3",{children:"15.4. Application Security"}),(0,n.jsxs)("p",{children:["Application security is embedded into our development lifecycle. Our engineers follow secure coding practices documented in an internal security playbook, covering topics such as SQL injection prevention (parameterized queries, ORM usage), cross-site scripting (XSS) prevention (output encoding, Content Security Policy), cross-site request forgery (CSRF) protection (CSRF tokens, SameSite cookies), authentication and session management, input validation, and safe handling of user-generated content. We run ",(0,n.jsx)("strong",{children:"Static Application Security Testing (SAST)"})," on every code change to detect security issues before merging, ",(0,n.jsx)("strong",{children:"Dynamic Application Security Testing (DAST)"})," against our staging environment, and ",(0,n.jsx)("strong",{children:"Software Composition Analysis (SCA)"})," to identify vulnerable dependencies. Critical and high-severity issues are addressed before deployment, and we maintain a public responsible disclosure policy at ",(0,n.jsx)("a",{href:"mailto:".concat(h),children:h})," for security researchers to report findings."]}),(0,n.jsx)("h3",{children:"15.5. Monitoring, Detection, and Incident Response"}),(0,n.jsxs)("p",{children:["We operate 24/7 security monitoring using centralized log aggregation (SIEM), anomaly detection, and alerting rules that notify our on-call security team of suspicious activity. Key events monitored include authentication failures, unusual API usage patterns, privilege escalations, large data exfiltration attempts, geographic anomalies in login activity, and indicators of compromise from threat intelligence feeds. We maintain a documented ",(0,n.jsx)("strong",{children:"Incident Response Plan"})," with clearly defined roles, escalation paths, communication templates, and post-incident review procedures. The plan is tested at least annually through tabletop exercises. In the event of a confirmed personal data breach, we notify the relevant supervisory authority (KVKK or applicable EU DPA) within ",(0,n.jsx)("strong",{children:"72 hours"}
1)," as required by GDPR Article 33, and notify affected individuals without undue delay if the breach is likely to result in high risk to their rights and freedoms (Article 34)."]}),(0,n.jsx)("h3",{children:"15.6. Organizational Controls"}),(0,n.jsxs)("p",{children:["Technology alone cannot protect data; people and processes are equally important. All employees and contractors with access to personal data sign ",(0,n.jsx)("strong",{children:"confidentiality and data protection agreements"})," as a condition of employment, undergo background checks appropriate to their role (more stringent for employees with production access), complete mandatory privacy and security training upon hire and annually thereafter, and are required to report any suspected security incidents immediately. Our security team maintains documented policies covering access control, data classification, acceptable use, change management, incident response, business continuity, and disaster recovery. Sub-processor relationships are managed through vendor risk assessments, Data Processing Agreements, and periodic security reviews. Backups are tested regularly to ensure we can recover from catastrophic failures, and we maintain Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) appropriate to each service tier."]}),(0,n.jsx)("h3",{children:"15.7. Compliance, Audits, and Continuous Improvement"}),(0,n.jsxs)("p",{children:["We are committed to achieving and maintaining industry-standard security certifications. Our roadmap includes SOC 2 Type II audit completion, ISO/IEC 27001 certification, and alignment with the Cloud Security Alliance (CSA) STAR framework. Pending these formal certifications, we undergo periodic third-party penetration testing (at least annually) by independent security firms, with results driving remediation priorities. Internal security audits are conducted quarterly, and we maintain a public security page (",(0,n.jsx)("a",{href:"mailto:".concat(h),children:"security contact"}),") where you can report concerns or request our latest security attestations under NDA for business customers."]}),(0,n.jsx)("h2",{id:"sec-16",children:"16. Data Breach Notification"}),(0,n.jsx)("p",{children:'Despite our extensive security measures described in Section 15, no system connected to the internet can be made absolutely secure against every conceivable attack, and we acknowledge the realistic possibility that a personal data breach could occur. A "personal data breach" under GDPR Article 4(12) means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. We have established a comprehensive Data Breach Response Plan with clear roles, escalation paths, communication templates, and recovery procedures that have been tested through tabletop exercises. Our commitment is to respond to any suspected or confirmed breach swiftly, transparently, and in accordance with all applicable legal notification requirements.'}),(0,n.jsx)("p",{children:"In the event of a personal data breach, we will execute the following response sequence:"}),(0,n.jsxs)("ol",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Within 24 hours of detection \u2014 Containment and Investigation:"})," Our security team immediately begins containment actions to stop ongoing data exposure, including isolating affected systems, revoking compromised credentials, blocking malicious IP addresses, enabling additional monitoring, and preserving forensic evidence. A formal incident response team is convened comprising security engineers, the DPO, legal counsel, and senior management. The incident is logged in our security incident tracking system with a unique identifier and severity classification."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Within 72 hours of becoming aware \u2014 Supervisory Authority Notification:"})," If the breach is likely to result in a risk to the rights and freedoms of natural persons, we notify the competent supervisory authority. For Turkish data subjects, this is KVKK (Ki\u015fisel Verileri Koruma Kurumu) \u2014 notification is required within 72 hours per KVKK Article 12. For EU data subjects, this is the relevant national Data Protection Authority (DPA) \u2014 required within 72 hours per GDPR Article 33. For UK data subjects, this is the Information Commissioner's Office (ICO). The notification includes: nature of the breach, categories and approximate numbers of data subjects concerned, categories and approximate numbers of personal data records concerned, name and contact details of the DPO, likely consequences of the breach, measures taken or proposed to address the breach including mitigation measures, and any delay in notification explained with reasons."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Without undue delay \u2014 Affected Individuals Notification:"})," If the breach is likely to result in a high risk to the rights and freedoms of natural persons (e.g., identity theft risk, financial fraud risk, significant reputational damage), we notify affected
1individuals directly. Notification is sent via email to registered addresses and/or in-app notification, in clear and plain language, describing: what happened and when, what personal data was involved, what we have done in response, what you should do to protect yourself (e.g., reset passwords, monitor financial accounts), how to contact us for more information, and any rights you may have. We do not delay individual notification to mitigate reputational concerns; legal requirements come first."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Ongoing \u2014 Regulatory Cooperation and Investigation:"})," We cooperate fully with supervisory authorities throughout the investigation, providing requested evidence, answering inquiries, and implementing any corrective actions ordered. We engage external forensic investigators when appropriate to ensure independent analysis of root causes."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Post-Incident \u2014 Root Cause Analysis and Remediation:"})," Within 30 days of incident closure, we conduct a thorough post-mortem analysis identifying the root causes (technical, procedural, or human), document lessons learned, implement corrective measures to prevent recurrence, update our risk assessments and controls, brief relevant staff, and may update this Policy or our security practices if needed. Lessons learned are incorporated into annual security training for all employees."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Transparency Reporting:"})," Where appropriate and when it would not compromise ongoing investigations, we may publish summary transparency reports documenting security incidents affecting us, their impact, and remediation. Customer-specific incidents are not disclosed publicly without explicit customer consent."]})]}),(0,n.jsxs)("p",{children:["Importantly, under our Data Processing Agreement with customers, we also notify our customers (you) of breaches affecting End-User data we process on your behalf, so that you as the Data Controller can fulfill your own notification obligations under GDPR/KVKK. We provide the information you need to include in your notifications and cooperate with your regulatory and end-user communications. See our ",(0,n.jsx)("a",{href:"/data-deletion",children:"Data Deletion page"})," and your DPA for further details on our processor obligations."]}),(0,n.jsx)("h2",{id:"sec-17",children:"17. Your Rights as a Data Subject"}),(0,n.jsxs)("p",{children:["Data protection laws around the world \u2014 particularly the GDPR in the EU/EEA, the UK GDPR, KVKK in Turkey, CCPA/CPRA in California, LGPD in Brazil, PIPEDA in Canada, APPI in Japan, and the Privacy Act in Australia \u2014 grant individuals substantial rights over how their personal data is processed. At ",s,", we recognize and uphold these rights in full, and we have established streamlined processes to help you exercise them quickly and without friction. Below is a detailed explanation of each right available to you, along with guidance on how we handle requests under each right. These rights generally apply to your personal data as an account holder; for data about your end-customers, those individuals must typically direct their requests to you as their Data Controller (though we will cooperate with you to facilitate compliance)."]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right of Access (GDPR Art. 15 / KVKK Art. 11(b-c)):"})," You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and where that is the case, access to the personal data along with supplementary information including the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients to whom the data has been or will be disclosed, the envisaged retention period or the criteria used to determine it, the existence of your other rights, the right to lodge a complaint with a supervisory authority, the source of the data if not collected from you, and the existence of any automated decision-making with meaningful information about the logic involved. Upon verified request, we provide a comprehensive copy of your personal data in a commonly used electronic format (typically JSON or CSV). The first access request is free of charge; for subsequent requests or manifestly unfounded/excessive requests, we may charge a reasonable administrative fee based on the cost of providing the information."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Rectification (Art. 16):"})," You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you, and taking into account the purposes of processing, the right to have incomplete personal data completed, including by means of providing a supplementary statement. Most rectifications can be performed directly through your account settings (profile, billing, preferences); for data that is not directly editable in the UI, contact our DPO and we will make corrections within a reasonable timeframe. We will inform each recipient to whom we previously disclosed the inaccurate data about the rectification unless this proves impossible or involves disproportionate effort."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'Right to Erasure / "Right to be Forgotten" (Art. 17):'})," You have the right to obtain erasure of your personal data without undue delay when: the data is no longer necessary for the purposes for which it was collected; you withdraw consent on which processing is based; you object to processing and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required to comply with a legal obligation. We have built a comprehensive data deletion workflow described
1in detail on our dedicated ",(0,n.jsx)("a",{href:"/data-deletion",children:"Data Deletion page"}),", including self-service deletion, email requests, identity verification, third-party notification (Art. 19), backup handling, and compliance with Meta's Data Deletion Callback requirements."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Restriction of Processing (Art. 18):"})," You have the right to obtain restriction of processing where: you contest the accuracy of the data (restriction applies for a period enabling us to verify accuracy); processing is unlawful and you oppose erasure preferring restriction instead; we no longer need the data but you require it for establishment/exercise/defense of legal claims; or you have objected to processing pending verification of whether our legitimate grounds override yours. When processing is restricted, we will only store the data and not further process it without your consent except for specific legal purposes."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Data Portability (Art. 20):"})," You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format (we provide JSON and CSV exports), and the right to transmit that data to another controller without hindrance from us. Where technically feasible, you can request direct transmission from our systems to another controller. This right applies to data processed by automated means based on consent or contract performance. We offer self-service exports in your dashboard for most data types, and our DPO can fulfill any additional portability requests within 30 days."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Object (Art. 21):"})," You have the right to object at any time to processing of your personal data based on legitimate interests (Art. 6(1)(f)) including profiling based on those provisions. Upon receiving an objection, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defense of legal claims. You have an absolute right to object to direct marketing, including profiling related to direct marketing \u2014 we will stop such processing immediately upon your objection, with no balancing test required."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Withdraw Consent (Art. 7(3)):"})," Where processing is based on your consent (for example, marketing emails, optional cookies, or specific features you opted into), you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. We provide easy withdrawal mechanisms including unsubscribe links in every marketing email, cookie preference controls on our website, and self-service toggles in your account settings. Withdrawing consent for a specific feature may limit your ability to use that feature but will not affect your overall account."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right Not to Be Subject to Automated Decision-Making (Art. 22):"})," You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Our Platform's AI generates responses that inform interactions but does not make legally binding decisions about individuals. Where any automated decision might rise to the significance threshold, we ensure human involvement in the decision, provide you with the right to express your point of view, and allow you to contest the decision with a human reviewer."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Lodge a Complaint with a Supervisory Authority:"})," Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that processing of your personal data infringes the GDPR or other data protection laws. We hope you will give us the opportunity to address your concerns directly first, but you are never required to do so. Complete contact details for relevant authorities are provided in Section 27."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to an Effective Judicial Remedy and Compensation (Art. 79, 82):"})," You have the right to an effective judicial remedy against a legally binding decision of a supervisory authority, and the right to claim compensation from us for material or non-material damage resulting from infringement of data protection law. These judicial remedies supplement (rather than replace) administrative complaints and are not affected by this Policy."]})]}),(0,n.jsx)("h2",{id:"sec-18",children:"18. How to Exercise Your Rights"}),(0,n.jsx)("p",{children:"We have established a streamlined, transparent process for handling data subject rights requests under GDPR, KVKK, CCPA, and similar laws. Our goal is to make exercising your rights as straightforward as possible while implementing reasonable safeguards to prevent fraudulent requests (which could otherwise result in unauthorized data disclosure or destruction). All requests are handled by our Data Protection Officer or designated legal team members who are trained on data subject rights and applicable timelines. We treat every request seriously and respond in good faith, even when we ultimately must decline a request due to legal exceptions or technical limitations. Below is the step-by-step process for exercising any of the rights described
1in Section 17:"}),(0,n.jsxs)("ol",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Contact method:"})," Email ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u}),' with subject "[GDPR/KVKK] \u2014 [Right You Wish to Exercise]".']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Required information:"})," Your registered email, full name, specific request, any relevant account details."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Identity verification:"})," We will verify your identity to prevent unauthorized access to personal data. This may involve requesting additional information."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Response timeline:"})," We respond within 30 calendar days. This may be extended by 60 days for complex requests, with notice."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Fees:"})," Generally free of charge. We may charge a reasonable fee for manifestly unfounded or excessive requests."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"If denied:"})," We will explain the reason and inform you of your right to lodge a complaint with a supervisory authority or seek judicial remedy."]})]}),(0,n.jsxs)("div",{className:"lp-highlight info",children:[(0,n.jsx)("strong",{children:"Tip:"})," For deletion requests specifically, you can also use our self-service ",(0,n.jsx)("a",{href:"/data-deletion",children:"Data Deletion page"}),", which walks you through the process step-by-step."]}),(0,n.jsx)("h2",{id:"sec-19",children:"19. Children's Privacy"}),(0,n.jsxs)("p",{children:["Protecting the privacy of children online is a fundamental responsibility, and various international laws \u2014 including the EU GDPR (Articles 8 and 12 regarding children's consent and clear communication), the United States Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code, the California Consumer Privacy Act provisions for minors, and Turkey's KVKK provisions for special categories of vulnerable individuals \u2014 impose specific protections for personal data of minors. ",a," is fundamentally a business-to-business (B2B) Platform designed for use by registered businesses and their authorized employees. Our Service is not directed at children, does not contain content designed to appeal to children, and is not designed to be used by minors."]}),(0,n.jsx)("p",{children:"Our specific policies regarding children are as follows: (1) We require all account holders to be at least 18 years of age, with the understanding that in some EU member states the age of digital consent may be set anywhere between 13 and 16 \u2014 we apply the 18 threshold uniformly as the most protective standard. (2) We do not knowingly collect personal data from children under 18 (or applicable lower age threshold in jurisdictions where it applies with appropriate parental consent mechanisms). (3) Account creation requires acceptance of these Terms, which contains an eligibility representation regarding age. (4) If we discover that we have inadvertently collected personal data from a child without proper parental consent, we will delete such information promptly and disable the account."}),(0,n.jsxs)("p",{children:["If you are a parent, guardian, or legal representative and believe that we have collected personal information about a child without proper authorization, please contact our Data Protection Officer immediately at ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u}),' with subject "Child Privacy \u2014 Request to Investigate." We will investigate within 30 days and take all appropriate corrective actions. You can also escalate concerns to your local supervisory authority \u2014 for the EU, your national Data Protection Authority; for the US, the FTC; for Turkey, KVKK.']}),(0,n.jsx)("p",{children:"An important consideration: while our Platform is used by businesses, the End-Users who interact with those businesses through our integrated channels (WhatsApp, Instagram, Telegram, web chat, voice) may include individuals of various ages, including potentially minors. For example, a business operating an educational service or selling consumer products may have legitimate communications with end-customers who are below the age of majority. In all such cases, the business customer (our tenant \u2014 you) is the Data Controller for end-user data and bears the primary responsibility for: (a) determining whether your service is appropriate for minors; (b) obtaining parental consent where legally required (COPPA, GDPR Article 8 for under-16s, etc.); (c) implementing age-verification mechanisms if appropriate to your business; and (d) providing age-appropriate privacy notices to your end-users. We process end-user data only as your Data Processor and are not in a position to independently verify ages."}),(0,n.jsx)("h2",{id:"sec-20",children:"20. Marketing Communications"}),(0,n.jsx)("p",{children:"We use marketing communications to keep you informed about new features, product updates, educational content (such as guides, webinars, and best practices), industry insights, exclusive promotions, and event invitations. We believe that well-targeted marketing communications can provide genuine value to our customers, helping you get more from the Platform and stay current with industry developments. However, we recognize that not everyone wants to receive marketing emails, and various laws (GDPR, ePrivacy Directive, CAN-SPAM Act, CASL, Turkish Law No. 6563 on Electronic Commerce) impose specific requirements on commercial messaging including clear opt-in mechanisms, easy opt-out options, and accurate sender identification. We comply with all such requirements and apply the highest standard where laws differ."}),(0,n.jsx)("p",{children:"We may send you marketing communications (product updates, newsletters, exclusive offers, event invitations, educational content, customer success stories) under one of the following lawful bases:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Explicit consent (Art. 6(1)(a) GDPR):"})," You have given clear, informed, freely-given, and unambiguou
1s opt-in consent \u2014 typically via a checked (not pre-checked) consent box during account signup or in your preferences update screen. We retain consent records as proof of compliance for at least 3 years."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Soft opt-in under EU/UK ePrivacy regulations (PECR):"})," If you are an existing customer of ours, we may contact you about similar products and services we offer, provided that (a) we collected your contact details in the course of a sale or negotiation; (b) we are marketing similar products to those you purchased or expressed interest in; and (c) you were given a clear opportunity to opt out at the time of collection and in every subsequent communication."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"B2B context:"})," Some jurisdictions allow more flexible direct marketing rules for business-to-business communications. We apply consumer-grade protections regardless because our customers may be sole proprietors, freelancers, or other individuals operating businesses."]})]}),(0,n.jsx)("p",{children:"You can unsubscribe from marketing communications at any time, free of charge, through any of the following methods:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Unsubscribe link:"}),' Every marketing email we send contains a clearly visible "Unsubscribe" link in the footer. Clicking it instantly removes you from our marketing lists; the change takes effect within 24 hours (typically immediately).']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Account preferences:"})," Sign in to your dashboard and navigate to ",(0,n.jsx)("strong",{children:"Settings \u2192 Notifications \u2192 Marketing Preferences"}),". You can granularly control which types of marketing you receive (newsletters, product updates, promotions, events) or unsubscribe from all."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Email request:"})," Email ",(0,n.jsx)("a",{href:"mailto:".concat(l,"?subject=Unsubscribe"),children:l}),' with subject "Unsubscribe." We will process the request within 5 business days.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Reply with STOP:"}),' Replying to any marketing email with "STOP" or "UNSUBSCRIBE" in the subject or body will trigger automated processing.']})]}),(0,n.jsx)("p",{children:"Important: Transactional and service-related emails \u2014 such as billing receipts, payment failure notifications, security alerts (login from new device, password reset), service degradation announcements, scheduled maintenance notices, mandatory legal updates (changes to Terms or Privacy Policy), and account-specific notifications (your subscription is about to renew, your storage is near limit) \u2014 cannot be opted out of while your account remains active, because they are necessary for service delivery and contractual performance. Once your account is closed, you will no longer receive any communications from us except as required to confirm account closure or comply with legal obligations."}),(0,n.jsxs)("p",{children:["We do not sell or rent your contact information to third parties for their marketing purposes. We do not share your email address with marketing partners. We do not use your data to build advertising audiences sold to third parties. Marketing emails come exclusively from ",s," or our authorized communications providers (such as SendGrid for delivery), all of whom are bound by strict data protection terms."]}),(0,n.jsx)("h2",{id:"sec-21",children:"21. Cookies and Tracking Technologies"}),(0,n.jsx)("p",{children:"Cookies are small text files that websites store on your device (browser) to remember information about your visit, such as your login session, language preference, or shopping cart contents. We use cookies and similar technologies (such as local storage and session storage in your browser) to provide essential Platform functionality, remember your preferences, and improve our service. Our use of cookies is governed by the EU ePrivacy Directive (and its national implementations such as the UK PECR), which requires explicit consent for non-e
1ssential cookies, and by GDPR for any personal data collected via cookies. We have implemented a privacy-respectful approach: we use the minimum cookies necessary, we do not use third-party advertising or tracking cookies, and we provide clear consent controls."}),(0,n.jsx)("p",{children:"The cookies we set fall into the following categories:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Strictly Necessary Cookies (Essential):"})," These cookies are required for basic Platform functionality and cannot be disabled without breaking the Service. They include session identifiers (so you stay logged in across page loads), CSRF tokens (to protect against cross-site request forgery attacks), authentication tokens, and load balancer affinity cookies (to ensure consistent server routing). Under EU ePrivacy law, strictly necessary cookies do not require consent because they are essential to deliver the service explicitly requested by you. They typically expire when you close your browser session or after a defined session timeout (e.g., 24 hours)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Functional / Preference Cookies:"})," These cookies remember your preferences and settings to provide a personalized experience \u2014 such as your language preference (Turkish, English), UI theme (light, dark), timezone, or cookie consent choices. They are not strictly required but make the Platform more usable. We obtain your opt-in consent for these via our cookie banner. They typically persist for up to 1 year."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Analytics Cookies:"}),' These cookies help us understand how customers use the Platform in aggregate (which features are popular, where users encounter friction, what error rates look like). We use first-party analytics that anonymizes data and does not identify individuals. We obtain opt-in consent and respect "Do Not Track" browser signals where transmitted. Analytics cookies are retained for a maximum of 13 months in compliance with GDPR best practice.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"NO Third-Party Advertising or Tracking Cookies:"})," We explicitly do NOT use cookies from advertising networks, retargeting platforms, social media trackers (Facebook Pixel, Twitter Pixel), or data brokers. We do not enable behavioral advertising on our website. We do not sell data to advertisers. Your activity on our Platform is not tracked across other websites for advertising purposes."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Local Storage and Session Storage:"})," In addition to cookies, we use HTML5 local storage and session storage to cache certain Platform data on your device for performance reasons (such as cached UI components, draft messages, or recently viewed conversations). This data is stored only in your browser and is never transmitted to our servers without your explicit action. You can clear it through your browser's developer tools."]})]}),(0,n.jsx)("p",{children:'You can manage your cookie preferences in several ways: (a) through our cookie consent banner displayed when you first visit our site; (b) through your browser settings, which allow you to block or delete cookies (note: blocking essential cookies will prevent the Platform from functioning); (c) by clearing browsing data via your browser\'s privacy controls; (d) by using browser extensions for enhanced privacy. We respect "Do Not Track" (DNT) browser signals where transmitted by treating them as a signal to disable optional analytics cookies.'}),(0,n.jsx)("h2",{id:"sec-22",children:"22. Meta Platform Compliance"}),(0,n.jsxs)("p",{children:[a," is an officially registered Meta technology partner with access to the WhatsApp Business API, Instagram Messaging API, and Facebook Login for Business. Our integration with Meta's platforms is governed by multiple overlapping policies and contractual requirements that we take very seriously, because non-compliance could result in the suspension of our access to Meta's APIs \u2014 which would affect every customer on our Platform. We maintain a dedicated internal
1compliance team and automated monitoring systems to ensure continuous adherence to these requirements. Specifically, we comply with the following Meta policies and contractual terms, which are incorporated into our operational practices and, where applicable, flow through to our customers via these Terms:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Meta Platform Terms:"})," The overarching agreement between developers and Meta governing all platform usage. Published at ",(0,n.jsx)("a",{href:"https://developers.facebook.com/terms",target:"_blank",rel:"noreferrer",children:"developers.facebook.com/terms"}),". Key provisions include data use restrictions, user protection requirements, monetization limits, and compliance review obligations."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Meta Developer Policies:"})," Specific rules for developers covering data minimization (requesting only necessary permissions), accurate representation of app functionality, prohibition on creating fake accounts, and proper handling of user tokens. We follow these policies in both code and operational practice."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"WhatsApp Business Messaging Policy:"})," The definitive policy governing what businesses can and cannot do via WhatsApp Business API. Core requirements include explicit opt-in consent from users before messaging, respect for the 24-hour messaging window, use of pre-approved Message Templates for business-initiated conversations outside the window, prohibition of promotional content in templates (unless approved), and prohibition of specific content categories such as gambling, weapons, and regulated goods without prior authorization."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Meta Business Pages Terms:"})," Rules for connecting Facebook Pages to business tools, including advertising restrictions and content moderation expectations."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Instagram Platform Terms:"})," Specific requirements for Instagram Business messaging integrations, including limits on how messages can be sent, restrictions on story mentions, and content moderation obligations."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Data Deletion Callback:"})," Meta requires all apps connected to Facebook/Instagram to implement a Data Deletion Callback URL that receives deletion requests when a user revokes app access through their Meta settings. We have implemented this callback at ",(0,n.jsxs)("code",{children:["https://",c,"/api/meta/data-deletion-callback"]}),", which automatically processes deletion requests within 30 days. When a user removes our app from their Facebook settings, we receive a signed request containing their user ID, confirm the request, and queue deletion of associated data across our systems."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Commerce Data Terms (if applicable):"})," When businesses use our Platform to integrate with WhatsApp Commerce, Instagram Shopping, or Facebook Marketplace, additional data usage restrictions apply, including product catalog data handling, inventory synchronization rules, and order data retention."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Ad Platform Terms:"})," For our Click-to-WhatsApp (CTWA) advertising features, we comply with Meta's advertising policies including attribution handling, audience privacy, and prohibition on discriminatory advertising."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Google Ads API Integration:"}),' Our "AI Google Ads" feature uses the Google Ads API under our approved Manager Account (MCC 486-290-6943). Customers connect their own Google Ads accounts via Google OAuth (scope: ',(0,n.jsx)("code",{children:"https://www.googleapis.com/auth/adwords"}),"). We only request the minimum scope needed to create and manage campaigns the customer explicitly configures through our Platform. Refresh tokens are stored encrypted (AES-256-GCM) and are never shared with third parties. Campaign spend is billed by Google directly to the customer; ChatPilots does not process or mark up ad spend. Use of the Google Ads API is subject to Google's ",(0,n.jsx)("a",{href:"https://developers.google.com/terms/api-services-user-data-policy",target:"_blank",rel:"noreferrer",children:"API Services
1User Data Policy"}),' \u2014 including the Limited Use requirements \u2014 and the Google Ads API Terms and Conditions. Customers may revoke access at any time from the "AI Google Ads" panel or directly from their Google account permissions page.']})]}),(0,n.jsx)("p",{children:"To maintain continuous compliance, we submit to periodic app reviews conducted by Meta, respond to Meta's platform announcements and policy updates promptly, track our WhatsApp Business Account quality ratings and alert customers before restrictions are imposed, enforce our Acceptable Use Policy to prevent customers from engaging in activities that would violate Meta's policies on our behalf, and cooperate with Meta's trust and safety teams when they investigate reports. Violations of Meta's policies by our customers may result in suspension of the offending customer's account on our Platform to protect our broader integration."}),(0,n.jsx)("h2",{id:"sec-23",children:"23. WhatsApp Business Messaging \u2014 Specific Data Practices"}),(0,n.jsx)("p",{children:"WhatsApp Business Messaging is one of the most regulated communication channels in the world, with strict rules designed to protect consumers from unwanted commercial messaging. These rules are established by Meta (WhatsApp's parent company) and enforced through technical limits, quality ratings, and contractual obligations. Using our Platform to send WhatsApp messages means you are operating within this regulated environment, and we build our product to help you comply rather than expose you to risk. Below we detail the specific data practices and operational rules for WhatsApp messaging through our Platform:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Explicit Opt-In Requirement:"}),' WhatsApp policy mandates that your end-customers must have explicitly consented to receive messages from your business before you send them anything. Valid opt-in methods include: a checked box on your website checkout form confirming "I agree to receive WhatsApp messages from [business name]"; a written consent on a paper form retained for audit; an in-person verbal consent where you explain what they will receive; or a QR code flow where the customer initiates contact by messaging your business first. Vague or pre-checked consent boxes are not acceptable. The burden of proof for opt-in lies with you; we help you collect and document consents but cannot create them.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"The 24-Hour Messaging Window:"})," WhatsApp's most important rule is the 24-hour window. Once your end-customer sends your business a message (inbound), you have exactly 24 hours to respond with any freeform content \u2014 plain text, images, documents, audio, video, location, contacts, interactive buttons, or list messages. The window resets with each new inbound message. After 24 hours of silence from the customer, you can only send ",(0,n.jsx)("strong",{children:"pre-approved Message Templates"})," (also called Highly Structured Messages or HSMs) until they respond again. Our Platform automatically tracks this window for you and warns when it's about to expire."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Message Templates (HSMs):"})," Templates are pre-approved message formats for business-initiated conversations outside the 24-hour window. They must be submitted to Meta for review and approval before use, typically taking 24-48 hours to process. Templates fall into categories: Marketing (promotional content, requires explicit opt-in), Utility (service updates, order confirmations, appointment reminders), and Authentication (one-time passcodes). Each category has different pricing, content rules, and approval standards. Our dashboard helps you draft, submit, and track template status, manage translations across languages, and monitor category reassignments by Meta."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Quality Rating and Conversation Category:"})," Meta assigns each WhatsApp Business phone number a quality rating (Green = High, Yellow = Medium, Red = Low) based on user feedback such as blocks and reports. Consistently high user complaint rates can result in rate limiting (reduced daily messaging capacity), restricted messaging tiers, or phone number suspension. Our Platform exposes your current quality rating in the dashboard, alerts you proactively when it drops, provides best-practice guidance for maintaining quality, and can automatically pause campaigns that are generating complaints."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Phone Number Handling:"})," End-customer phone numbers you use for WhatsApp messaging are stored encrypted at rest using AES-256 with per-tenant keys. Numbers are used exclusively for delivering messages through Meta's API and related analytics (such as tracking which numbers have opted in or opted out). We do not share, sell, or use end-customer numbers for purposes other than serving your account. When you delete a contact or cancel your subscription, the associated phone numbers are deleted per the retention schedule in Section 14."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Group Messaging is Prohibited:"})," The WhatsApp Business API explicitly does NOT support sending messages to WhatsApp groups. Our Platform only supports 1:1 conversations between your business and individual customers who have opted in. Attempting to abuse this by manually copying a group link or coordinating group sends would violate our Acceptable Use Policy and Meta's terms."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Regulated and Prohibited Content:"})," WhatsApp prohibits certain content categories entirely (illegal drugs, weapons, adult services, deceptive schemes, hate speech) and restricts others to pre-approved businesses (gambling, pharmaceuticals, alcohol in some regions, dating services, financial services, political content). Our onboarding flow surfaces these restrictions, and we reserve the right to review your use case before enabling WhatsApp for your account if you operate in a restricted category."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"User Privacy within WhatsApp:"})," When an end-customer messages your business, their WhatsApp profile information (display name and profile photo) becomes available to your account. We do not copy or store WhatsApp profile photos unless you explicitly save them. End-customers retain the ability to block your business at any time, which immediately prevents further messaging."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Pricing and Conversation Charges:"})," Meta charges per conversation (not per message) based on conversation category and the originating country of your end-customer. These
1charges are passed through to you as usage-based fees separate from your ",a," subscription. We display these charges transparently in your billing dashboard."]})]}),(0,n.jsx)("h2",{id:"sec-24",children:"24. California Consumer Privacy (CCPA/CPRA)"}),(0,n.jsx)("p",{children:"The California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA) effective January 1, 2023, provides comprehensive privacy rights to California residents regarding personal information collected by businesses meeting certain thresholds. The CPRA also established the California Privacy Protection Agency (CPPA) as the dedicated regulator. Although our primary regulatory framework is GDPR/KVKK, we extend equivalent CCPA/CPRA protections to all California residents who interact with our Platform, ensuring you receive the full benefit of California law alongside our global privacy protections. The categories of personal information we collect (as defined under CCPA \xa71798.140), the sources of that information, the business purposes for which it is used, and the categories of third parties to whom it is disclosed are all detailed in earlier sections of this Policy (see Sections 5, 6, and 12). Below we enumerate the specific rights granted to California residents and how to exercise them."}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Know (CCPA \xa71798.110, 1798.115):"})," You have the right to request that we disclose what personal information we have collected about you in the past 12 months, including: the categories of personal information; the categories of sources from which the information was collected; the business or commercial purpose for collecting; the categories of third parties with whom we shared it; and the specific pieces of personal information collected. Upon verified request, we provide this information in a portable format within 45 days (extendable to 90 days for complex requests)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Delete (CCPA \xa71798.105):"})," You have the right to request deletion of personal information we have collected about you, subject to certain exceptions for ongoing service provision, security, debugging, legal compliance, and other legitimate business needs as enumerated in \xa71798.105(d). See our ",(0,n.jsx)("a",{href:"/data-deletion",children:"Data Deletion page"})," for the detailed deletion process."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Correct (CPRA \xa71798.106):"})," Effective under CPRA, you have the right to request correction of inaccurate personal information we maintain about you. We will use commercially reasonable efforts to correct the data and notify any third parties to whom we previously disclosed it."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Opt-Out of Sale or Sharing (CCPA \xa71798.120, CPRA \xa71798.121):"}),' California law gives you the right to opt out of the "sale" of personal information (broadly defined to include any exchange for monetary or other valuable consideration) and the "sharing" of personal information for cross-context behavioral advertising. ',(0,n.jsx)("strong",{children:"We do NOT sell or share personal information for cross-context behavioral advertising under any definition. This is a categorical commitment."}),' Therefore, no opt-out is needed, but we honor the "Global Privacy Control" (GPC) browser signal as a valid opt-out request regardless.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Limit Use of Sensitive Personal Information (CPRA \xa71798.121):"}),' CPRA introduced this right specifically for "sensitive personal information" (a defined subset including SSN, geolocation, racial/ethnic origin, religious beliefs, mail/email content, biometrics, etc.). You have the right to direct us to limit our use of such information to that which is necessary to perform the services or provide the goods reasonably expected. We do not use sensitive personal information for purposes beyond essential service delivery.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Non-Discrimination (CCPA \xa71798.125):"})," We will not discriminate against you for exercising any CCPA/CPRA rights. This means we will not deny you services, charge you different prices, provide a different level of quality, or suggest that we will. We may, however, offer financial incentives for the collection or sale of personal information through programs you opt into (we currently do not operate any such programs)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Right to Data Portability:"})," Personal information you have provided to us can be transmitted to you (or another business at your request) in a structured, commonly used, machine-readable format such as JSON or CSV."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Authorized Agent Requests:"})," You may designate an authorized agent to make CCPA/CPRA requests on your behalf. The agent must provide signed permission demonstrating their authority, and we may verify their identity and the relationship before processing."]})]}),(0,n.jsxs)("p",{children:["To exercise any CCPA/CPRA right, contact ",(0,n.jsx)("a",{href:"mailto:".concat(u,"?subject=CCPA%20Request"),children:u}),' with subject "CCPA Request" specifying the right you wish to exercise. You can also call us via the contact information at the bottom of this Policy. We do not require account creation to exercise r
1ights; we will verify your identity through reasonable means appropriate to the sensitivity of the information involved. Statutory response deadlines apply (45 days for most requests, extendable by 45 additional days with notice).']}),(0,n.jsx)("h2",{id:"sec-25",children:"25. LGPD (Brazil)"}),(0,n.jsx)("p",{children:"The Brazilian General Data Protection Law (Lei Geral de Prote\xe7\xe3o de Dados \u2014 LGPD, Law No. 13.709/2018, in force since September 2020) is Brazil's comprehensive data protection framework, closely modeled on the EU GDPR with some Brazilian-specific adaptations. The Autoridade Nacional de Prote\xe7\xe3o de Dados (ANPD) is the dedicated national supervisory authority. We extend LGPD-equivalent protections to all Brazilian residents who use our Platform or whose personal data we process. The legal bases for processing under LGPD Article 7 closely parallel GDPR Article 6 and include consent, legal obligation, public administration, research, contract execution, exercise of rights, vital interests, public health, legitimate interests, and credit protection."}),(0,n.jsxs)("p",{children:["Brazilian residents have the following rights under LGPD Article 18, which align closely with GDPR rights: confirmation of processing; access to data; correction of incomplete or inaccurate data; anonymization, blocking, or deletion of unnecessary or excessively processed data; portability to another service provider; deletion of personal data processed with consent; information about public and private entities with whom data has been shared; information about the possibility of refusing consent and the consequences of refusal; revocation of consent. To exercise these rights, contact our DPO at ",(0,n.jsx)("a",{href:"mailto:".concat(u,"?subject=LGPD%20Request"),children:u}),' with subject "LGPD Request." We respond within 15 days as required by ANPD guidelines (extendable in complex cases). Brazilian residents may also file complaints with ANPD at ',(0,n.jsx)("a",{href:"https://www.gov.br/anpd",target:"_blank",rel:"noreferrer",children:"gov.br/anpd"}),". We participate in good faith with any ANPD investigations or inquiries."]}),(0,n.jsx)("h2",{id:"sec-26",children:"26. PIPEDA (Canada)"}),(0,n.jsx)("p",{children:"The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law applicable to private-sector organizations engaged in commercial activities. Quebec, Alberta, and British Columbia have substantially similar provincial laws (Quebec Law 25 \u2014 formerly Bill 64, Alberta PIPA, BC PIPA). PIPEDA is built around 10 fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. We comply with all 10 principles in our data handling practices for Canadian residents."}),(0,n.jsxs)("p",{children:['Canadian users have the right to: access their personal information held by us; request correction of inaccurate information; withdraw consent at any time (subject to legal or contractual restrictions); receive an explanation of the use and disclosure of their information; and file complaints with us or with the Office of the Privacy Commissioner of Canada (OPC). PIPEDA also imposes specific data breach notification obligations: organizations must report breaches that pose a "real risk of significant harm" to the OPC and notify affected individuals as soon as feasible. We comply with these requirements. To exercise PIPEDA rights, contact ',(0,n.jsx)("a",{href:"mailto:".concat(u,"?subject=PIPEDA%20Request"),children:u}),". To file an external complaint, the OPC can be reached at ",(0,n.jsx)("a",{href:"https://www.priv.gc.ca",target:"_blank",rel:"noreferrer",children:"priv.gc.ca"}),"."]}),(0,n.jsx)("h2",{id:"sec-27",children:"27. Supervisory Authorities (Complaint Filing)"}),(0,n.jsx)("p",{children:"Independent supervisory authorities exist in most jurisdictions to enforce data-protection law and to provide an external recourse mechanism for individuals whose personal data has allegedly been mishandled. Under GDPR Article 77, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if they consider that the processing of personal data relating to them infringes the GDPR. KVKK Article 14 provides an analogous right under Turkish law: data subjects whose application to the data controller has been rejected, whose response is found insufficient, or who do not receive a response within the statutory period may file a complaint with the Personal Data Protection Board (KVKK Kurulu)."}),(0,n.jsxs)("p",{children:["Before resorting to a supervisory authority, we strongly encourage you to first contact our DPO so that we have an opportunity to investigate, explain, or remedy any concern. The vast majority of disputes can be resolved at this stage without the burden, cost, and delay of a regulatory proceeding. If you remain dissatisfied with our response, or if we fail to respond within the statutory deadlines (one calendar month under GDPR Article 12(3); thirty days under KVKK Article 13), you may escalate to the supervisory authority with jurisdiction over your case. The list below is illustrative \u2014 for jurisdictions not enumerated, please consult the global directory maintained by the Global Privacy Assembly at ",(0,n.jsx)("a",{href:"https://globalprivacyassembly.org",target:"_blank",rel:"noreferrer",children:"globalprivacyassembly.org"}),"."]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Turkey (KVKK):"})," ",(0,n.jsx)("a",{href:"https://kvkk.gov.tr",target:"_blank",rel:"noreferrer",children:"kvkk.gov.tr"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"European Union:"})," Your national Data Protection Authority. Full list: ",(0,n.jsx)("a",{href:"https://edpb.europa.eu/about-edpb/about-edpb/members_en",target:"_blank",rel:"noreferrer",children:"edpb.europa.eu/members"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"United Kingdom:"})," Information Commissioner's Office (ICO) \u2014 ",(0,n.jsx)("a",{href:"https://ico.org.uk",target:"_blank",rel:"noreferrer",children:"ico.org.uk"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"United States:"})," Federal Trade Commission (FTC) \u2014 ",(0,n.jsx)("a",{href:"https://www.ftc.gov",target:"_blank",rel:"noreferrer",children:"ftc.gov"}),". California residents: Attorney General."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Canada:"})," Office of the Privacy Commissioner \u2014 ",(0,n.jsx)("a",{href:"https://www.priv.gc.ca",target:"_blank",rel:"noreferrer",children:"priv.gc.ca"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Brazil:"})," Autoridade Nacional de Prote\xe7\xe3o de Dados (ANPD) \u2014 ",(0,n.jsx)("a",{href:"https://www.gov.br/anpd",target:"_blank",rel:"noreferrer",children:"gov.br/anpd"})]})]}),(0,n.jsx)("h2",{id:"sec-28",children:"28. EU Representative (GDPR Art. 27)"}),(0,n.jsx)("p",{children:"GDPR Article 27 obliges controllers and processors not established in the Union \u2014 but offering goods or services to data subjects in the Union, or monitoring their behaviour insofar as it takes place within the Union \u2014 to designate in writing a representative in the Union. The representative serves as a single, locally-accessible point of contact for supervisory authorities and data subjects on all issues related to the processing, in addition to or instead of the controller or processor. The obligation is intended to remove the practical barrier that EU data subjects would otherwise face in communicating with non-EU controllers, particularly where language, time-zone, or legal-system differences exist."}),(0,n.jsxs)("p",{children:["An exemption applies under Article 27(2) where (a) processing is occasional, (b) does not include, on a large scale, special categories of data referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10, and (c) is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing. We assess our obligation under Article 27 on an ongoing basis. Where designation is required, the identity, postal address, telephone, and email of our EU Representative will be published in this Section, communicated to relevant supervisory authorities, and available upon written request to ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u}),". Until formally designated, EU data subjects may exercise all GDPR rights directly with our DPO via the channels set out in Sections 17\u201318 above."]}),(0,n.jsx)("h2",{id:"sec-29",children:"29. Changes to This Privacy Policy"}),(0,n.jsx)("p",{children:"Privacy law and our processing operations are not static. New regulations, new sub-processors, new product features, and feedback from regulators or auditors may require us to revise this document from time to time. We are committed to giving you transparent advance notice of any change that materially affects your rights, the categories of data we process, the purposes of processing, the legal basis on which we rely, the recipients to whom we disclose data, the international transfers we make, or the retention periods we apply. We will not retroactively reduce your rights without your consent."}),(0,n.jsx)("p",{children:"Typical reasons we update this Privacy Policy include:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Changes in our data practices or services"}),(0,n.jsx)("li",{children:"Legal/regulatory requirements"}),(0,n.jsx)("li",{children:"Feedback from regulators or users"}),(0,n.jsx)("li",{children:"New third-party integrations"})]}),(0,n.jsx)("p",{children:"For material changes, we will:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Notify you at least 30 days in advance via email or in-app notification"}),(0,n.jsx)("li",{children:'Update the "Effective Date" at the top of this policy'}),(0,n.jsx)("li",{children:"Maintain a version history below"}),(0,n.jsx)("li",{children:"Require re-acceptance for fundamentally altered terms"})]}),(0,n.jsx)("h2",{id:"sec-30",children:"30. Languages"}),(0,n.jsx)("p",{children:"This Privacy Policy is published in English, which is the language we use for product development, internal documentation, and communication with regulators and sub-processors located outside Turkey. The English version is the authoritative legally binding text and shall control in any case of doubt, ambiguity, or inconsistency. For the convenience of our Turkish-speaking users we maintain a parallel KVKK-ayd\u0131nlatma metni in Turkish on our public website;
1 that translation is provided in good faith but is informational only \u2014 to the extent any Turkish translation conflicts with this English text, the English version prevails for purposes of contractual interpretation, while users in Turkey continue to enjoy any minimum protections afforded by KVKK irrespective of language. We may, in the future, publish further translations (Spanish, German, Portuguese, Arabic) on a similar informational basis. Translation does not extend the scope, alter the meaning, or create additional rights or obligations beyond those set out in the English original."}),(0,n.jsx)("h2",{id:"sec-31",children:"31. Version History"}),(0,n.jsxs)("table",{children:[(0,n.jsx)("thead",{children:(0,n.jsxs)("tr",{children:[(0,n.jsx)("th",{children:"Version"}),(0,n.jsx)("th",{children:"Date"}),(0,n.jsx)("th",{children:"Changes"})]})}),(0,n.jsxs)("tbody",{children:[(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"3.0"}),(0,n.jsx)("td",{children:p}),(0,n.jsx)("td",{children:"Major rewrite \u2014 enterprise-grade, 33 sections, multi-jurisdiction"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"2.0"}),(0,n.jsx)("td",{children:"April 8, 2026"}),(0,n.jsx)("td",{children:"Added GDPR/KVKK rights, sub-processor list"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"1.0"}),(0,n.jsx)("td",{children:"January 2026"}),(0,n.jsx)("td",{children:"Initial publication"})]})]})]}),(0,n.jsx)("h2",{id:"sec-32",children:"32. Governing Law & Jurisdiction"}),(0,n.jsx)("p",{children:"This Privacy Policy and any non-contractual obligations arising out of or in connection with it shall be governed by, and construed in accordance with, the laws of the Republic of Turkey, including in particular the Turkish Personal Data Protection Law No. 6698 (KVKK), the Turkish Code of Obligations No. 6098, the Turkish Commercial Code No. 6102, the Electronic Commerce Law No. 6563, and any related secondary legislation, regulations, communiqu\xe9s, or board decisions issued by the KVKK Kurulu. The choice of Turkish law is made for legal-certainty purposes and does not deprive a consumer (a natural person acting outside the scope of any business activity) of the protection afforded by mandatory provisions of the law of the country in which the consumer has their habitual residence, in accordance with Article 6 of the Rome I Regulation (EU) No. 593/2008 where applicable."}),(0,n.jsx)("p",{children:"The competent courts and enforcement offices of Istanbul (\xc7a\u011flayan adliyesi) shall have exclusive jurisdiction to settle any dispute, controversy, or claim arising out of or in connection with this Privacy Policy, including any question regarding its existence, validity, breach, or termination. Notwithstanding the foregoing, (i) consumers may bring proceedings in the courts of the country in which they reside; (ii) we reserve the right to bring proceedings against any user in any court of competent jurisdiction in connection with infringement of intellectual-property rights or breach of confidentiality obligations; and (iii) data subjects retain in all cases the right to complain to their local supervisory authority and to seek judicial remedies under their local data-protection law (e.g. GDPR Articles 78\u201379). Nothing in this Section limits, excludes, or otherwise restricts any non-waivable statutory right of a data subject."}),(0,n.jsx)("h2",{id:"sec-33",children:"33. Contact Us"}),(0,n.jsx)("p",{children:"Transparency depends on accessibility. We have therefore made every reasonable effort to ensure that you can reach the right person inside our organisation, in the right channel, with a minimum of friction. Whether you are exercising a statutory right, reporting a suspected security incident, asking a clarifying question about how we process a particular data category, or simply requesting a copy of an underlying agreement (DPA, SCC), the channels below are monitored on business days and acknowledged within one (1) business day, with substantive response within the statutory deadlines noted in Sections 17 and 18. We log all inbound privacy correspondence in a dedicated case-management system to ensure traceability and to facilitate later audit."}),(0,n.jsx)("p",{children:"For any privacy-related inquiries:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Email (general privacy):"})," ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Email (data subject rights):"})," ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Email (security issues):"})," ",(0,n.jsx)("a",{href:"mailto:".concat(h),children:h})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Subject line format:"}),' "[Privacy] \u2014 [Your request]"']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Mailing address:"})," ",s,", Data Protection Officer, ",o]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Response time:"})," Within 30 days"]})]}),(0,n.jsx)(x,{})]})}function v(){return(0,n.jsxs)("div",{className:"lp-section",children:[(0,n.jsxs)("div",{className:"lp-intro",children:[(0,n.jsxs)("p",{children:['These Terms of Service ("Terms", "Agreement", "ToS", "Master Agreement") form the comprehensive, legally binding commercial contract between you, in your capacity as the customer of the Service ("Customer", "You", "Your", "Subscriber"), and ',s,' ("Company", "We", "Us", "Our", "Provider"), a joint-stock company duly incorporated and existing under the laws of the Republic of Turkey, with its registered office and principal place of business in Istanbul. The Agreement governs every aspect of your access to and use of the ',a,' platform ("Platform", "Service", "',a,'"), an enterprise softw
1are-as-a-service offering available at ',(0,n.jsx)("a",{href:"https://".concat(c),children:c})," and through associated APIs, subdomains, mobile-optimised interfaces, integrations, and command-line tooling. The Agreement constitutes the complete commercial framework between the parties: it defines the scope of service, the financial terms, the parties' respective rights and obligations, the allocation of risk and liability, the procedure for resolving disputes, and every other contractual element required to establish a stable, predictable, long-term business relationship."]}),(0,n.jsxs)("p",{children:["This Agreement does not exist in isolation. It is the apex of a structured stack of legal instruments, each addressing a distinct subject matter and operating in concert with the others to form the complete contractual envelope governing your use of the Service. The supporting instruments incorporated by reference into these Terms \u2014 and which you should review alongside this document \u2014 are the ",(0,n.jsx)("a",{href:"/privacy",children:"Privacy Policy"})," (which describes how personal data is collected, used, shared, secured, retained, and deleted, and which informs your data-protection rights as data subject); the ",(0,n.jsx)("a",{href:"/acceptable-use",children:"Acceptable Use Policy"})," (which prohibits specific categories of misuse such as spam, fraud, illegal content, infrastructure abuse, and violations of upstream Meta/Twilio policies); the ",(0,n.jsx)("a",{href:"/refund",children:"Refund Policy"})," (which details the circumstances in which refunds are available, the procedures for requesting them, and the statutory consumer-protection rights that overlay our contractual commitments); the ",(0,n.jsx)("a",{href:"/data-deletion",children:"Data Deletion Policy"})," (which sets out your right to erasure, the multi-stage deletion pipeline we operate, and the procedures for self-service or assisted deletion); the Data Processing Agreement (DPA) (which allocates the controller-processor responsibilities under GDPR, KVKK and analogous laws when you process personal data of your end-customers through the Platform); and, for Enterprise customers, any Order Form or Master Services Agreement that may modify or supplement these Terms with negotiated commercial conditions."]}),(0,n.jsx)("p",{children:"By accessing the Platform, registering for an account, purchasing a paid subscription, integrating with our APIs, or otherwise making use of the Service in any manner whatsoever \u2014 even merely browsing the marketing site beyond the public landing pages \u2014 you irrevocably acknowledge that you have read these Terms in full, that you understand their commercial and legal implications, and that you accept and agree to be bound by them as a complete and enforceable contract. Acceptance is electronic and does not require a wet-ink signature; under Turkish Law No. 5070 on Electronic Signatures, Law No. 6563 on Electronic Commerce, the EU eIDAS Regulation 910/2014, the US Electronic Signatures in Global and National Commerce Act (E-SIGN) of 2000, and the UK Electronic Communications Act 2000, click-through and conduct-based acceptance creates a binding contract enforceable in the same manner as a paper-and-ink agreement. We retain electronic logs of acceptance \u2014 the IP address, user-agent, timestamp, and the specific version of the Terms accepted \u2014 as evidence in the event of any future dispute about formation."}),(0,n.jsx)("p",{children:'If you are accepting these Terms on behalf of a company, partnership, corporation, limited liability company, governmental agency, non-profit organisation, university, or any other legal person (an "Entity"), you personally represent and warrant to us that you have full legal authority to bind that Entity to these Terms; that you have been duly authorised by the Entity\'s governing body, board of directors, partnership committee, or equivalent decision-making organ to execute this Agreement on its behalf; that the Entity has the legal capacity and corporate power to enter into this Agreement; that the Entity\'s acceptance of these Terms does not conflict with any other obligations, charters, bylaws, articles of incorporation, shareholder agreements, or other instruments to which the Entity is subject; and that any internal approvals, board resolutions, or regulatory consents required for the Entity to enter into this Agreement have been obtained. Where you accept on behalf of an Entity, the term "Customer," "You," and "Your" in these Terms refers to the Entity, and you and the Entity are each bound by these Terms. If you cannot make all of the foregoing representations honestly, you must not accept these Terms or use the Service on behalf of any Entity.'})]}),(0,n.jsx)(b,{}),(0,n.jsxs)("div",{className:"lp-toc",children:[(0,n.jsx)("h4",{children:"Table of Contents"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-1",children:"1. Agreement Formation & Parties"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-2",children:"2. Definitions"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-3",children:"3. Order of Precedence"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-4",children:"4. Service Description"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-5",children:"5. Eligibility"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-6",children:"6. Account Registration"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-7",children:"7. Account Security"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-8",children:"8. Subscription Plans"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-9",children:"9. Billing & Payment"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-10",children:"10. Taxes & Invoicing"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-11",children:"11. Price Changes"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-12",children:"12. Free Tier & Trials"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-13",children:"13. Credits & Usage"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-14",children:"14. Acceptable Use"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-15",children:"15. Customer Content"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-16",children:"16. Customer Data & DPA"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-17",children:"17. Intellectual Property"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-18",children:"18. Feedback License"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-19",children:"19. AI-Generated Content"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-20",children:"20. Third-Party Integrations"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-21",children:"21. Meta/WhatsApp Specific Terms"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-22",children:"22. Service Availability"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-23",children:"23. Support"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-24",children:"24. Beta Features"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-25",children:"25. Modifications to Service"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-26",children:"26. Termination by You"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-27",children:"27. Termination by Us"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-28",children:"28. Effect of Termination"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-29",children:"29. Warranties Disclaimer"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-30",children:"30. Limitation of Liability"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-31",children:"31. Indemnification"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-32",children:"32. Confidentiality"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-33",children:"33. Export Control"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-34",children:"34. Anti-Bribery"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-35",children:"35. Force Majeure"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-36",children:"36. Assignment"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-37",children:"37. Governing Law"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-38",children:"38. Dispute Resolution"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-39",children:"39. Class Action Waiver"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-40",children:"40. Miscellaneous"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-41",children:"41. Changes to Terms"})}),(0,n.jsx)("li",{children:(0,n.jsx)("a",{href:"#t-42",children:"42. Contact"})})]})]}),(0,n.jsx)("h2",{id:"t-1",children:"1. Agreement Formation & Parties"}),(0,n.jsxs)("p",{children:['This Agreement ("Terms of Service") is a legally binding contract formed between you, as the Customer, and ',s,", a legal entity duly organized and existing under the laws of the Republic of Turkey, with its registered principal place of business at ",o,", operating the ",a," software-as-a-service Platform. These Terms, together with any policies and supplemental agreements referenced herein, govern your access to and use of the Platform and all associated products, services, features, software, and applications offered by us. The formation of this Agreement does not require a handwritten signature; under Turkish law (Law No. 5070 on Electronic Signatures and Law No. 6563 on Electronic Commerce), as well as applicable EU and international e-commerce regulations, electronic acceptance through click-through consent, account creation, or continued use constitutes valid and enforceable contract formation."]}),(0,n.jsx)("p",{children:"The Agreement becomes effective between you and us upon the earliest occurrence of any of the following events, whichever comes first:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:'Your completion of the account registration process on our website, at which point you are presented with these Terms and required to affirmatively accept them (typically by clicking an "I Agree" checkbox or similar consent mechanism) before the account is created. Your registration timestamp is recorded as the effective date of the Agreement for that individual account.'}),(0,n.jsx)("li",{children:"Your first access to the Platform after these Terms become available, regardless of whether you have formally clicked through acceptance \u2014 meaning that the act of using the Platform with knowledge of these Terms constitutes implied acceptance and binds you to its provisions."}),(0,n.jsx)("li",{children:"Your first payment of subscription fees, usage-based charges, or any other amount owed for your use of the Platform, whether paid directly or via your authorized payment method on recurring auto-renewal."}),(0,n.jsx)("li",{children:"Your signing of a specific Order Form, Master Services Agreement (MSA), Data Processing Agreement (DPA), or other contract that references these Terms as the underlying framework governing your Platform subscription (most commonly applicable to Enterprise-tier customers with negotiated commercial terms)."}),(0,n.jsx)("li",{children:"Your integration with any of our APIs, webhooks, or developer tools, including programmatic creation of an account or consumption of API endpoints, which automatically subjects the authenticated account to these Terms."})]}),(0,n.jsx)("p",{children:'If you are accessing, registering for, or using the Service on behalf of a company, partnership, corporation, non-profit organization, governmental entity, or any other legal person (collectively, an "Entity"), you personally represent and warrant to us that: (a) you have full legal authority under the laws applicable to that Entity to bind the Entity to these Terms; (b) you have been duly authorized by the Entity\'s governing body, officers, or other appropriate decision-makers to execute this Agreement on its behalf; (c) the Entity has the legal capacity and corporate power to enter into this Agreement; and (d) the Entity\'s acceptance of these Terms does not conflict with any other obligations, charters, bylaws, or agreements to which the Entity is subject. In such cases, the term "Customer," "You," or "Your" in these Terms refers to the Entity, and both you personally (as the authorized representative) and the Entity are responsible for ensuring compliance with these Terms. If you are unable to make all of these representations honestly, you must not accept these Terms or use the Platform on behalf of an Entity.'}),(0,n.jsx)("h2",{id:"t-2",children:"2. Definitions"}),(0,n.jsx)("p",{children:"The terms defined below are used throughout this Agreement with the meanings ascribed to them in this Section, regardless of whether they appear capitalised or in lower case in any particular passage. Definitions are central to the proper interpretation of these Terms because they fix the precise scope of contractual rights and obligations and avoid the ambiguity that ordinary-language usage can introduce. Where a term is not defined here but is defined in the GDPR, KVKK, the Turkish Code of Obligations, or any applicable Order Form, the meaning given in that other instrument shall apply unless the context manifestly requires otherwise. Defined terms include the singular and plural forms, and references to one gender include all genders."}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Platform", "Service":'})," The ",a," SaaS platform, including all features, APIs, documentation, and related services."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Subscription":'})," A paid plan granting access to the Platform with specified feature sets and usage limits."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Order Form":'})," A written agreement (paper or electronic) referencing these Terms for Enterprise customers."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Content":'})," Any data, text, messages, images, audio, video, or other information submitted to or transmitted through the Platform."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Customer Content":'})," Content submitted by you, your employees, or end-customers via your account."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"End-User":'})," Your customer, prospect, or contact who communicates with your business through the Platform."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"API":'})," Our Application Programming Interfaces or those of integrated third-party services."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Fees":'})," All subscription, usage-based, and other charges payable by you."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Effective Date":'})," The date this Agreement enters into force for you (registration, payment, or Order Form signing)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"DPA":'})," Data Processing Agreement governing processor obligations."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Documentation":'})," User guides, API references, and support articles published by us."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Confidential Information":'})," Non-public information shared between the parties marked or reasonably understood as confidential."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:'"Meta Platforms":'})," Meta Platforms, Inc., including WhatsApp, Instagram, and Facebook."]})]}),(0,n.jsx)("h2",{id:"t-3",children:"3. Order of Precedence"}),(0,n.jsx)("p",{children:"The contractual relationship between you and us is documented in several distinct instruments \u2014 these Terms of Service, the Privacy Policy, the Acceptable Use Policy, the Refund Policy, the Data Processing Agreement, and (for Enterprise customers) one or more Order Forms or Master Services Agreements. Each instrument addresses a particular subject matter and operates in concert with the others. Occasional inconsistencies between documents are inevitable as they evolve at different cadences. To remove ambiguity in the rare cases where tw
1o instruments appear to address the same point with different language, the following order of precedence applies \u2014 the higher-listed instrument prevails to the extent of the inconsistency, but only as to the specific provision in conflict; all other terms in both instruments continue to apply unaffected:"}),(0,n.jsxs)("ol",{children:[(0,n.jsx)("li",{children:"Signed Order Form or Master Services Agreement (Enterprise only)"}),(0,n.jsx)("li",{children:"Data Processing Agreement (DPA)"}),(0,n.jsx)("li",{children:"These Terms of Service"}),(0,n.jsx)("li",{children:"Privacy Policy"}),(0,n.jsx)("li",{children:"Acceptable Use Policy"}),(0,n.jsx)("li",{children:"Other policies referenced herein"})]}),(0,n.jsx)("h2",{id:"t-4",children:"4. Service Description"}),(0,n.jsxs)("p",{children:[a," is an enterprise-grade Software-as-a-Service platform that combines multi-channel customer messaging, voice automation, marketing orchestration, and operational workflows in a single integrated environment. The Platform is delivered entirely over the public internet through web browsers and HTTP APIs; no on-premise installation is required. The Service is targeted at small, mid-market, and enterprise businesses that need to operate customer conversations and back-office processes at scale, with first-class support for the Turkish market and broader EU/MENA expansion. The set of features and integrations is summarised below for descriptive purposes; the authoritative current capability matrix is maintained on our public website and may be expanded from time to time. Nothing in this description constitutes a guarantee that any particular feature will remain available in its current form, and no commitment is made about a specific roadmap, release date, or future functionality except as expressly set out in a signed Order Form. Core capabilities include:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Multi-channel AI Chatbots:"})," WhatsApp Business, Instagram Messaging, Telegram, Facebook Messenger, Web Chat Widget."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"AI Voice Call Center:"})," Inbound/outbound automated voice calls with natural language understanding."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"AI Email Assistant:"})," Inbox integration, AI-drafted responses, automated triage."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Marketing Automation:"})," SMS campaigns, email blasts, segmentation, A/B testing."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Business Operations:"})," Appointments, orders, accounting, CRM, HR, project management."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"18 Specialized AI Employees:"})," Sales, support, HR, legal, accounting, social media, data analyst, fitness, real estate, health, education, reservation, tracking, feedback, onboarding, collection, project, tender."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Developer Tools:"})," REST API, webhooks, SDKs."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Admin & Analytics:"})," Dashboards, reports, audit logs."]})]}),(0,n.jsx)("p",{children:"We reserve the right to modify, add, or remove features at any time. Material changes affecting paid subscriptions will be communicated at least 30 days in advance."}),(0,n.jsx)("h2",{id:"t-5",children:"5. Eligibility"}),(0,n.jsx)("p",{children:"The Platform is intended for use by competent business users and is not designed for, marketed to, or made available to children, individuals lacking legal capacity, sanctioned persons, or persons whose use of communications technology is restricted by court order or applicable regulation. The eligibility requirements below operate as continuing representations \u2014 by using the Service you represent that they are true at the time of registration and that you will notify us promptly if they cease to be true at any subsequent point. We may, at any time and at our reasonable discretion, request documentary evidence of eligibility (proof of age, business registration certificate, ultimate beneficial ownership disclosure, sanctions screening declaration) and may suspend access pending verification. Submission of false eligibility information is a material breach of this Agreement and grounds for immediate termination without refund."}),(0,n.jsx)("p",{children:"To use the Platform, you must:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Be at least 18 years old (or 16 in certain EU jurisdictions with parental consent)."}),(0,n.jsx)("li",{children:"Have legal capacity to enter into a binding contract in your jurisdiction."}),(0,n.jsx)("li",{children:"Not be a resident of or operate from any country subject to US, EU, UK, or UN sanctions."}),(0,n.jsx)("li",{children:"Not be on any government denied-parties list (e.g., OFAC SDN List, EU Consolidated List)."}),(0,n.jsx)("li",{children:"Represent a legitimate business or operate for legitimate business purposes."})]}),(0,n.jsx)("h2",{id:"t-6",children:"6. Account Registration"}),(0,n.jsx)("p",{children:"Account creation is the gateway through which all other rights and obligations under this Agreement attach to a
1specific identifiable customer. We therefore impose certain minimum information-quality and behavioural standards on the registration process. Accurate registration data is critical not only for billing, support, and lifecycle communications, but also for the integrity of our anti-abuse, fraud-prevention, and Know-Your-Customer (KYC) processes \u2014 particularly relevant where the Platform integrates with regulated financial services (Paddle, payment processors) and regulated communication channels (Meta WhatsApp, Twilio voice/SMS) that themselves impose verification obligations on us as a Business Solution Provider."}),(0,n.jsx)("p",{children:"You agree to:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Provide accurate, complete, and current information during registration."}),(0,n.jsx)("li",{children:"Promptly update account information when it changes."}),(0,n.jsx)("li",{children:"Use a valid email address you control."}),(0,n.jsx)("li",{children:"Select a secure password (minimum 8 characters, mix of cases, numbers, and symbols recommended)."})]}),(0,n.jsx)("p",{children:"We reserve the right to reject applications, suspend accounts, or terminate accounts providing false or misleading information."}),(0,n.jsx)("h2",{id:"t-7",children:"7. Account Security"}),(0,n.jsxs)("p",{children:["Account security is a shared responsibility between you and us. While we implement robust technical and organizational security measures to protect the Platform infrastructure (as detailed in our ",(0,n.jsx)("a",{href:"/privacy",children:"Privacy Policy"})," Section 15), the security of your specific account fundamentally depends on how you manage your credentials and configure your access controls. An account takeover can have severe consequences \u2014 loss of customer data, unauthorized messaging to your end-customers, fraudulent charges, reputational damage, and potential legal liability. Therefore, we require you to take the following account security obligations seriously:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"You are solely responsible for maintaining the strict confidentiality of your account credentials, including but not limited to your username, password, API keys, OAuth access tokens, webhook signing secrets, session cookies, and any multi-factor authentication codes or backup recovery codes. These credentials should never be stored in plain text, committed to public repositories, shared via insecure channels (email, chat), or written down in accessible locations."}),(0,n.jsx)("li",{children:"You are responsible for all activities, transactions, messages sent, charges incurred, changes made, and consequences of any actions that occur under your account, regardless of whether such activities were initiated by you personally, by authorized team members, by unauthorized third parties who obtained your credentials, or by automated systems you have connected to your account. This responsibility underscores the importance of strong credential hygiene."}),(0,n.jsx)("li",{children:"You must NOT share your credentials with unauthorized parties under any circumstances, including family members, friends, contractors outside your organization, or any party not properly invited to your workspace as a team member through our invitation system. For legitimate team collaboration, create separate user accounts for each person with appropriate role-based permissions rather than sharing login credentials."}),(0,n.jsxs)("li",{children:["You must immediately notify us at ",(0,n.jsx)("a",{href:"mailto:".concat(h),children:h})," of any actual or suspected unauthorized access, security breach, compromised credential, or other security incident affecting your account. Prompt notification allows us to help contain the damage, reset credentials, review audit logs, and potentially trigger our incident response procedures. Delayed reporting significantly limits our ability to assist."]}),(0,n.jsx)("li",{children:"We strongly recommend that you enable Multi-Factor Authentication (MFA) using a time-based one-time password (TOTP) authenticator app such as Google Authenticator, Authy, or 1Password, or using a FIDO2 hardware security ke
1y such as YubiKey for the strongest protection. MFA provides defense-in-depth: even if your password is compromised, attackers cannot access your account without the second factor."}),(0,n.jsxs)("li",{children:['Administrative accounts (users with "Owner" or "Admin" roles) are ',(0,n.jsx)("strong",{children:"required"})," to enable MFA under our security policy. For Enterprise-tier customers, MFA enforcement is mandatory for all account users under contractual terms. Failure to enable MFA on admin accounts may result in restricted access to sensitive features or account suspension after reasonable notice."]}),(0,n.jsx)("li",{children:"You should always log out of your account when finished, especially when using shared, public, or non-personal computers (such as those in internet cafes, libraries, or hotel business centers). Closing the browser window does not necessarily end your session."}),(0,n.jsxs)("li",{children:["Use strong, unique passwords for your ",a," account that are not reused across other services. We recommend using a reputable password manager to generate and store complex passwords. Avoid predictable passwords incorporating your name, company, or common words."]}),(0,n.jsxs)("li",{children:["Be vigilant against phishing attacks. We will never ask for your password via email, phone, or chat. Verify the authenticity of emails claiming to be from us by checking the sender domain and contacting ",(0,n.jsx)("a",{href:"mailto:".concat(h),children:h})," if in doubt."]}),(0,n.jsx)("li",{children:"Regularly review your account's login activity, active sessions, and audit logs for any suspicious entries. Our dashboard provides these security-relevant logs so you can detect anomalies."}),(0,n.jsx)("li",{children:"Promptly remove access for team members who leave your organization by deactivating their user accounts in your workspace settings. Stale accounts are a common attack vector."})]}),(0,n.jsx)("h2",{id:"t-8",children:"8. Subscription Plans"}),(0,n.jsx)("p",{children:"Our commercial model is based on tiered subscriptions plus elastic usage-based components. The tiered structure is intended to align price with the value and operational footprint that different customer profiles place on the Platform \u2014 a small business piloting WhatsApp automation has very different needs from a multi-country enterprise running concurrent campaigns across thousands of agents. Each tier bundles a defined set of features, included usage allowances (AI credits, conversations, voice minutes), permitted integrations, and support service levels. Beyond the included allowances, additional usage is billed at the published overage rates or absorbed into pre-purchased credit packs. The current up-to-date tier matrix, feature-by-feature comparison, regional pricing, applicable taxes, and any promotional discounts are published on our website and supersede any earlier descriptions in marketing materials, blog posts, or sales collateral. Subscription tiers may be added, renamed, deprecated, or restructured from time to time; existing customers will be migrated to a comparable replacement tier (or grandfathered) where commercially feasible:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Free tier:"})," Limited features, capped usage, for evaluation only."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Growth plan:"})," Full-featured for SMBs, 2.990 TRY/month."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Enterprise:"})," Custom pricing, advanced features, SLA, dedicated support."]})]}),(0,n.jsx)("p",{children:"Current pricing, features, and usage limits are published on our website. Pricing may vary by region, currency, and promotional campaigns."}),(0,n.jsx)("h2",{id:"t-9",children:"9. Billing & Payment"}),(0,n.jsxs)("p",{children:["Payment processing is the lifeblood of any SaaS relationship and we have therefore engineered our billing stack with reliability, compliance, and customer transparency as primary design goals. We do not store, transmit, or process raw payment-card numbers, CVVs, or bank-account credentials on our own infrastru
1cture; instead, we have integrated with Paddle.com Market Ltd., a PCI-DSS Level 1 certified Merchant of Record (MoR), which assumes full responsibility for cardholder-data security, sales-tax determination across more than one hundred jurisdictions, fraud screening, and chargeback handling. The MoR model means Paddle is the legal seller of record on your invoice in many regions, while ",s," remains the contractual counterparty under these Terms. The provisions below describe how billing operates in practice and the standards we apply to dunning, retries, and account state transitions following billing events:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Payment processor:"})," All payments are processed by Paddle.com Market Ltd. (PCI-DSS Level 1 certified). Paddle acts as the Merchant of Record (MoR)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Billing cycles:"})," Monthly or annual, selected at purchase."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Auto-renewal:"})," Subscriptions automatically renew unless cancelled before the end of the current period. You authorize us to charge your payment method on renewal."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Payment methods:"})," Credit/debit cards (Visa, Mastercard, American Express), local methods via Paddle (iDEAL, SEPA, Apple Pay, Google Pay)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Currency:"})," Turkish Lira (TRY), US Dollar (USD), or Euro (EUR) based on your region."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Upfront billing:"})," Subscription fees are charged upfront for each billing period."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Usage-based fees:"})," Charged monthly in arrears (SMS, voice minutes, API overages)."]})]}),(0,n.jsx)("h3",{children:"Failed Payment Retry Schedule:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Day 1: First attempt on renewal date."}),(0,n.jsx)("li",{children:"Day 3: Second attempt + email notification."}),(0,n.jsx)("li",{children:'Day 7: Third attempt + "payment required" banner in dashboard.'}),(0,n.jsx)("li",{children:"Day 14: Fourth attempt + feature restrictions."}),(0,n.jsx)("li",{children:"Day 21: Account suspension."}),(0,n.jsx)("li",{children:"Day 45: Account marked for deletion (data retained 30 more days)."})]}),(0,n.jsx)("h2",{id:"t-10",children:"10. Taxes & Invoicing"}),(0,n.jsx)("p",{children:"Indirect taxation in cross-border SaaS is genuinely complex: VAT, GST, sales tax, withholding tax, and digital-services tax interact differently in each jurisdiction, and the place-of-supply rules for B2B vs B2C differ even within the same country. We use Paddle's MoR architecture precisely because it solves the multi-jurisdictional tax problem at scale \u2014 Paddle calculates, collects, remits, and reports indirect taxes in over one hundred jurisdictions on our behalf. The key practical points for your tax planning and accounting reconciliation are summarised below; for jurisdiction-specific or complex situations (reverse-charge B2B supplies, free-zone exemptions, withholding-tax credits, transfer-pricing) you should consult your own tax advisor or accountant \u2014 nothing in this Section constitutes tax advice."}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"All prices are exclusive of taxes unless stated otherwise."}),(0,n.jsx)("li",{children:"VAT, GST, sales tax, or equivalent is calculated and charged based on your billing location."}),(0,n.jsx)("li",{children:"Turkish customers: KDV (Turkish VAT) applies at the current rate."}),(0,n.jsx)("li",{children:"EU customers: VAT applies per your country's rate (MOSS compliant)."}),(0,n.jsx)("li",{children:"Tax-exempt organizations must provide valid exemption certificates."}),(0,n.jsx)("li",{children:"Electronic invoices (e-fatura) are issued for each billing cycle and available in your dashboard."}),(0,n.jsx)("li",{children:"Turkish business customers receive Turkish e-ar\u015fiv faturas\u0131 per legal requirements."})]}),(0,n.jsx)("h2",{id:"t-11",children:"11. Price Changes"}),(0,n.jsxs)("p",{children:["The economics of SaaS \u2014 particularly when integrated
1with third-party messaging providers (Meta WhatsApp), telephony providers (Twilio), AI inference providers (OpenAI), and cloud infrastructure (AWS) \u2014 are subject to upstream cost movements that we periodically need to reflect in customer-facing pricing. Examples include Meta's adjustments to WhatsApp conversation pricing per category and country, Twilio's per-minute and per-message rate changes, OpenAI model-pricing updates, and macroeconomic FX swings between TRY, EUR, and USD. We commit not to surprise you with such changes: any modification to recurring subscription pricing, included quotas, or overage rates that adversely affects you will be communicated in writing (email plus in-app notification) at least ",(0,n.jsx)("strong",{children:"thirty (30) days"})," before the change takes effect. The notice will identify the changed item, the prior and new amounts, the effective date, and the rationale. The new pricing applies to your next billing cycle that begins after the notice period elapses; mid-cycle changes are not made."]}),(0,n.jsx)("p",{children:"You retain the right to terminate your subscription, with no early-termination penalty, at any time before the new pricing takes effect \u2014 which constitutes the practical mechanism by which acceptance vs rejection of a price change is signalled. If you do not cancel, your continued use of the Platform after the effective date constitutes acceptance of the revised pricing. For Enterprise customers under signed Order Forms, price changes during the committed term are governed by the Order Form rather than this Section, and typically require renegotiation at renewal rather than during the term. Pass-through usage charges (Meta conversation fees, Twilio per-message fees) are not subject to the 30-day notice period because they reflect upstream prices that are themselves subject to change with shorter notice from the underlying provider; we will pass through such changes as soon as they take effect upstream."}),(0,n.jsx)("h2",{id:"t-12",children:"12. Free Tier & Trials"}),(0,n.jsx)("p",{children:"We offer a perpetual free tier and may from time to time run time-limited free trials, promotional credits, or pilot programmes. The purpose of these zero-cost offerings is to let prospective customers genuinely evaluate the Platform's fit for their use case without financial commitment, and to enable students, researchers, and early-stage developers to learn how to integrate with our APIs. The free tier is not, however, a substitute for a paid subscription in production, and we reserve the right to limit it in any way necessary to prevent abuse, protect the integrity of our integrations with upstream providers (notably Meta and Twilio, who themselves impose volume restrictions), and contain operational cost. Free tier accounts:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:'Are provided "AS IS" without warranty.'}),(0,n.jsx)("li",{children:"May have rate limits, feature restrictions, and data retention caps."}),(0,n.jsx)("li",{children:"May be deleted after 90 days of inactivity."}),(0,n.jsx)("li",{children:"May display promotional content or require attribution."}),(0,n.jsx)("li",{children:"Are not eligible for SLA or priority support."})]}),(0,n.jsx)("h2",{id:"t-13",children:"13. Credits & Usage Limits"}),(0,n.jsx)("p",{children:'The Platform meters consumption of variable-cost resources \u2014 primarily AI inference (calls to OpenAI\'s GPT models), outbound SMS messages, voice-call minutes, WhatsApp conversations, and certain advanced analytics \u2014 through an internal unit called the "credit." Credits abstract over the underlying provider pricing so that you experience a single, predictable unit of consumption rather than separate denominations for tokens, messages, and minutes. Credit consumption is tracked in near real time and visible in your billing dashboard. We deliberately price credits at a markup (typically 2x cost-plus) over our blended upstream cost so that we can absorb minor fluctuations in upstream pricing without immediately repricing customers, fund support and infrastru
1cture overhead, and invest in product development. The provisions below set out how credits work, when they expire, and what cannot be done with them:'}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Subscriptions include a monthly allocation of AI credits and messaging quotas."}),(0,n.jsx)("li",{children:"Unused credits expire at the end of each billing cycle (do not roll over unless specified)."}),(0,n.jsx)("li",{children:"Overage charges apply beyond the subscription's included limits."}),(0,n.jsx)("li",{children:"Prepaid credit packages are available and valid for 12 months from purchase."}),(0,n.jsx)("li",{children:"Credits cannot be refunded, transferred between accounts, or exchanged for cash."})]}),(0,n.jsx)("h2",{id:"t-14",children:"14. Acceptable Use"}),(0,n.jsx)("p",{children:"Your use of the Platform must at all times comply with these Terms, our Acceptable Use provisions, all applicable laws and regulations in your jurisdiction and those of your end-customers, and the terms of any third-party services integrated through the Platform (particularly Meta/WhatsApp, Instagram, Telegram, Twilio, and others). The comprehensive list of prohibited uses below is not exhaustive \u2014 it represents clearly established categories of abuse that trigger immediate enforcement action. We reserve the right to determine in our reasonable discretion whether any specific use violates the spirit or letter of these restrictions, even if not explicitly enumerated. You are prohibited from using the Platform to:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Send unsolicited bulk messages (spam) in violation of anti-spam laws"})," including but not limited to the US CAN-SPAM Act, Canada's CASL, the EU ePrivacy Directive and national implementations (such as the UK PECR), the Turkish Law No. 6563 on Electronic Commerce, and similar legislation worldwide. This includes sending commercial messages to recipients who have not given explicit, recorded opt-in consent; sending to lists purchased from third-party data brokers; continuing to message recipients who have opted out; or disguising the commercial nature of messages to evade filters."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Violate Meta/WhatsApp Business Messaging Policy"}),", including failure to obtain explicit opt-in before messaging; ignoring the 24-hour messaging window rule by sending freeform content outside the window (you must use approved Message Templates instead); submitting templates with misleading category designations (e.g., marketing content disguised as utility); sending from WhatsApp numbers with consistently low quality ratings; or attempting to bypass Meta's quality control systems."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Transmit illegal, harmful, threatening, abusive, defamatory, obscene, pornographic, hateful, racially or ethnically offensive content"})," through any channel, including content that violates child safety laws, content designed to harass or intimidate specific individuals, content promoting terrorism or violent extremism, content depicting or promoting child sexual abuse (CSAM \u2014 which we are legally required to detect and report), or any content that would be unlawful in the jurisdictions where it is sent or received."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Infringe intellectual property rights"})," of any third party, including copyrights, trademarks, patents, trade secrets, rights of publicity, or moral rights. Do not transmit copyrighted media without permission, impersonate other businesses or brands, use trademarks without authorization, or share confidential information belonging to others."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Attempt to reverse engineer, decompile, disassemble, hack, penetration test (without written consent), scrape, or otherwise disrupt the Platform"}),", our infrastructure, or our sub-processors' systems. This includes circumventing any security mechanisms, access controls, encryption, rate limits, or authentication systems; exploiting bugs or vulnerabilities rather than responsibly disclosing them; using automated tools to discover endpoints or attack surfaces; attempting denial-of-service attacks; or creating derivative works of the Platform software."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Use the Platform for fraud, phishing, scamming, identity theft, money laundering, tax evasion, or any financial crime"}),", including but not limited to impersonating legitimate businesses to
1steal credentials; sending messages designed to trick recipients into revealing sensitive information; operating Ponzi schemes, pyramid schemes, or get-rich-quick scams; laundering proceeds of crime; or evading currency controls."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Operate in prohibited or regulated industries without prior written approval from our trust and safety team"}),", including but not limited to online gambling and betting; adult content or services including escort services; sale of weapons, firearms, ammunition, or explosives; illegal drugs or controlled substances; pharmaceutical sales without proper licensing; tobacco and e-cigarettes (restricted in many markets); political campaigning and lobbying (subject to strict regulatory frameworks); dating and romance services (subject to fraud risks); multi-level marketing (MLM) programs; cryptocurrency trading, ICOs, or speculative investment products; debt collection (regulated by FDCPA and similar laws); and regulated professional services (legal, medical, financial advice)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Circumvent, bypass, or manipulate rate limits, usage quotas, billing systems, or feature restrictions"})," imposed by your subscription tier or the Platform's architecture, including creating multiple free-tier accounts to avoid paid tier requirements, sharing accounts across organizations, using VPNs or proxies to obscure geographic billing jurisdiction, reverse-engineering internal APIs, or automating actions designed to inflate reported metrics."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Use AI-generated content in ways that deceive users about the automated nature of the interaction"}),' when the user has explicitly asked whether they are talking to a human or AI. While it is generally acceptable for AI to handle routine inquiries without explicit disclosure, you must provide truthful answers if a user directly asks "Am I talking to a bot?" or similar questions. You also must not misrepresent AI-generated content as being written by specific human authors.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Upload, transmit, or distribute malicious code"})," including viruses, worms, trojans, ransomware, spyware, adware, rootkits, or any other form of malware or unwanted software that could harm recipients' devices or data."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Interfere with or disrupt the Platform's normal operation"})," or other users' ability to use the Platform, including through spam, resource exh
1austion, coordinated attacks, intentionally triggering false positives in moderation systems, or manipulating shared rankings/metrics."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Violate privacy or data protection laws"})," applicable to your end-customers, including processing personal data without a lawful basis under GDPR/KVKK; failing to provide required privacy notices; collecting sensitive categories of data without appropriate safeguards; transferring personal data internationally without proper mechanisms; or ignoring data subject rights requests."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Impersonate any person or entity"})," or falsely state or otherwise misrepresent your affiliation with a person or entity. Do not create accounts using names of real people without authorization, fake businesses, or pretend to be ",a," staff."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Use the Platform to collect or harvest personal data"})," of other users or end-customers beyond what is strictly necessary for your legitimate business purpose, or to build third-party databases, mailing lists, or audiences for resale."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Export the Platform or any related technology"})," in violation of US, EU, UK, Turkish, or other applicable export control laws and sanctions regulations (including US OFAC restrictions on trade with sanctioned countries, organizations, and individuals)."]})]}),(0,n.jsx)("p",{children:"Violation of any of these prohibited uses may result in, at our sole discretion: a written warning with an opportunity to cure; temporary feature restrictions or rate limit reductions; suspension of your account pending investigation; permanent termination of your account without refund; forfeiture of remaining credits, prepaid balances, or service commitments; reporting of the conduct to Meta, Twilio, payment processors, or law enforcement authorities as appropriate; and civil or criminal prosecution in extreme cases. Violations that endanger the integrity of our integration with Meta, Twilio, or other critical upstream partners may additionally result in immediate termination without notice, because continued service to such customers puts every other customer on the Platform at risk."}),(0,n.jsx)("h2",{id:"t-15",children:"15. Customer Content"}),(0,n.jsx)("p",{children:'"Customer Content" means everything you, your authorised users, and your end-customers contribute to the Platform \u2014 message text, attachments, audio, video, contact records, CRM notes, knowledge-base articles, AI prompts and outputs, configuration files, custom code, integration credentials, business logic, and any other data submitted to or generated through the Service. Customer Content is the heart of why our Platform is valuable to you, and we treat it accordingly. We do not assert any ownership over Customer Content; we do not exploit it for our commercial purposes; and we do not use it to train AI models. The narrowly-scoped licence we ask for below exists solely so that the technical operation of the Platform \u2014 storing your data on cloud infrastructure, transmitting messages on your behalf, indexing content for search, generating backups, displaying it in your dashboard \u2014 is legally permitted. Without that licence, the very act of running the Service would arguably be unlicensed copying. The licence terminates when your account terminates, subject to short-term retention for backups and any ongoing legal-hold obligations described in the Privacy Policy:'}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Ownership:"})," You retain all ownership rights to Customer Content."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"License to Us:"})," You grant us a worldwide, non-exclusive, royalty-free, limited license to host, transmit, store, process, and back up Customer Content solely to provide the Service."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Responsibility:"})," You are solely responsible for the legality, accuracy, and appropriateness of Customer Content."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Consent obligations:"})," You must obtain all necessary consents from your End-Users before processing their data through the Platform."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Data portability:"})," You may export Customer Content at any time in standard formats (JSON, CSV)."]})]}),(0,n.jsx)("h2",{id:"t-16",children:"16. Customer Data & DPA"}),(0,n.jsx)("p",{children:'Where the Customer Content you process through the Platform contains personal data of identified or identifiable individuals (typically your end-customers, employees, or business contacts), data-protection law applies in addition to ordinary contract law. Under GDPR, KVKK, UK GDPR, and analogous frameworks, the parties to a personal-data flow assume statutorily-defined roles: the entity that determines the purposes and means of processing is the "controller" and bears primary regulatory responsibility, while any entity that processes personal data on behalf of the controller is a "processor" and bears narrower, contractually-channeled obligations. In our relationship, you sit closest to the data subject and decide what messages to send, what data to collect, and for what purposes \u2014 which means you are almost always the controller. We provide the technical infrastru
1cture that executes your instructions \u2014 which means we are almost always the processor. The Data Processing Agreement (DPA) referenced below is the legally-required instrument that allocates these obligations in detail:'}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:["You are the ",(0,n.jsx)("strong",{children:"Data Controller"})," and we are the ",(0,n.jsx)("strong",{children:"Data Processor"}),"."]}),(0,n.jsxs)("li",{children:['Our Data Processing Agreement ("DPA"), available at ',(0,n.jsx)("a",{href:"/dpa",children:"/dpa"}),", is incorporated into these Terms."]}),(0,n.jsx)("li",{children:"You warrant that you have a lawful basis under GDPR, KVKK, or other applicable law to process End-User data."}),(0,n.jsx)("li",{children:"You are responsible for obtaining required consents and providing required notices to End-Users."})]}),(0,n.jsx)("h2",{id:"t-17",children:"17. Intellectual Property"}),(0,n.jsxs)("p",{children:["The Platform represents many years of design, software engineering, AI prompt engineering, integration work, brand investment, and customer-feedback iteration. Substantial sums have been spent on its creation and on the third-party licences that enable certain components. Your subscription buys you the right to ",(0,n.jsx)("em",{children:"use"})," the Platform as a service for the duration of your subscription, in accordance with these Terms \u2014 it does not buy or transfer to you any ownership stake, source-code rights, or other underlying intellectual property. All rights, title, and interest in the Platform, software, designs, trademarks, logos, documentation, AI models we develop, training datasets we curate, prompts and prompt chains we author, look-and-feel, user-interface design, branding, and all related materials, including all derivative works of the foregoing, are and shall remain the exclusive property of ",s," and its licensors, regardless of who happens to suggest a feature or report a bug. To preserve these rights, you agree not to:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Copy, modify, create derivative works, or redistribute any part of the Platform."}),(0,n.jsx)("li",{children:"Reverse engineer, decompile, or disassemble the Platform."}),(0,n.jsx)("li",{children:"Remove or alter proprietary notices, trademarks, or logos."}),(0,n.jsx)("li",{children:"Use our trademarks, logos, or branding without prior written consent."}),(0,n.jsx)("li",{children:"Access or use the Platform to build a competing product or benchmark against competitors without consent."})]}),(0,n.jsx)("h2",{id:"t-18",children:"18. Feedback License"}),(0,n.jsxs)("p",{children:["Customer feedback \u2014 feature ideas, bug reports, performance observations, design critiques, integration suggestions, AI prompt improvements, market intelligence \u2014 is one of our most valuable inputs and we actively welcome it. To remove any legal friction or unintended encumbrance that might otherwise discourage us from incorporating a great idea, this Section establishes a clean licensing rule: when you choose to share feedback with us through any channel (email, support ticket, in-app feedback widget, calls with sales or success teams, conference conversations, social media), you grant ",s," a worldwide, perpetual, irrevocable, fully paid-up, royalty-free, sublicensable, transferable licence to use, copy, modify, adapt, translate, distribute, publicly display, publicly perform, create derivative works of, incorporate into the Platform, and otherwise commercialise that feedback for any purpose, without any obligation to compensate, credit, attribute, or notify you. You retain whatever ownership rights you had before sharing \u2014 this licence does not transfer ownership \u2014 but the licence is broad enough that we can act on the feedback without further permission. You also waive, to the extent permitted by law, any moral rights or rights of attribution in the feedback. If your feedback embeds confidential information, please mark it as such; otherwise, we treat it as non-confidential and free to use."]}),(0,n.jsx)("h2",{id:"t-19",children:"19. AI-Generated Content"}),(0,n.jsxs)("p",{children:["A defining feature of ",a,' is that large portions of customer interactions can be handled by configurable AI agents \u2014 chatbots, voice agents, AI-drafted email responses, summarisers, and a library of eighteen specialised "AI Employees" tuned to specific business functions. These agents are powered by foundation models from OpenAI and other AI providers, augmented with our own prompt engineering, retrieval pipelines, guardrails, and post-processing. AI is a powerful but probabilistic technology: the same input may yield slightly different outputs across calls, factual claims may be fabricated ("hallucinated"), reasoning may be flawed, and outputs may reflect biases present in the underlying training data. The provisions below clarify the legal status of AI outputs, the residual responsibility you retain when deploying AI in customer-facing contexts, and our commitments around training-data isolation:']}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:'The Platform uses AI models (including OpenAI GPT) to generate responses. AI-generated content is provided "AS IS" without warranty of accuracy, completeness, or fitness for purpose.'}),(0,n.jsx)("li",{children:"You are responsible for reviewing AI-generated content before relying on it for business-critical decisions."}),(0,n.jsx)("li",{children:"You must NOT represent AI-generated responses as coming from a human when a user has explicitly asked if they are talking to a human/AI."}),(0,n.jsx)("li",{children:"Ownership of AI outputs follows the terms of the underlying AI provider (OpenAI, etc.)."}),(0,n.jsx)("li",{children:"We do NOT use your data to train AI models. Your data is only sent for inference and is subject to OpenAI's Zero Data Retention for enterprise accounts."}),(0,n.jsx)("li",{children:'AI may produce inaccurate or fabricated content ("hallucinations"). You must verify critical information.'})]}),(0,n.jsx)("h2",{id:"t-20",children:"20. Third-Party Integrations"}),(0,n.jsx)("p",{children:"The Platform achieves a large portion of its functional surface through integrations with carefully-selected third-party providers \u2014 channels (Meta, Telegram, Twilio), AI inference (OpenAI), payments (Paddle), infrastru
1cture (AWS, Cloudflare), email delivery (SendGrid, Mailgun), browser automation (Browserless), and more. While we have negotiated and continue to maintain commercial and technical relationships with each provider, your use of features powered by those integrations is necessarily also subject to the provider's own terms and policies, which we cannot modify on your behalf. Where Meta, for example, changes its WhatsApp Business Messaging Policy, the change is effective immediately as a matter of Meta's relationship with us and our customers, and we are required to flow it through. The integration list below is illustrative \u2014 please consult our public website for the current authoritative list and the full text of each provider's terms \u2014 and acceptance of these Terms includes your acknowledgement that the third-party terms below additionally apply to your use of the relevant features:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Meta (WhatsApp, Instagram, Facebook):"})," ",(0,n.jsx)("a",{href:"https://www.facebook.com/terms.php",target:"_blank",rel:"noreferrer",children:"Terms of Service"}),", ",(0,n.jsx)("a",{href:"https://www.whatsapp.com/legal/business-policy",target:"_blank",rel:"noreferrer",children:"WhatsApp Business Policy"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Telegram:"})," ",(0,n.jsx)("a",{href:"https://telegram.org/tos",target:"_blank",rel:"noreferrer",children:"Terms of Service"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Twilio:"})," ",(0,n.jsx)("a",{href:"https://www.twilio.com/legal/tos",target:"_blank",rel:"noreferrer",children:"Terms"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Paddle:"})," ",(0,n.jsx)("a",{href:"https://www.paddle.com/legal/terms",target:"_blank",rel:"noreferrer",children:"Merchant Agreement"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"OpenAI:"})," ",(0,n.jsx)("a",{href:"https://openai.com/policies/terms-of-use",target:"_blank",rel:"noreferrer",children:"Terms"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Google:"})," ",(0,n.jsx)("a",{href:"https://policies.google.com/terms",target:"_blank",rel:"noreferrer",children:"Terms"})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"AWS:"})," ",(0,n.jsx)("a",{href:"https://aws.amazon.com/agreement",target:"_blank",rel:"noreferrer",children:"Customer Agreement"})]})]}),(0,n.jsx)("p",{children:"We are not responsible for modifications to, unavailability of, or issues with third-party services beyond our reasonable control."}),(0,n.jsx)("h2",{id:"t-21",children:"21. Meta/WhatsApp-Specific Terms"}),(0,n.jsxs)("p",{children:["Because ",a," is an integrator of Meta's WhatsApp Business API, Instagram Messaging API, and Facebook/Meta advertising platforms, your use of those features on our Platform is subject not only to these Terms but also to Meta's own policies and contractual requirements. These Meta-specific obligations flow through to you as our customer and, in many cases, cannot be modified or waived by us because they are imposed by Meta on all their platform integrators. Violations of Meta's policies can result in Meta imposing restrictions or terminating access not only for the offending customer but potentially for all customers on our integration \u2014 which is why we enforce these obligations strictly. The following provisions specifically apply to your use of Meta-integrated features:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Direct relationship with Meta:"})," WhatsApp Business API usage operates under a tripartite relationship between you, us, and Meta. Depending on your onboarding flow (Embedded Signup, direct WABA provisioning, or BSP provisioning), you may be required to directly accept Meta's Platform Terms, Developer Policies, and WhatsApp Business Messaging Policy. We facilitate this acceptance but cannot waive or modify Meta's requirements. Your continued use of WhatsApp features through our Platform constitutes ongoing acknowledgment of Meta's terms."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Explicit opt-in from every End-User:"})," Before sending a WhatsApp message to any End-User, you must have collected their explicit, documented consent to receive messages from your business on WhatsApp. Valid consent methods include: a checked (not pre-checked) consent box on your website or application; a clear written affirmative action (signing a form indicating consent); a verbal consent obtained and documented in your CRM; or the End-User messaging your business first (which implies consent for the duration of the resulting conversation, though not for future unrelated campaigns). Consent records must be retained for at least three years as proof against complaints."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"24-hour messaging window strictly enforced:"})," Meta's API technically prevents and we also programmatically enforce the rule that freeform messages (any non-template content) may only be sent within 24 hours of the End-User's most recent inbound message. Outside this window, only approved Message Templates can be sent. Attempts to circumvent this by prompting users with \"please reply to this message to keep in touch\" before sending marketing are considered abuse and may trigger enforcement. The 24-hour window resets with each new inbound message from the End-User."]}
1),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Message Templates submission and compliance:"})," You are responsible for authoring Message Templates that accurately represent your intended use case, submitting them through our dashboard for Meta's approval, categorizing them correctly (Utility, Authentication, or Marketing), and not misrepresenting promotional content as non-promotional to evade Marketing category pricing or restrictions. Meta may reclassify your templates retroactively; we will pass through any such changes. Rejected templates should be revised based on feedback, not resubmitted unchanged."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Quality Rating monitoring and response:"})," Meta assigns a Quality Rating (Green/Yellow/Red) to each of your WhatsApp Business phone numbers based on End-User feedback (block and report rates). Ratings directly affect your messaging tier (how many unique recipients you can message per day), and consistently low ratings result in progressive restrictions up to and including phone number suspension. You agree to monitor your Quality Rating through our dashboard, respond to drops proactively (by reducing volume, improving opt-in quality, or pausing campaigns), and accept that we may impose temporary restrictions on your account to protect both your number and our broader integration with Meta."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Prohibited content categories:"})," Meta prohibits certain content entirely and restricts others to pre-authorized businesses. Prohibited entirely: illegal drugs, weapons and firearms, adult services and pornography, deceptive schemes, content promoting violence or hate. Restricted (require Meta approval and often geographic limits): pharmaceuticals, online gambling, tobacco and alcohol, dating services, financial services and cryptocurrencies, political advertising. You must not attempt to bypass these restrictions; violations may result in immediate termination."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Customer matching and audience targeting compliance:"})," For features involving uploading phone numbers to Meta for Click-to-WhatsApp (CTWA) advertising, lookalike audiences, or Custom Audiences, you must have obtained legally valid consent to share those numbers with Meta for advertising purposes, understand that Meta hashes phone numbers before matching (but the upload itself is a data transfer), and comply with Meta's Custom Audiences Terms including restrictions on use of sensitive audience segments."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"WhatsApp conversation pricing pass-through:"})," Meta charges for WhatsApp conversations (not individual messages), with pricing varying by End-User country, conversation category (Service, Utility, Authentication, Marketing), and other factors. These charges are passed through to you at cost, often bundled with our service charges, and displayed in your billing dashboard. Meta's pricing may change; we will pass through changes with reasonable notice."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Template category reassignments:"})," Meta periodically reviews templates and may reassign their category (for example, reclassifying a template from Utility to Marketing). This can affect pricing. You agree to accept Meta's classifications as final, though we will help you resubmit revised templates if appropriate."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Compliance audits and cooperation:"})," Meta may audit Business Solution Providers (BSPs) periodically. You agree to cooperate with any such audits by providing requested documentation of opt-in practices, consent records, use cases, and compliance measures in a timely manner."]})]}),(0,n.jsx)("h2",{id:"t-22",children:"22. Service Availability"}),(0,n.jsx)("p",{children:"We engineer the Platform for high availability across geographically distributed regions and apply industry-standard practices \u2014 redundant compute, automatic failover, infrastru
1cture-as-code, immutable deployments, blue/green release patterns, real-time monitoring, and 24/7 on-call coverage \u2014 to minimise the frequency, duration, and customer impact of outages. Despite these efforts, no internet-delivered service can credibly promise zero downtime; equipment fails, software has defects, networks partition, and upstream providers occasionally suffer their own incidents. The provisions below describe our availability target, what counts and does not count toward the calculation, how planned vs unplanned downtime is treated, and the operational disciplines we apply to maintenance:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:["We target 99.9% monthly uptime. Enterprise customers receive contractual SLA. See ",(0,n.jsx)("a",{href:"/sla",children:"Service Level Agreement"}),"."]}),(0,n.jsx)("li",{children:"Scheduled maintenance is announced at least 24 hours in advance (via email and status page)."}),(0,n.jsx)("li",{children:"Emergency maintenance may occur without notice in case of security incidents."}),(0,n.jsx)("li",{children:"Downtime caused by third-party services (Meta, AWS, Twilio, etc.) is excluded from uptime calculations."})]}),(0,n.jsx)("h2",{id:"t-23",children:"23. Support"}),(0,n.jsx)("p",{children:"Customer support is delivered as a tiered service: the level and channel of support available to you depends on your subscription plan, the severity of your issue, and (for Enterprise customers) the specific commitments in your Order Form. We staff our support team with engineers and customer-success specialists who are familiar with the Platform's internals as well as the upstream integrations (Meta WhatsApp, Twilio, OpenAI), enabling us to diagnose issues end-to-end rather than bouncing tickets between teams. Self-service support \u2014 through our help-centre, API documentation, and in-app product tours \u2014 is available to every user regardless of tier and is often the fastest path to resolution for routine questions. The matrix below summarises the support entitlements per tier; Enterprise customers should refer to their Order Form for the authoritative response-time and resolution-time commitments:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Free tier:"})," Community support only."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Growth:"})," Email support, best-effort response within 24 hours."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Enterprise:"})," Priority email support, dedicated account manager, phone support during business hours."]})]}),(0,n.jsx)("h2",{id:"t-24",children:"24. Beta Features"}),(0,n.jsx)("p",{children:'To accelerate innovation and obtain real-world validation before committing to general availability, we periodically release pre-release functionality under labels such as "Alpha", "Beta", "Preview", "Early Access", "Experimental", or "Limited Availability". These features are made available to a curated subset of customers \u2014 sometimes via opt-in flags in the dashboard, sometimes by individual invitation, sometimes via a wait-list \u2014 for the express purpose of collecting feedback, identifying defects, and informing roadmap decisions. By participating, you become a partner in product development; in exchange for early access you accept a higher tolerance for instability, a less polished user experience, breaking changes between iterations, and the possibility that the feature may never reach general availability. Beta features are excluded from our standard SLA, support tier guarantees, and certain warranties; the specific provisions are:'}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Are provided AS IS, without any warranty."}),(0,n.jsx)("li",{children:"May be unstable, incomplete, or changed/discontinued at any time."}),(0,n.jsx)("li",{children:"Are not covered by SLA."}),(0,n.jsx)("li",{children:"May have separate terms applicable."})]}),(0,n.jsx)("h2",{id:"t-25",children:"25. Modifications to Service"}),(0,n.jsxs)("p",{children:["The Platform is not a fixed product but a continuously-evolving service. Over the course of any given month, we typically ship dozens of incremental improvements \u2014 bug fixes, performance tuning, security hardening, UI refinements, new AI prompts, additional language support \u2014 most of which are entirely transparent to customers. Occasionally we make larger changes, such as redesigning a workflow, deprecating a feature in favour of a successor, sunsetting an integration whose upstream provider has shut down, or restructuring how a particular module operates. We balance the need to evolve the product against the disruption that change creates for customers who rely on existing behaviour, and we apply the following discipline: non-material changes (improvements, bug fixes, additive features) require no advance notice; material changes that materially degrade the functionality of a paid subscription tier are communicated by email and in-app notification at least ",(0,n.jsx)("strong",{children:"thirty (30) days"})," in advance, with an explanation of the change and any available migration path. If you reasonably consider a material change unacceptable, you may terminate your subscription before the change takes effect and receive a pro-rata refund of any prepaid fees covering periods after the effective date \u2014 terms detailed in our Refund Policy. Continued use of the Service after the effective date constitutes acceptance of the change. Beta and free-tier features may be modified or discontinued at any time without prior notice; Enterprise customers are entitled to additional protections specified in their Order Forms."]}),(0,n.jsx)("h2",{id:"t-26",children:"26. Termination by You"}),(0,n.jsx)("p",{children:"The right to walk away from a service contract on reasonable notice is fundamental to the SaaS model and is something we honour without obstacles, dark-pattern flows, or retention manoeuvres. Cancellation is a self-service action available at any time from inside your dashboard, requires no manager-approval call, and produces an immediate, unambiguou
1s record. We do not impose early-termination fees on month-to-month subscriptions. For annual subscriptions, the prepaid term is generally non-refundable beyond the initial 14-day money-back guarantee window described in the Refund Policy, but you remain entitled to use the Service through the end of the prepaid term. For Enterprise customers under signed Order Forms with multi-month or multi-year commitments, termination rights are governed by the Order Form rather than this Section. The mechanics:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:["You may cancel your subscription at any time via account settings or by emailing ",(0,n.jsx)("a",{href:"mailto:".concat(l),children:l}),"."]}),(0,n.jsx)("li",{children:"Cancellation takes effect at the end of the current billing period."}),(0,n.jsx)("li",{children:"You remain responsible for Fees incurred before cancellation."}),(0,n.jsxs)("li",{children:["Refunds are governed by our ",(0,n.jsx)("a",{href:"/refund",children:"Refund Policy"}),"."]})]}),(0,n.jsx)("h2",{id:"t-27",children:"27. Termination by Us"}),(0,n.jsx)("p",{children:"We reserve the right to suspend or terminate your access to the Platform under defined circumstances. Suspension is generally a temporary, reversible action used while we investigate a suspected violation, await your response to a billing failure, or contain a security or abuse incident; termination is a permanent action that ends your subscription, deletes your account (subject to the data-export window), and severs our contractual relationship. We exercise these rights with proportionality and, wherever feasible and not contrary to safety or legal obligations, with prior notice and an opportunity to cure. Some triggers, however, require immediate action without notice \u2014 for example, where continued service to a particular customer would violate Meta's policies and put the integration at risk for every other customer, or where law enforcement provides a court order. The triggers include:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Material breach of these Terms or the Acceptable Use Policy."}),(0,n.jsx)("li",{children:"Non-payment after exhausted retry schedule."}),(0,n.jsx)("li",{children:"Fraudulent, illegal, or harmful activity."}),(0,n.jsx)("li",{children:"Law enforcement or court order."}),(0,n.jsx)("li",{children:"Prolonged inactivity (90+ days for free accounts)."}),(0,n.jsx)("li",{children:"Reputational risk to our business."}),(0,n.jsx)("li",{children:"Meta/Twilio/other upstream provider disabling our relationship with you."})]}),(0,n.jsx)("h2",{id:"t-28",children:"28. Effect of Termination"}),(0,n.jsx)("p",{children:"Termination of this Agreement, by either party and for any reason, triggers a structured wind-down sequence intended to give you a reasonable opportunity to extract your data while ensuring that our infrastructure does not retain account state indefinitely. The wind-down is designed to be predictable, documented, and respectful of both parties' interests: you should expect that your data remains accessible for export for thirty (30) days from the effective date of termination, after which it is deleted from active systems and (within the timeframes documented in the Data Deletion Policy) from backups. Some categories of data \u2014 invoices and tax records, audit logs of significant security events, anonymised analytics \u2014 are retained beyond account deletion to comply with statutory record-keeping obligations or to support our legitimate-interest in fraud and abuse detection across customer cohorts. The specific consequences of termination are:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Your access to the Platform ceases immediately."}),(0,n.jsx)("li",{children:"You may export your Customer Content within 30 days."}),(0,n.jsx)("li",{children:"After 30 days, we delete your data per our Privacy Policy and retention schedule."}),(0,n.jsx)("li",{children:"Fees paid for the current period are non-refundable (subject to Refund Policy)."}),(0,n.jsx)("li",{children:"Sections that by nature survive termination (liability, IP, confidentiality, governing law) continue."})]}),(0,n.jsx)("h2",{id:"t-29",children:"29. Warranties Disclaimer"}),(0,n.jsx)("p",{children:"The disclaimer below is a standard component of any subscription-based software service and reflects an industry-wide allocation of risk: the Platform is offered at a price that assumes you are obtaining the product for what it actually is, not for theoretical perfection. Implied warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy of AI outputs, system availability, and freedom from defects, viruses, or interruption \u2014 to the extent they would otherwise arise by operation of law \u2014 are expressly disclaimed because such warranties cannot in practice be honoured by any reasonably-priced internet-delivered service. The disclaimer is shown in upper case both as conventional notice that the matter is important and to comply with the prominence requirements of certain consumer-protection statutes. The disclaimer does not purport to remove rights that cannot be excluded as a matter of mandatory law (for example, certain Turkish consumer-protection rights for natural-person consumers, or non-excludable warranties under the EU Consumer Sales Directive); to the extent any such rights apply, they continue notwithstanding this Section."}),(0,n.jsx)("p",{children:'THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY OF AI-GENERATED CONTENT, OR UNINTERRUPTED AVAILABILITY. WE DO NOT WARRANT THAT THE SERVICE WILL MEET YOUR REQUIREMENTS OR THAT IT WILL BE ERROR-FREE, SECURE, OR UNINTERRUPTED. WE DO NOT WARRANT THE ACCURACY, RELIABILITY, COMPLETENESS, OR TIMELINESS OF ANY INFORMATION OR CONTENT DELIVERED THROUGH THE SERVICE, INCLUDING ANY INFORMATION OR CONTENT GENERATED BY ARTIFICIAL INTELLIGENCE. NO INFORMATION, WHETHER ORAL OR WRITTEN, OBTAINED BY YOU FROM US OR FROM THE SERVICE SHALL CREATE ANY WARRANTY NOT EXPRESSLY STATED IN THESE TERMS.'}),(0,n.jsx)("h2",{id:"t-30",children:"30. Limitation of Liability"}),(0,n.jsx)("p",{children:"This limitation of liability is a fundamental element of the bargain between you and us, and it reflects a fair allocation of risk given the subscription fees charged. Without these limitations, our pricing would necessarily be substantially higher to account for potentially unlimited exposure. You acknowledge that you have had an opportunity to review these limitations and have priced your use of the Platform accordingly. The limitations apply regardless of the form of action (contract, tort, strict liability, or otherwise) and regardless of whether the damages were foreseeable or we were advised of their possibility. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE FOLLOWING LIMITATIONS APPLY:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Exclusion of Indirect Damages:"})," NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES OF ANY KIND ARISING OUT OF OR RELATED TO THIS AGREEMENT OR YOUR USE OF THE PLATFORM. This includes but is not limited to damages for lost revenue, lost business opportunities, business interruption, loss of anticipated savings, loss of use, loss of reputation, or cost of substitute products or services. This exclusion applies regardless of whether the claim is brought in contract, tort, strict liability, or otherwise, and regardless of whether the possibility of such damages was foreseeable or disclosed in advance."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Liability Cap:"})," OUR TOTAL CUMULATIVE AGGREGATE LIABILITY TO YOU ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, YOUR USE OF THE PLATFORM, OR ANY PROVISION OF SERVICES, UNDER ANY CAUSE OF ACTION OR THEORY OF LIABILITY, SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY YOU TO US UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. For customers on free tiers with no fees paid, our aggregate liability shall not exceed USD 100 (one hundred US dollars). This cap represents the maximum aggregate amount recoverable across all claims combined, not per-claim."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Specific Excluded Losses:"})," Without limiting the generality of the above, we are specifically NOT liable for any loss of profits, loss of revenue, loss of business opportunities, loss or c
1orruption of data, loss of goodwill, loss of reputation, loss of anticipated savings, loss of management time, loss of use of any software or equipment, loss of or damage to property, loss or corruption of Customer Content, errors or inaccuracies in AI-generated content, failures of third-party services (Meta, Twilio, OpenAI, Paddle, etc.), loss of customers or contracts, or any other indirect or consequential loss, regardless of the cause, and whether arising under contract, tort, or otherwise."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Third-Party Service Failures:"})," We are not liable for any damages, losses, or interruptions caused by third-party services upon which the Platform depends, including but not limited to Meta's WhatsApp Business API, Instagram Messaging API, Telegram Bot API, Twilio's telephony services, Paddle's payment processing, OpenAI's AI inference services, AWS cloud infrastructure, or Cloudflare's CDN. While we work diligently to mitigate third-party outages through redundancy and graceful degradation where possible, we cannot guarantee uninterrupted operation of these external services and are not liable when they fail or change their terms."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"AI-Related Disclaimers:"})," We specifically disclaim liability for any consequences of AI-generated content, including but not limited to factual inaccuracies (hallucinations), offensive or inappropriate outputs, compliance failures in AI responses, or business decisions made based on AI recommendations. AI is a probabilistic technology that produces approximate results; you are responsible for reviewing critical outputs before acting on them."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Exceptions to Limitations:"})," The foregoing limitations do NOT apply to: (a) damages resulting from our gross negligence, willful misconduct, or intentional fraud; (b) death or personal injury caused by our negligence; (c) our indemnification obligations under Section 31; (d) your payment obligations for fees due; (e) either party's breach of confidentiality obligations causing quantifiable monetary loss; or (f) liability that cannot be limited or excluded under applicable law (such as certain statutory consumer protection rights under Turkish, EU, UK, or US consumer laws)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Statute of Limitations:"})," You agree that any claim or cause of action arising out of or related to this Agreement or the Platform must be filed within one (1) year after the cause of action accrues, otherwise it is permanently barred. This shortened limitations period reflects the fast-moving nature of the SaaS industry and the benefit of early dispute resolution."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Allocation of Risk:"})," THE LIMITATIONS AND EXCLUSIONS IN THIS SECTION REFLECT AN INFORMED, FAIR, AND REASONABLE ALLOCATION OF RISK BETWEEN THE PARTIES, AND FORM AN ESSENTIAL BASIS OF THE BARGAIN BETWEEN US. THE PROVISIONS OF THIS SECTION SHALL APPLY NOTWITHSTANDING THE FAILURE OF ANY LIMITED REMEDY OF ITS ESSENTIAL PURPOSE."]})]}),(0,n.jsx)("h2",{id:"t-31",children:"31. Indemnification"}),(0,n.jsx)("p",{children:"Indemnification shifts the financial responsibility for certain types of third-party claims onto the party best positioned to control or prevent the underlying conduct. Because you control the messages you send, the audiences you target, the consents you obtain, and the content you upload, you are the party best positioned to prevent the kind of third-party claim \u2014 for example, a recipient suing for unsolicited messaging, a copyright owner suing over infringing content, or a regulator fining for unlawful processing \u2014 that arises out of those choices. Conversely, because we control the Platform's source code, we are best positioned to defend a third-party allegation that the Platform itself infringes a patent or copyright. This Section therefore creates two complementary indemnification obligations: a customer indemnity flowing to us for misuse-driven claims, and a provider indemnity flowing to you for IP-infringement claims directed at the Platform itself. Both indemnities are subject to standard procedural conditions: the indemnified party must notify the indemnifying party promptly of any claim, give the indemnifying party sole control of defence and settlement, and provide reasonable cooperation at the indemnifying party's expense."}),(0,n.jsxs)("p",{children:["You agree to defend, indemnify, and hold harmless ",s,", its affiliates, officers, directors, employees, contractors, and agents from any claims, damages, losses, liabilities, costs (including reasonable attorneys' fees) arising from:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Your use of or access to the Platform."}),(0,n.jsx)("li",{children:"Your violation of these Terms or any law."}),(0,n.jsx)("li",{children:"Your violation of any third-party right, including IP, privacy, or contractual rights."}),(0,n.jsx)("li",{children:"Any claim that your Customer Content caused damage to a third party."}),(0,n.jsx)("li",{children:"Messages sent to End-Users who did not consent."})]}),(0,n.jsx)("p",{children:"We will indemnify you against third-party claims that the Platform, used as permitted, infringes third-party intellectual property rights."}),(0,n.jsx)("h2",{id:"t-32",children:"32. Confidentiality"}),(0,n.jsx)("p",{children:"The provision of services under this Agreement inevitably involves the exchange of confidential or proprietary information in both directions: you may share with us information about your business operations, customer base, marketing strategy, internal processes, financial terms negotiated in your Order Form, or pre-release product feedback; we may share with you information about Platform internals, future roadmap items, sub-processor arrangements, security-control specifics, AI prompt designs, or pricing offered to you specifically. \"Confidential Information\" means any non-public information disclosed by one party to the other in connection with this Agreement that is either marked as confidential or that a reasonable recipient would understand to be confidential given the nature of the information and the circumstances of disclosure, including (in any event) the negotiated terms of any Order Form, the technical specifications of integrations, security procedures, and any pre-release feature information. Each party agrees to (i) protect the other's Confidential Information using at least the same degree of care it uses to protect its own confidential information of like sensitivity, and in no event less than a reasonable degree of care; (ii) use the Confidential Information solely for purposes of performing under or exercising rights granted by this Agreement; (iii) limit disclosure to its employees, agents, professional advisors, and contractors who have a genuine need to know and who are bound by written confidentiality obligations at least as protective as those in this Section; and (iv) not disclose Confidential Information to any third party without the disclosing party's prior written consent, except as required by law (in which case the receiving party will, where legally permitted, give the disclosing party prompt notice and a reasonable opportunity to seek protective relief). Standard exclusions apply: information that becomes generally known through no fault of the receiving party, that the receiving party rightfully knew before disclosure, that is independently developed without reference to the Confidential Information, or that is rightfully obtained from a third party without confidentiality restriction is not Confidential Information. The confidentiality obligations of this Section survive termination of this Agreement for a period of three (3) years, except for trade secrets, which remain protected for as long as they qualify as trade secrets under applicable law."}),(0,n.jsx)("h2",{id:"t-33",children:"33. Export Control & Sanctions"}),(0,n.jsx)("p",{children:'The Platform incorporates technology, services, and AI models originating from or routed through multiple jurisdictions (United States, European Union, United Kingdom, Turkey, and others), each of which maintains its own regime of export controls, economic sanctions, embargoes, and restricted-party lists. As a customer using the Platform \u2014 and as a sender of communications to potentially many countries \u2014 you are responsible for ensuring that your use does not facilitate or constitute a prohibited export, technology transfer, or sanctions violation. You represent and warrant on a continuing basis that: (i) neither you, nor any of your affiliates, owners, directors, officers, employees with access to the Platform, nor any of your end-users to whom you send communications through the Platform, is a Sanctioned Person; (ii) you are not located, organised, or resident in any country or territory that is the subject of comprehensive sanctions imposed by the United States (including Cuba, Iran, North Korea, Syria, the Crimea, Donetsk, Luhansk, Kherson, and Zaporizhzhia regions), the European Union, the United Kingdom, the United Nations, or the Republic of Turkey; (iii) you will not use the Platform to provide goods, services, technology, software, or any benefit to any Sanctioned Person or any party located in a Sanctioned Region; (iv) you will not use the Platform in connection with the development, production, or use of nuclear, chemical, or biological weapons, missile te
1chnology, or other weapons of mass destruction; and (v) you will comply with all applicable export control laws including the US Export Administration Regulations (EAR), the International Traffic in Arms Regulations (ITAR), EU Dual-Use Regulation (EU) 2021/821, and equivalent national laws. "Sanctioned Person" includes any party listed on the US OFAC Specially Designated Nationals (SDN) List, the OFAC Sectoral Sanctions Identifications List, the EU Consolidated List, the UK OFSI Consolidated List, the UN Sanctions List, or any equivalent restricted-party list maintained by a competent authority. We reserve the right to screen accounts, end-user phone numbers, IP addresses, and Order-Form counterparties against these lists at any time and to immediately suspend or terminate any account or transaction that triggers a positive match, without obligation of refund.'}),(0,n.jsx)("h2",{id:"t-34",children:"34. Anti-Bribery & Corruption"}),(0,n.jsxs)("p",{children:[s," maintains a strict zero-tolerance policy on bribery, corruption, facilitation payments, kickbacks, and any other form of improper inducement, whether involving public officials, private-sector counterparties, or our own personnel. This commitment reflects both the unconditional nature of our ethical standards and the broad extraterritorial reach of modern anti-corruption legislation: the United States Foreign Corrupt Practices Act (FCPA) of 1977 (as amended), the United Kingdom Bribery Act 2010 (which created the strict-liability corporate offence of failure to prevent bribery and applies wherever the company carries on business), the OECD Anti-Bribery Convention, the Turkish Criminal Code Articles 252\u2013256 dealing with bribery and embezzlement, and a growing body of equivalent national laws (the French Sapin II, German anti-corruption laws, Brazilian Clean Companies Act). You agree on a continuing basis that you will not, in connection with this Agreement or your use of the Platform, directly or indirectly offer, promise, give, request, or accept any bribe, kickback, undue advantage, gift of more than nominal value, hospitality of disproportionate scale, or facilitation payment to or from any person \u2014 including any government official, political party, candidate for political office, employee of a state-owned enterprise or international organisation, or private-sector counterparty \u2014 for the purpose of obtaining or retaining business, securing an improper commercial advantage, influencing an official act or decision, or inducing a breach of duty. You also agree to maintain accurate books and records reflecting all transactions undertaken using the Platform, to implement reasonable controls designed to prevent corruption in your own organisation and supply chain, and to report to us promptly any reasonable suspicion of corruption involving the Platform or our personnel. Any breach of this Section is a material breach of this Agreement and entitles us to terminate immediately without notice, without refund, and to take any further legal action available."]}),(0,n.jsx)("h2",{id:"t-35",children:"35. Force Majeure"}),(0,n.jsx)("p",{children:'Force-majeure provisions allocate the risk of catastrophic, unforeseeable, or otherwise unavoidable events that prevent contractual performance through no fault of the affected party. Neither party shall be liable to the other for any failure or delay in the performance of any obligation under this Agreement (other than payment of fees that are already accrued and due) to the extent such failure or delay is caused by a Force Majeure Event, provided that the affected party (i) gives prompt written notice to the other party identifying the event and its expected duration, (ii) takes commercially reasonable steps to mitigate the impact and to resume performance as soon as practicable, and (iii) continues to perform any obligations not affected by the event. A "Force Majeure Event" means any event beyond the reasonable control of the affected party, including but not limited to: acts of God, fires, floods, earthquakes, tsunamis, hurricanes, tornadoes, volcanic eruptions, and other natural disasters;
1 pandemics, epidemics, and public-health emergencies declared by competent authorities; war (whether declared or not), invasion, armed conflict, civil war, hostilities, acts of foreign enemies, terrorism, sabotage, riot, civil commotion, insurrection, or revolution; nuclear, chemical, or biological contamination, or sonic boom; widespread power-grid failures or large-scale internet routing failures attributable to backbone-level incidents; embargoes, expropriations, requisitions, sanctions, or other governmental actions, including changes in law that materially impair performance; strikes, lockouts, labour disputes, or other industrial action involving the affected party\'s workforce or that of a critical sub-processor; cyberattacks of broad systemic scope (e.g. attacks on certificate authorities or DNS root infrastructure); and prolonged failure or unavailability of essential third-party services upon which the Platform relies (including but not limited to Meta WhatsApp Business API, Twilio, Paddle, OpenAI, AWS, Cloudflare). If a Force Majeure Event continues for more than thirty (30) consecutive days, either party may terminate the affected portion of this Agreement upon written notice without further liability, except for fees accrued for service actually rendered before the event.'}),(0,n.jsx)("h2",{id:"t-36",children:"36. Assignment"}),(0,n.jsx)("p",{children:"This Agreement is personal to you in the sense that we have entered into it on the basis of an assessment of you (or your organisation) as a counterparty \u2014 your industry, use case, geographic footprint, and risk profile. You may not assign, transfer, novate, sub-licence, charge, or otherwise dispose of all or any of your rights or obligations under this Agreement, whether by operation of law (including in connection with a change of control, merger, acquisition, demerger, or sale of assets) or otherwise, without our prior written consent, which we will not unreasonably withhold but may condition on the proposed assignee's acceptance of the same Terms and any reasonable due-diligence requirements. Any purported assignment in breach of this Section is void. We, on the other hand, may assign or transfer our rights and obligations under this Agreement, in whole or in part: (a) to any of our affiliates; (b) in connection with a merger, acquisition, reorganisation, or sale of all or substantially all of our assets or the business to which the Agreement relates; or (c) to a successor in interest by operation of law, in each case upon written notice to you (which notice may be given by email or in-app notification). The assignee shall succeed to our rights and obligations on identical terms; you will continue to enjoy the same Service at the same fees and may not use the assignment as grounds to terminate (except where the assignment to a competitor would prejudice your reasonable interests)."}),(0,n.jsx)("h2",{id:"t-37",children:"37. Governing Law"}),(0,n.jsxs)("p",{children:["This Agreement, and all non-contractual obligations arising out of or in connection with it (including any question regarding its existence, validity, formation, performance, breach, or termination, and any claims for unjust enrichment, misrepresentation, or restitution), shall be governed by and construed in accordance with the substantive laws of the Republic of Turkey, including in particular the Turkish Code of Obligations No. 6098, the Turkish Commercial Code No. 6102, the Turkish Personal Data Protection Law No. 6698 (KVKK), the Electronic Commerce Law No. 6563, and any related secondary legislation, regulations, communiqu\xe9s, or board decisions in force from time to time. The application of conflict-of-laws principles, the United Nations Convention on Contracts for the International Sale of Goods (CISG), the UNIDROIT Principles of International Commercial Contracts, and any other body of supranational or harmonised commercial law is expressly excluded. The choice of Turkish law as the governing law reflects the fact that ",s," is incorporated, has its principal place of business, and conducts its core operations in Turkey, and provides legal certainty for both parties about the rules that will be applied to disputes. Notwithstanding the foregoing, where you contract with us as a consumer (a natural person acting outside the scope of any business activity) and reside in a
1jurisdiction whose mandatory consumer-protection laws confer rights that cannot be waived by choice-of-law clauses, those mandatory rights continue to apply alongside Turkish law to the limited extent required."]}),(0,n.jsx)("h2",{id:"t-38",children:"38. Dispute Resolution"}),(0,n.jsx)("p",{children:"Disputes between commercial parties are an unfortunate but unavoidable feature of any long-running business relationship. Our objective is to keep dispute resolution proportionate to the dispute itself: minor disagreements should be resolved through dialogue between the operational teams, larger disputes should escalate through senior management, and only the irreducible residue should reach a formal forum. The provisions below establish a two-stage dispute-resolution architecture \u2014 a mandatory good-faith negotiation period that gives both parties time to investigate facts and identify settlement options without the cost and friction of formal proceedings, followed by exclusive jurisdiction in the Turkish courts (or, for Enterprise customers, optional arbitration). Both parties agree that this Section is intended to encourage early resolution and to reduce the cost of disputes for both sides; either party's failure to engage genuinely in the negotiation phase may be cited by the other party in subsequent proceedings."}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Informal resolution first:"})," Parties agree to first attempt to resolve disputes via good-faith negotiation for at least 30 days."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Jurisdiction:"})," Exclusive jurisdiction of the courts and enforcement offices of Istanbul (\xc7a\u011flayan), Republic of Turkey."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Optional arbitration (Enterprise):"})," Parties may mutually agree to binding arbitration under Istanbul Arbitration Centre (ISTAC) rules, or ICC International Arbitration for cross-border cases."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"EU consumers:"})," Additional access to EU Online Dispute Resolution: ",(0,n.jsx)("a",{href:"https://ec.europa.eu/consumers/odr",target:"_blank",rel:"noreferrer",children:"ec.europa.eu/consumers/odr"})]})]}),(0,n.jsx)("h2",{id:"t-39",children:"39. Class Action Waiver"}),(0,n.jsx)("p",{children:"To the maximum extent permitted by applicable law, you and we each agree that any dispute, claim, or controversy arising out of or relating to this Agreement or your use of the Platform shall be resolved exclusively on an individual basis, and not as a plaintiff, claimant, or class member in any purported class action, collective action, consolidated action, mass action, or representative proceeding (whether judicial or arbitral). The arbitrator (if applicable) shall not have authority to consolidate the claims of multiple parties or to preside over any form of class, collective, mass, consolidated, or representative proceeding. You and we each waive, to the extent permitted by law, any right to a jury trial. We acknowledge that the validity and enforceability of class-action waivers vary by jurisdiction; nothing in this Section purports to waive any right that you have under mandatory law that cannot be waived by contract (for example, certain consumer-collective-redress rights under EU Directive (EU) 2020/1828 in EU jurisdictions where that Directive applies, or certain rights under the Turkish Consumer Protection Law No. 6502). To the extent any portion of this Section is found unenforceable as to a particular claim, the remainder of this Section shall continue to apply to all other claims and aspects."}),(0,n.jsx)("h2",{id:"t-40",children:"40. Miscellaneous"}),(0,n.jsx)("p",{children:'The provisions in this Section are the standard "boilerplate" of a SaaS contract \u2014 individually small, collectively important. They address how the parties communicate formal notices, what happens if a particular provision turns out to be unenforceable, how the Agreement interacts with other documents, and the residual default rules that allocate risk for situations not covered elsewhere. Although boilerplate is sometimes overlooked, it is read by courts and arbitrators with the same weight as the operative provisions and should be reviewed carefully:'}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Severability:"})," If any provision is unenforceable, the rest remains in effect."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Waiver:"})," Failure to enforce any right is not a waiver of future enforcement."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Notices:"})," Legal notices to us: ",(0,n.jsx)("a",{href:"mailto:".concat(d),children:d}),". Notices to you: via email to your registered address."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Electronic communications:"})," You consent to receive communications electronically."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Headings:"})," For reference only; do not affect interpretation."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Entire Agreement:"}
1)," These Terms + Privacy Policy + AUP + DPA + Refund Policy + any Order Form constitute the entire agreement."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"No third-party beneficiaries:"})," This Agreement is solely between you and us."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Relationship:"})," Parties are independent contractors. No partnership, agency, or employment."]})]}),(0,n.jsx)("h2",{id:"t-41",children:"41. Changes to Terms"}),(0,n.jsxs)("p",{children:['The legal, regulatory, and commercial landscape in which the Platform operates evolves continuously. New laws (the EU AI Act, the Digital Services Act, sector-specific regulations), new sub-processors, new product capabilities, regulator guidance, and feedback from our customers and counsel all create occasions on which we need to update these Terms. We approach updates with discipline: cosmetic, clarifying, or non-material updates may be made with concurrent notice (publishing the revised version with an updated "Effective Date"); material updates that adversely affect customers\' rights or obligations are pre-announced at least ',(0,n.jsx)("strong",{children:"thirty (30) days"})," in advance via email to the Account Owner's registered address and an in-app notification, with a summary of the key changes and a link to a clean redline. The full version history of these Terms is maintained on our public website to support audit and historical reference. Your continued use of the Service after the effective date of an update constitutes your acceptance of the updated Terms; if you do not accept the update, your sole remedy is to terminate your subscription before the effective date and request any pro-rata refund permitted under the Refund Policy. For Enterprise customers, material changes to terms incorporated by reference into a signed Order Form do not take effect until the next renewal of that Order Form unless you expressly accept them earlier."]}),(0,n.jsx)("h2",{id:"t-42",children:"42. Contact"}),(0,n.jsx)("p",{children:"For any matter relating to these Terms \u2014 questions of interpretation, requests for the underlying DPA, formal legal notices, suspected security incidents, or pre-sales clarifications \u2014 please use the appropriate channel below. We monitor each inbox during Turkish business hours (Europe/Istanbul, UTC+3), with after-hours coverage for security and high-severity incidents only. Routing your message to the correct channel speeds up triage and ensures it reaches the responsible team:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"General inquiries:"})," ",(0,n.jsx)("a",{href:"mailto:".concat(l),children:l})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Legal notices:"})," ",(0,n.jsx)("a",{href:"mailto:".concat(d),children:d})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Security issues:"})," ",(0,n.jsx)("a",{href:"mailto:".concat(h),children:h})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Mailing address:"})," ",s,", ",o]})]}),(0,n.jsx)(x,{})]})}function j(){return(0,n.jsxs)("div",{className:"lp-section",children:[(0,n.jsxs)("div",{className:"lp-intro",children:[(0,n.jsxs)("p",{children:['This Refund Policy ("Refund Policy", "Policy") sets out, in comprehensive detail, the circumstances under which refunds may be claimed, the procedures by which refund requests are submitted and processed, the timelines that apply at each stage of the workflow, the categories of charges that are and are not refundable, the relationship between contractual refund rights and statutory consumer-protection rights, and the escalation path available to you if you remain dissatisfied with our decision on a particular refund request. The Policy applies to every paid product, plan, add-on, credit pack, and usage charge offered by ',a,' ("Platform", "Service"), an enterprise software-as-a-service operated by ',s,' ("Company", "We", "Us"), a joint-stock company duly registered in the Republic of Turkey with its principal place of business in Istanbul. It applies whether you are a free-tier user evaluating the Service, a self-service Growth-plan
1subscriber, an Enterprise customer under a negotiated Order Form, an annual subscriber, a monthly subscriber, or a buyer of one-off prepaid credit packages.']}),(0,n.jsx)("p",{children:'Our overarching commercial philosophy on refunds is straightforward: we want every customer to feel genuinely confident that the value they receive from the Service exceeds the price they pay; where that value-for-price equation is not delivered, we would rather part ways amicably with a cash refund than retain a dissatisfied customer through procedural friction. We do not employ retention dark patterns, mandatory "chat with a retention specialist" gates, multi-step opt-out cancellation flows, or punitive cancellation fees. The 14-day money-back guarantee described in Section 1 below is unconditional and is honoured without question; refund decisions outside that window are made transparently against the policy criteria set out in this document, with a clearly defined appeal route in the (rare) cases where an initial decision goes against the customer.'}),(0,n.jsx)("p",{children:"This Refund Policy is contractual in nature \u2014 it forms part of our Terms of Service and is binding between you and us as a matter of contract law \u2014 but it operates alongside, and never in derogation of, the substantial body of statutory consumer-protection rights that applies to consumer transactions in many jurisdictions. Where you contract with us as a \"consumer\" (a natural person acting outside any trade, business, craft, or profession), you benefit from non-waivable rights under the laws of your country of residence that may exceed the contractual rights granted by this Policy. Among the statutory frameworks under which we operate are: the Republic of Turkey's T\xfcketicinin Korunmas\u0131 Hakk\u0131nda Kanun No. 6502 and its associated Mesafeli S\xf6zle\u015fmeler Y\xf6netmeli\u011fi (Distance Contracts Regulation), which provides a 14-day right of withdrawal for consumer distance contracts; the European Union's Consumer Rights Directive 2011/83/EU, as transposed into the national laws of each EU/EEA Member State, which mirrors the 14-day cooling-off period for distance contracts subject to certain exceptions for digital services where express consent to immediate performance has been given (Article 16(m)); the United Kingdom's Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the Consumer Rights Act 2015, which together provide cancellation rights, satisfactory-quality requirements, and remedies for non-conforming digital content; the United States Federal Trade Commission Act, the California Consumer Privacy Act/Privacy Rights Act, and various state-specific consumer-protection statutes; and analogous frameworks in Brazil (CDC), Canada, Japan, Singapore, Australia, and elsewhere."}),(0,n.jsxs)("p",{children:["Where contractual rights under this Policy are more generous than your statutory rights (as is generally the case), the contractual rights apply. Where statutory rights are more generous than the contractual rights (as may be the case in certain narrowly-defined consumer scenarios), the statutory rights apply and cannot be waived or diminished by anything in this Policy. Nothing in this Policy excludes, limits, or restricts any non-waivable consumer-protection right available to you under applicable law. If you are unsure whether you are a consumer or a business customer for the purposes of a particular jurisdiction, or whether a specific statutory right applies to your situation, our billing team can clarify; in case of genuine doubt we resolve the question in your favour. Refund requests, escalations, and questions about this Policy may be addressed to ",(0,n.jsx)("a",{href:"mailto:".concat(l),children:l}),"; we acknowledge inbound correspondence within one business day and aim to issue substantive decisions within five business days."]})]}),(0,n.jsx)(b,{}),(0,n.jsx)("h2",{children:"1. 14-Day Money-Back Guarantee"}),(0,n.jsxs)("p",{children:["We stand firmly behind the quality and value of our Platform, and we want every customer to feel confident in their decision to use ",a,". To eliminate the risk of your initial purchase, we offer an unconditional ",(0,n.jsx)("strong",{children:"14-day money-back guarantee"})," on all new paid subscriptions, regardless of the plan tier you selected. This guarantee means that if, for any reason or no reason at all, you are not completely satisfied with the Platform within the first 14 days after your initial paid subscription begins, you can request a full refund of all subscription fees paid \u2014 no questions asked, no obstacles, no forms to fill out. We honor this guarantee with no hesitation because we believe a great product should speak for itself, and we would rather part ways gracefully with a customer who isn't a good fit than try to hold onto fees from someone who isn't getting value."]}),(0,n.jsx)("p",{children:"The specific terms and conditions of the 14-day guarantee are as follows:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Applies to first-time paid subscriptions only:"})," The guarantee is designed to remove the initial risk of signing up, not to enable repeated trial-and-refund abuse. It therefore applies only to your first paid subscription at ",a,". If you previously subscribed, received a refund, and then signed up again, the guarantee is not available on the subsequent subscription (though standard pro-rata refund provisions may still apply for certain circumstances)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Not applicable to renew
1als, upgrades, or add-ons:"})," The 14-day window starts from the first paid charge. Subsequent renewal charges (monthly or annual auto-renewals), mid-cycle upgrades to higher plan tiers, or add-on purchases (such as extra credit packs, premium support, or additional SMS quotas) are not covered by the initial guarantee but may be subject to other refund provisions described in this Policy."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Full refund regardless of usage:"})," You receive a full refund even if you actively used the Platform during the 14-day window \u2014 sent messages, made voice calls, uploaded data, consumed AI credits, or otherwise utilized the Service. This reflects our confidence that if you used the product and still want to leave, we would rather refund you than retain a dissatisfied customer. However, usage charges that are pass-through to third parties (such as Meta's per-conversation WhatsApp charges or Twilio's per-message SMS charges) may not be refundable because those fees have been paid to third parties on your behalf."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"How to claim:"})," Simply email ",(0,n.jsx)("a",{href:"mailto:".concat(l,"?subject=Refund%20Request%20within%2014%20Days"),children:l}),' with the subject "Refund Request within 14 Days" and your account email. You do not need to explain why. We process the refund immediately upon receipt, typically completing it within 5 business days.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"What happens to your account:"})," Upon your refund request, your account enters a cancellation state \u2014 you lose access to paid features immediately, but your data is preserved for 30 days in case you change your mind. If you do nothing within that 30 days, the account and associated data are fully deleted per our ",(0,n.jsx)("a",{href:"/data-deletion",children:"Data Deletion Policy"}),"."]})]}),(0,n.jsx)("h2",{children:"2. EU Consumer Rights (14-Day Cooling-Off)"}),(0,n.jsxs)("p",{children:['Where you contract with us as a "consumer" within the meaning of EU consumer law \u2014 that is, as a natural person acting for purposes which are outside your trade, business, craft, or profession \u2014 you benefit from a robust set of statutory protections under Directive 2011/83/EU on consumer rights, as transposed into the law of each EU Member State. The most prominent of these is the right of withdrawal: a fourteen (14) calendar day period during which you may withdraw from a distance contract for any reason, with no obligation to justify your decision and (subject to the exceptions discussed below) no liability beyond the cost of any service genuinely consumed before withdrawal. The withdrawal period for digital services begins on the day the contract is concluded \u2014 typically the moment you click "I agree" and complete payment \u2014 and runs uninterrupted for fourteen calendar days, including weekends and public holidays. The ',a," 14-day money-back guarantee described in Section 1 above provides protection that meets or exceeds the EU consumer right of withdrawal in virtually every case, so you do not need to choose between the two: simply request a refund within 14 days for any reason and we will treat the request on whichever basis is most favourable to you."]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:["To withdraw under the EU consumer right rather than the ",a," 14-day guarantee, email ",(0,n.jsx)("a",{href:"mailto:".concat(l),children:l}),' with the subject "Cooling-off withdrawal" and identify your account email and the transaction date. The withdrawal must be sent (not received) before the 14-day deadline expires.']}),(0,n.jsx)("li",{children:"You may alternatively use the EU Model Withdrawal Form prescribed in Annex I(B) of Directive 2011/83/EU; we will provide a populated template upon request, but no specific form or wording is required \u2014 any unequivocal statement of withdrawal suffices."}),(0,n.jsx)("li",{children:"Important exception for digital services: under Article 16(m) of Directive 2011/83/EU, the consumer's right of withdrawal in relation to the supply of digital content not on a tangible medium is lost where the performance has begun with the consumer's prior express consent and acknowledgment that they thereby lose the right of withdrawal. When you create your account, we obtain this express consent so that we can begin providing the Service immediately rather than forcing you to wait fourteen days. Despite this technical loss of the statutory right, our 14-day money-back guarantee continues to apply and gives you a contractual refund right that is functionally equivalent."}),(0,n.jsx)("li",{children:"Where the withdrawal right does apply (for example, if performance has not yet begun), refunds are processed within 14 days of receipt of the withdrawal notice, using the same payment method used for the original transaction unless you expressly agree otherwise."})]}),(0,n.jsx)("h2",{children:"3. UK Consumer Rights (CRA 2015)"}),(0,n.jsx)("p",{children:"UK-resident consumers enjoy a substantially equivalent regime of statutory protections, anchored on three principal instruments: the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, which transposed the EU Consumer Rights Directive into UK law and provides a fourteen (14) calendar day right of cancellation for distance contracts (subject to the same digital-services exception described
1in Section 2 above where you have given express consent to immediate performance); the Consumer Rights Act 2015 (CRA 2015), which gives you the right to expect that any service supplied to you will be performed with reasonable care and skill, completed within a reasonable time, and (where price was not agreed in advance) charged at a reasonable price; and the Digital Content provisions of CRA 2015 Part 1 Chapter 3, which apply to digital services and require that they be of satisfactory quality, fit for any particular purpose made known to us, and as described. Where a service falls short of these standards you may, depending on the circumstances, be entitled to a price reduction or, in serious cases, to a refund. As with EU consumers, our 14-day money-back guarantee is generally the simplest route to obtaining a refund and is honoured automatically without the need to invoke statutory rights, but the statutory rights remain available and cannot be excluded or restricted by contract. UK customers also benefit from access to alternative dispute resolution through approved consumer ADR schemes; we provide ODR information in our Dispute Escalation section below."}),(0,n.jsx)("h2",{children:"4. Turkish Distance Sales (Mesafeli Sat\u0131\u015f)"}),(0,n.jsxs)("p",{children:["T\xfcrkiye Cumhuriyeti'nde t\xfcketici s\u0131fat\u0131yla sat\u0131n al\u0131m yapan m\xfc\u015fteriler, 6502 say\u0131l\u0131 T\xfcketicinin Korunmas\u0131 Hakk\u0131nda Kanun ve buna ba\u011fl\u0131 Mesafeli S\xf6zle\u015fmeler Y\xf6netmeli\u011fi kapsam\u0131nda geni\u015f bir koruma rejiminden yararlan\u0131r. Y\xf6netmelik gere\u011fi, mesafeli s\xf6zle\u015fmenin kuruldu\u011fu tarihten itibaren on d\xf6rt (14) g\xfcn i\xe7inde herhangi bir gerek\xe7e g\xf6stermeksizin ve cezai \u015fart \xf6demeksizin s\xf6zle\u015fmeden cayma hakk\u0131na sahipsiniz; cayma hakk\u0131n\u0131n kullan\u0131lmas\u0131 i\xe7in bu s\xfcre i\xe7inde taraf\u0131m\u0131za y\xf6nlendirilen yaz\u0131l\u0131 bir bildirim yeterlidir. Cayma bildiriminin taraf\u0131m\u0131za ula\u015fmas\u0131ndan itibaren on d\xf6rt (14) g\xfcn i\xe7inde, \xf6deme hangi y\xf6ntemle yap\u0131ld\u0131ysa ayn\u0131 y\xf6ntemle ve hi\xe7bir masraf yans\u0131t\u0131lmaks\u0131z\u0131n iade ger\xe7ekle\u015ftirilir. Dijital i\xe7erik ve hizmetler bak\u0131m\u0131ndan Y\xf6netmelik Madde 15 cayma hakk\u0131 istisnas\u0131n\u0131 d\xfczenler: t\xfcketicinin onay\u0131 ile elektronik ortamda an\u0131nda ifa edilen hizmetlerde cayma hakk\u0131 bulunmaz. ",a," hesab\u0131n\u0131z\u0131 olu\u015ftururken bu istisnaya ili\u015fkin a\xe7\u0131k onay\u0131n\u0131z\u0131 al\u0131r\u0131z ki Hizmet'i 14 g\xfcn beklemek zorunda kalmadan derhal kullanmaya ba\u015flayabilesiniz; ancak bu durumda dahi, B\xf6l\xfcm 1'deki 14 g\xfcnl\xfck geri \xf6deme garantimiz yasal cayma hakk\u0131yla i\u015flevsel olarak e\u015fde\u011fer bir s\xf6zle\u015fmeden do\u011fan iade hakk\u0131 sa\u011flar. Talepleriniz i\xe7in ",(0,n.jsx)("a",{href:"mailto:".concat(l),children:l}),' adresine "Cayma talebi" konulu bir e-posta g\xf6ndermeniz yeterlidir; kay\u0131tl\u0131 hesap e-postan\u0131z\u0131 ve fatura numaras\u0131n\u0131 eklemeniz i\u015flem s\xfcresini k\u0131salt\u0131r. T\xfcrk t\xfcketiciler ayr\u0131ca T\xfcketici Hakem Heyetlerine ve T\xfcketici Mahkemelerine ba\u015fvurma hakk\u0131n\u0131 sakl\u0131 tutar.']}),(0,n.jsx)("h2",{children:"5. How to Request a Refund"}),(0,n.jsx)("p",{children:"Our refund request process is designed to be straightforward, transparent, and respectful of your time. We do not impose lengthy forms, mandatory explanations for reasons, or layered approval hurdles \u2014 if you are within a refund-eligible period and your request meets the applicable criteria, we will process it promptly and fairly. You can initiate a refund request through any of the following channels, with email being the most common and fastest in practice:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Email (recommended for fastest processing):"})," Send a message to ",(0,n.jsx)("a",{href:"mailto:".concat(l,"?subject=Refund%20Request"),children:l}),' with "Refund Request" as the subject line. Our billing team monitors this address continuously during business hours (Istanbul time, 09:00-18:00 Monday through Friday, excluding Turkish public holidays).']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Information to include:"})," To help us process your request in a single round-trip without needing to ask follow-up questions, please include in your email: (a) the email address registered to your ",a," account; (b) the Paddle transaction ID or invoice number from the receipt email \u2014 this uniquely identifies the specific payment you want refunded; (c) the refund scope (full refund of the most recent charge, full account cancellation with all charges refunded, or a specific partial amount); (d) an optional brief reason \u2014 while not required, knowing why you're leaving helps us improve the Service for others; and (e) any special circumstances we should be aware of, such as if you've already initiated a chargeback with your bank (please don't do this before contacting us \u2014 it creates unnecessary complications and we would rather resolve things directly)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Support chat (if enabled in your region):"})," Customers on paid plans may also request refunds through our in-app support chat, which routes directly to our billing team."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Through your account dashboard:"})," For certain refund scenarios (such as cancelling a trial before charge, downgrading with pro-rata credit, or cancelling a recent upgrade), self-service options are available in Settings \u2192 Billing \u2192 Subscription History."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Processing timeline \u2014 acknowledgment:"})," We send an automated acknowledgment within minutes confirming we received your request. A human team member reviews and responds within 2 business days with either approval and next steps, a request for clarification, or (rarely) an explanation of why the request cannot be approved under this Policy."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Processing timeline \u2014 decision:"})," Final decision on refund eligibility is communicated within 5 business days of your initial request in nearly all cases. Complex cases (such as refunds involving multiple transactions, disputes over usage, or cases requiring management approval) may take up to 10 business days."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Processing timeline \u2014 payment back to you:"})," Once approved, refunds are initiated with Paddle immediately. The actual time for the refund to appear on your payment instrument depends on Paddle's processing and your bank's policies: credit/debit cards typically take 5-10 business days to show on your statement; bank transfers (SEPA, wire, iDEAL) up to 14 business days; digital wallets (PayPal, Apple Pay, Google Pay) 3-5 business days; prepaid cards may take longer. A confirmation email is sent when the refund is executed on our end."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"No hidden fees or penalties:"})," We never charge cancellation fees, processing fees, or administrative charges on refunds. You receive the full refundable amount. In cases involving foreign currency conversion, Paddle returns the amount in the original charging currency; any FX fluctuation between charge and refund is borne by the customer (this is standard across all SaaS providers using Paddle or Stripe)."]})]}),(0,n.jsx)("h2",{children:"6. Refund Processing"}),(0,n.jsx)("p",{children:"All refund payments are executed through our Merchant of Record, Paddle.com Market Ltd., which is also the payment processor that originally collected the funds. This unified processing path is critical because it allows the refund to be returned to the exact same payment instrument used for the original charge \u2014 credit card, bank account, digital wallet \u2014 which is required by card-network rules (Visa, Mastercard, American Express) and is the only way to avoid customer-side identity verification, currency-conversion friction, and tax-reporting confusion. We do not refund to alternative payment methods or to third-party accounts; the refund follows the original payment in reverse. Once we approve the refund on our end, we send the instruction to Paddle within hours; from that point onward the timing is determined by the underlying payment rail
1s and your bank's processing schedule, which is outside our direct control. Practical timelines:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Credit/debit cards:"})," 5-10 business days to appear on your statement."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Bank transfers (SEPA, etc.):"})," Up to 14 business days."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Digital wallets (PayPal, Apple Pay, Google Pay):"})," 3-5 business days."]}),(0,n.jsx)("li",{children:"Returned to your original payment method."}),(0,n.jsx)("li",{children:"Confirmation email sent upon processing."})]}),(0,n.jsx)("h2",{children:"7. Partial Refunds & Pro-Rata"}),(0,n.jsx)("p",{children:'Not every refund situation calls for a full reversal of the underlying charge. In many real-world scenarios \u2014 a customer downgrades partway through a billing period, a documented service outage exceeds the SLA threshold by a measurable percentage, an annual subscription is cancelled after several months of legitimate use \u2014 the equitable outcome is a partial refund that returns the unused portion of value while retaining payment for value already delivered. We use a simple, transparent pro-rata calculation that customers can verify themselves; we do not apply hidden adjustments, "restocking fees", or punitive deductions. The calculation is performed on a calendar-day basis (not pro-rated by usage volume, hours of access, or messages sent) for predictability. Pro-rata refunds may be issued in cases of:'}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Mid-cycle downgrade to a lower tier."}),(0,n.jsx)("li",{children:"Service outages exceeding SLA commitments (Enterprise)."}),(0,n.jsx)("li",{children:"Early termination due to material breach by us."})]}),(0,n.jsxs)("p",{children:["Pro-rata formula: ",(0,n.jsx)("code",{children:"(Unused days / Total days) \xd7 Paid amount"})]}),(0,n.jsx)("h2",{children:"8. Credits vs. Cash Refunds"}),(0,n.jsx)("p",{children:"In some refund scenarios \u2014 particularly those arising from goodwill gestures, SLA credits for minor incidents, or compensation for short-duration service degradations \u2014 both parties may be better served by an account credit (applied automatically to your next invoice) rather than a cash refund returned to your bank. Credits avoid the 5\u201314 day card-rail processing delay, eliminate any FX-conversion noise on cross-currency transactions, sidestep the administrative burden of reissuing receipts and tax documents, and (from your perspective) effectively reduce your next invoice by the credit amount. We will offer credits in lieu of cash refunds where this is the more efficient solution, but cash refunds remain available on request for the situations described in the rest of this Policy and we will not pressure you to accept credits as a substitute for a cash refund to which you are entitled. Credits operate under the following terms:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Valid for 12 months from issuance."}),(0,n.jsx)("li",{children:"Non-transferable."}),(0,n.jsx)("li",{children:"Cannot be exchanged for cash."}),(0,n.jsx)("li",{children:"Applied automatically to your next invoice."})]}),(0,n.jsx)("h2",{children:"9. Annual Subscription Refunds"}),(0,n.jsx)("p",{children:"For annual subscriptions cancelled mid-year:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Within 14 days: Full refund."}),(0,n.jsx)("li",{children:"After 14 days: Pro-rata refund for unused months (minus discount value received). The annual discount (typically ~20%) is recoverable in the calculation."})]}),(0,n.jsxs)("p",{children:[(0,n.jsx)("strong",{children:"Example:"})," Paid 2000 USD for 12 months (was 2500 monthly equivalent = 208.33/month). Cancelled after 4 months. Refund = 2000 - (208.33 \xd7 4) = 2000 - 833.33 = 1166.67 USD."]}),(0,n.jsx)("h2",{children:"10. Downgrades Mid-Cycle"}),(0,n.jsx)("p",{children:"If you elect to move to a lower-tier subscription plan during a billing period, the change takes effect immediately at the technical level \u2014 your account is reconfigured to the new plan's feature set, included quotas, and rate limits, and any features exclusive to your previous tier be
1come unavailable. The economic adjustment is handled through an account credit rather than a cash refund: the unused portion of the higher-tier plan, calculated on a calendar-day pro-rata basis from the date of the downgrade through the end of the current billing period, is converted to a credit on your account ledger. That credit is automatically applied against your next invoice, including overage charges or the next renewal of your downgraded plan. We use credits rather than cash refunds for downgrades because the customer is continuing to use the Service, the credit is consumed within a short time horizon (typically the next billing cycle), and it avoids the friction of reversing a payment only to charge again days later. If you prefer a cash refund of the unused portion instead, simply email us within 7 days of the downgrade and we will process it in cash via Paddle, although the original 14-day guarantee is the simplest mechanism if you are within that window."}),(0,n.jsx)("h2",{children:"11. Upgrade Credits"}),(0,n.jsx)("p",{children:"The mirror image of a downgrade is an upgrade. When you move to a higher-tier subscription plan during a billing period, you immediately gain access to the additional features, larger quotas, and priority support entitlements of the new tier, but you do not pay the full new-tier price for the entire current billing period \u2014 that would unfairly double-bill you for the days already paid at the lower tier. Instead, we compute the unused calendar-day portion of your current plan, treat that as an account credit, and apply the credit against the first invoice of the upgraded plan. The new plan begins its own billing cycle from the upgrade date going forward; subsequent renewals proceed on the new schedule. For Enterprise customers under signed Order Forms, mid-term upgrades are governed by the Order Form (which may include negotiated upgrade pricing, true-up provisions, or volume-discount tiers) rather than this Section."}),(0,n.jsx)("h2",{children:"12. Non-Refundable Items"}),(0,n.jsx)("p",{children:"The following categories of charges are not refundable, regardless of the refund mechanism invoked, because they reflect amounts that have already been paid out to third parties or value that has been irrevocably consumed. We do not retain these amounts ourselves \u2014 passing them through is the only way to keep our Platform pricing competitive \u2014 and we therefore cannot return what we no longer hold. The non-refundable items are:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Monthly subscription charges after the 14-day guarantee window."}),(0,n.jsx)("li",{children:"Third-party pass-through fees (Meta messaging conversation charges, Twilio SMS costs, AI provider usage)."}),(0,n.jsx)("li",{children:"Custom integration or consulting services delivered."}),(0,n.jsx)("li",{children:"One-time credit packages that have been partially consumed."}),(0,n.jsx)("li",{children:"Domain registrations, SSL certificates (if procured)."}),(0,n.jsx)("li",{children:"Add-ons purchased separately (e.g., dedicated IP, premium support)."})]}),(0,n.jsx)("h2",{children:"13. Refund Denial Reasons"}),(0,n.jsx)("p",{children:"Although we strongly prefer to resolve refund requests in your favour wherever the circumstances reasonably support it, there are a small number of well-defined situations in which a refund cannot be granted. Denial does not mean we are dismissive of your concerns; it usually reflects either a contractual rule applied to all customers (so that we are not seen as preferring some over others), an anti-fraud control protecting all customers, or an upstream constraint imposed by Paddle, Meta, or another counterparty. We will always provide a written explanation for any denial, identify the specific provision of this Policy applied, and offer a path to escalation under Section 17. The denial reasons are:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Request outside the 14-day window (except for SLA breaches or consumer protection laws)."}),(0,n.jsx)("li",{children:"Evidence of Platform abuse, fraud, or Acceptable Use Policy violations."}),(0,n.jsx)("li",{children:"Chargeback already initiated with the payment provider."}
1),(0,n.jsx)("li",{children:"Account deletion requested before refund eligibility verified."}),(0,n.jsx)("li",{children:"Multiple repeat requests from the same customer (anti-abuse)."})]}),(0,n.jsx)("h2",{children:"14. Good Faith Exceptions"}),(0,n.jsx)("p",{children:"Hard-and-fast policy rules exist to ensure consistent, predictable, fair treatment of customers in routine cases \u2014 but real life produces situations that no policy can anticipate. We reserve and routinely exercise the discretion to grant refunds outside the strict letter of this Policy where doing so is the right thing to commercially or ethically. These goodwill refunds are not entitlements you can demand and are issued on a case-by-case basis, but our default posture is generosity rather than rigidity, particularly where the customer has acted in good faith and the situation is genuinely unusual. Common scenarios in which we have historically granted goodwill refunds include:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Prolonged service outages exceeding SLA."}),(0,n.jsx)("li",{children:"Clear billing errors or duplicate charges."}),(0,n.jsx)("li",{children:"Unauthorized transactions (after fraud investigation)."}),(0,n.jsx)("li",{children:"Significant feature removal without adequate notice."}),(0,n.jsx)("li",{children:"Exceptional customer hardship (case-by-case)."})]}),(0,n.jsx)("h2",{children:"15. Chargebacks"}),(0,n.jsx)("p",{children:'A "chargeback" is a payment-card-network mechanism that allows a cardholder to dispute a charge directly with their issuing bank, bypassing the merchant entirely. Chargebacks were originally designed to protect consumers against fraudulent merchants and unauthorised transactions, and they remain valuable for those purposes. However, when used as a substitute for a direct refund request \u2014 sometimes called a "friendly fraud" chargeback \u2014 they create significant collateral damage: the merchant (us, via Paddle) incurs a chargeback fee of USD 15\u201340 regardless of the outcome; both parties spend hours preparing and reviewing dispute evidence; the chargeback negatively affects our merchant-account standing, which over time can lead to higher processing fees that we ultimately have to pass on to all customers; and your own account may be flagged for risk by both us and Paddle, complicating future transactions. Direct refund requests, by contrast, are typically resolved within 48 hours, cost nothing on either side, and leave both parties in good standing. We therefore strongly encourage you to contact us first; if you initiate a chargeback without doing so, the following consequences apply:'}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Your account may be suspended pending investigation."}),(0,n.jsx)("li",{children:"We will provide evidence to the payment processor."}),(0,n.jsx)("li",{children:"If the chargeback is reversed, standard fees apply."}),(0,n.jsxs)("li",{children:["Please email ",(0,n.jsx)("a",{href:"mailto:".concat(l),children:l})," FIRST \u2014 we can usually resolve issues within 48 hours."]})]}),(0,n.jsx)("h2",{children:"16. Subscription Cancellation"}),(0,n.jsx)("p",{children:"Subscription cancellation and refund are related but distinct concepts. Cancellation means stopping the auto-renewal of your subscription so that no further charges occur after the end of the current billing period \u2014 your existing subscription continues to deliver value until that period ends. Refund means returning some or all of an already-paid amount to your payment method. The two interact: cancellation alone does not generate a refund of fees already paid, and a refund may or may not be accompanied by cancellation depending on what you request. For a clean exit you will normally want both \u2014 cancel the auto-renewal and (if you are within the eligibility window) request a refund for the most recent charge. Cancellation is intentionally frictionless and does not require explanation, retention conversation, or manager approval. Cancel your subscription at any time via:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Account settings: Settings \u2192 Billing \u2192 Cancel Subscription"}),(0,n.jsxs)("li",{children:["Email: ",(0,n.jsx)("a",{href:"mailto:".concat(l),children:l})]})]}),(0,n.jsx)("p",{children:"Cancellation takes effect at the end of the current billing period. You retain full access until then. No further charges occur after cancellation."}),(0,n.jsx)("h2",{children:"17. Dispute Escalation"}),(0,n.jsx)("p",{children:"Where you remain dissatisfied with our handling of a refund request after engaging with our standard support channels, we want to provide you with a clear, structured escalation path that gives the matter a fresh review at a more senior level and, if needed, signposts you to genuinely independent external bodies that can assist. Escalation is a right, not a favour \u2014 we keep this path open precisely because we know that we will sometimes get individual decisions wrong and that a customer's perspective on a contested matter deserves a second look. The escalation steps below are ordered from least disruptive (internal manager review) to most formal (external authority); we encourage starting at step 1 and only progressing to later steps if earlier ones have been exhausted. Whatever the outcome, we will not retaliate against any customer for exercising escalation rights \u2014 this is an explicit commitment of our customer-experience policy."}),(0,n.jsxs)("ol",{children:[(0,n.jsx)("li",{children:"Request escalation to the Billing Manager by replying to your ticket."}),(0,n.jsx)("li",{children:"Provide additional documentation if available."}),(0,n.jsxs)("li",{children:["If still unresolved, contact your local consumer protection authority:",(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Turkey:"})," T\xfcketici Hakem Heyeti"]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"EU:"})," European Consumer Centre (ECC-Net)"]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"UK:"})," Citizens Advice, Trading Standards"]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"US:"})," FTC, State Attorney General, BBB"]})]})]}),(0,n.jsxs)("li",{children:["EU Online Dispute Resolution: ",(0,n.jsx)("a",{href:"https://ec.europa.eu/consumers/odr",target:"_blank",rel:"noreferrer",children:"ec.europa.eu/consumers/odr"})]})]}),(0,n.jsx)("h2",{children:"18. Contact"}),(0,n.jsx)("p",{children:"If anything in this Refund Policy is unclear or you would like to discu
1ss a specific situation before raising a formal request, please reach out using the contact information below. We treat refund correspondence as priority customer-experience traffic and aim to respond within one business day. Including your account email and a brief summary of the situation in the first message saves a round-trip and accelerates resolution."}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Email (refunds, billing disputes):"})," ",(0,n.jsx)("a",{href:"mailto:".concat(l,"?subject=Refund%20Policy%20Question"),children:l})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Mailing address:"})," ",s,", Billing Department, ",o]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Business hours:"})," Monday\u2013Friday, 09:00\u201318:00 Europe/Istanbul (UTC+3), excluding Turkish public holidays."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Acknowledgment SLA:"})," within 1 business day. Final decision SLA: typically within 5 business days."]})]}),(0,n.jsx)(x,{})]})}function A(){return(0,n.jsxs)("div",{className:"lp-section",children:[(0,n.jsxs)("div",{className:"lp-intro",children:[(0,n.jsxs)("p",{children:['This Data Deletion Policy ("Deletion Policy", "Policy") is the dedicated public-facing instrument through which ',a,' ("Platform", "Service"), operated by ',s,' ("Company", "We", "Us") \u2014 a joint-stock company duly registered in the Republic of Turkey with its principal place of business in Istanbul \u2014 explains in granular detail your right to request the deletion (also called "erasure" or "the right to be forgotten") of your personal data, the procedural steps through which deletion requests are submitted and verified, the multi-stage deletion pipeline through which we propagate deleti
1ons across our production databases, search indexes, AI vector stores, object storage, sub-processor systems, and rolling backups, and the narrow legal exceptions under which residual data must continue to be retained even after a deletion request is honoured. The Policy applies to every category of personal data we hold about you in any capacity \u2014 whether you are a registered Customer of the Platform, an end-user of one of our Customers, a job applicant, a recipient of our marketing communications, or a person whose data has been processed for any other reason set out in our ',(0,n.jsx)("a",{href:"/privacy",children:"Privacy Policy"}),"."]}),(0,n.jsx)("p",{children:"The right to erasure is one of the foundational rights granted to data subjects by modern privacy law and reflects the broader principle that individuals should retain meaningful control over their personal information throughout its lifecycle. The right is enshrined in, among other instruments: Article 17 of the EU General Data Protection Regulation 2016/679 (GDPR), which sets out six discrete grounds on which erasure may be requested; Article 11(e) and Article 7 of the Turkish Personal Data Protection Law No. 6698 (KVKK), which specifically address the destruction of personal data when the underlying processing reasons no longer exist; Section 1798.105 of the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), which gives California residents a defined right to deletion subject to certain enumerated exceptions; Article 18(VI) of the Brazilian LGPD; the equivalent provisions of UK GDPR; the deletion-and-withdrawal-of-consent provisions of Canada's PIPEDA, Quebec Law 25, and equivalent provincial laws; the relevant articles of Japan's APPI, Singapore's PDPA, and Australia's Privacy Act 1988; and the contractual data-deletion-callback obligations imposed by Meta on every integrator of WhatsApp Business API, Instagram Messaging API, and Facebook page integrations. Our deletion procedures are unified across all of these frameworks \u2014 we do not operate parallel workflows by jurisdiction \u2014 which means that requesting deletion under any one regime in practice triggers the most protective treatment available across all of them."}),(0,n.jsx)("p",{children:"We have engineered the Platform with deletion as a first-class architectural concern rather than as a compliance afterthought. Every personal-data record we hold is tagged at creation time with a tenant identifier, a data-subject identifier, a category code, and a retention-policy code; this metadata enables a single deletion command to cascade automatically across primary databases, replicated read-replicas, full-text search indexes, AI embedding vector stores, voice-recording object storage in our cloud-storage tier, transactional logs, and our analytics warehouse, without leaving orphaned fragments behind. We acknowledge inbound deletion requests within forty-eight (48) hours, complete identity verification within three (3) business days, and finalise the substantive deletion within thirty (30) calendar days from the original request \u2014 the maximum statutory deadline under GDPR Article 12(3). For unusually complex requests (those involving large data volumes, multiple integrations, or onward notification to a high number of sub-processors), we reserve the right to extend the deletion window by up to sixty (60) additional days as expressly permitted by Article 12(3), with written notice to you setting out the reasons for the extension. Throughout the process you remain entitled to status updates, written confirmation upon completion, and a defined three-stage appeals path if you are dissatisfied with our handling."})]}),(0,n.jsx)(b,{}),(0,n.jsx)("h2",{children:"1. Your Legal Right to Erasure"}),(0,n.jsxs)("p",{children:['The right to request deletion of personal data \u2014 also known as the "Right to Erasure" or "Right to be Forgotten" \u2014 is one of the most fundamental and powerful rights granted to individuals under modern data protection laws around the world. This right reflects the principle that individuals should have control over their personal information, including the ability to withdraw from data-processing relationships and have their data removed from systems where it is no longer necessary or where the legal basis for processing no longer exists. At ',s,", we recognize and honor this right fully, and we have built our Platform's data architecture with deletion in mind \u2014 enabling granular, verified, and timely removal of personal data across all our systems, backups, and integrated sub-processors. The specific legal frameworks that grant you these rights, and that we honor in our deletion procedures, include the following:"]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"EU General Data Protection Regulation (GDPR) Article 17:"}),' Establishes the "Right to Erasure" (often called "Right to be Forgotten" in the popular press) for data subjects in the European Economic Area. This right applies when the data is no longer necessary for the purposes it was collected, when consent is withdrawn and there is no other legal basis, when processing was unlawful, when erasure is required by law, or when you object to processing and our grounds do n
1ot override yours. Our deletion procedures fully implement Article 17 including the notification obligations under Article 19.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Turkish Personal Data Protection Law (KVKK) Article 11(e):"})," Grants Turkish residents the specific right to request the erasure or destruction of their personal data when the reasons requiring processing no longer exist. KVKK Article 7 further specifies that data must be erased, destroyed, or anonymized when the purposes for processing have ceased, the retention period has expired, or you withdraw consent. We comply with these obligations for all Turkish users."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"California Consumer Privacy Act (CCPA) \xa71798.105 and California Privacy Rights Act (CPRA):"})," California residents have the right to request deletion of personal information that a business has collected about them, with certain exceptions for legal compliance, security, debugging, and specific other purposes. Our procedures honor CCPA deletion requests and respond within the statutory 45-day window (extendable to 90 days for complex cases)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Brazilian General Data Protection Law (LGPD) Article 18(VI):"})," Brazilian residents have the right to request the deletion of personal data processed with their consent. We process LGPD deletion requests through the same unified workflow used for GDPR requests."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"UK GDPR:"})," Following Brexit, the United Kingdom's data protection framework mirrors the EU GDPR with minor adjustments. UK residents have identical deletion rights, enforced by the UK Information Commissioner's Office (ICO)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Canada's Personal Information Protection and Electronic Documents Act (PIPEDA):"})," Canadian users have rights to request deletion and withdrawal of consent, subject to specific exceptions."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Meta Platform Terms and Developer Data Use Policy:"})," Meta requires all platform integrators to implement a Data Deletion Callback URL that automatically processes deletion requests when users revoke app access. We have fully implemented this requirement, detailed in Section 13 below."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Japan's Act on the Protection of Personal Information (APPI), Singapore's Personal Data Protection Act (PDPA), and Australia's Privacy Act 1988:"})," Similar deletion rights exist under these Asia-Pacific frameworks, and our unified deletion workflow accommodates requests from residents of these jurisdictions."]})]}),(0,n.jsx)("p",{children:"We do not discriminate against users who exercise their deletion rights. Exercising any of these rights is free of charge for reasonable requests, though we may charge a reasonable administrative fee for manifestly unfounded or excessive repeat requests as permitted by GDPR Article 12(5)."}),(0,n.jsx)("h2",{children:"2. What Data Can Be Deleted"}),(0,n.jsx)("p",{children:'Almost every category of personal data we hold about you is in scope for deletion when you submit a verified erasure request. Our internal data architecture is designed around the principle of "delete-by-design": records are tagged at creation time with a tenant identifier and a data-subject identifier, so that a single deletion command can cascade across user-facing databases, search indexes, AI vector stores, voice-recording object storage, transactional logs, and our analytics warehouse without leaving orphaned fragments behind. The categories below cover the common types of data; if you are unsure whether a specific item is covered, our DPO will walk you through your account\'s data inventory before processing the deletion. The deletable categories include:'}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Account information:"})," Name, email, phone number, company details."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Communication history:"})," WhatsApp/IG/Telegram/email messages processed through your account."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Voice data:"})," Call recordings and transcripts."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Usage data:"})," Platform interaction logs, session history."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Customer data:"})," End-user contacts and conversations in your workspace."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Content:"})," Uploaded files, documents, images in your account."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Preferences and settings:"})," Configuration, integrations, customizations."]})]}),(0,n.jsx)("h2",{children:"3. What Data We MUST Retain (Legal Exceptions)"}),(0,n.jsx)("p",{children:"Notwithstanding the broad scope of the right to erasure, every major data-protection framework recognises that certain residual data must \u2014 or in some cases may \u2014 continue to be retained even after a deletion request, because other overriding legal obligations attach to the data itself rather than to the data subject's preference. GDPR Article 17(3) enumerates these exceptions explicitly (compliance with a legal obligation, exercise of freedom of expression and information, performance of a task in the public interest, public-health reasons, archiving for scientific or historical research with appropriate safeguards, and the establishment, exercise, or defence of legal claims). KVKK Article 28 provides analogous exceptions under Turkish law. We apply these exceptions narrowly \u2014 only the minimum necessary data is retained, only for the minimum necessary period, only for the specific purpose justifying retention, and with strict access controls that prevent retained data from being used for any other purpose. Categories we may need to retain include:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Invoice & tax records:"})," 10 years (Turkish Commercial Code Art. 82)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Financial records:"})," 5 years (Turkish Tax Procedure Law)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Anti-fraud records:"})," As needed for fraud prevention, typically 5 years."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Legal hold data:"})," During active legal proceedings, disputes, or regulatory investigations."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Public interest data:"})," Where processing is required by law or for public interest (rare)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Defense of legal claims:"})," Evidence for existing or anticipated lawsuits."]})]}),(0,n.jsx)("p",{children:"Such retained data is kept encrypted with strict access controls and is not used for any other purpose."}),(0,n.jsx)("h2",{children:"4. Partial vs Full Deletion"}),(0,n.jsx)("p",{children:"The right to erasure is sometimes mistakenly understood as an all-or-nothing choice between keeping the account fully intact and wiping it entirely. In practice, modern data-protection law (and our Platform's architecture) supports a granular middle ground in which you can target deletion at specific categories, time ranges, integrations, or end-user records \u2014 preserving the rest of the account if you wish to continue using the Service. This flexibility is particularly valuable for B2B customers who need to delete a particular end-customer's data in response to a Data Subject Access Request from that end-customer, while continuing to operate other parts of their workspace normally. Available deleti
1on scopes:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Full account deletion:"})," All personal data removed, account closed, subscription cancelled, integrations disconnected, sub-processor data purged. Suitable when you are leaving the Service entirely."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Partial deletion by category:"})," Specific data categories only (e.g. voice recordings only, AI conversation history only, marketing-list contacts only). Account remains active."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Partial deletion by time range:"}),' All data created or modified within a specified date range (e.g. "delete everything older than two years" or "delete data from the Q1 2025 campaign window").']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Partial deletion by end-user:"})," All data relating to a specific end-customer of yours, identified by phone number, email, or end-user ID. Used to fulfil DSARs received by you as controller from your own customers."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Partial deletion by integration:"})," All data ingested through a specific integration (e.g. a now-disconnected Instagram page, a deprecated WhatsApp number)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Anonymisation in lieu of deletion:"})," Personal identifiers stripped while retaining aggregate or statistical value for analytics. Often the right answer where you want analytical history preserved without identifiable individuals."]})]}),(0,n.jsx)("h2",{children:"5. Soft Delete vs Hard Delete"}),(0,n.jsx)("p",{children:"From a technical-architecture standpoint, deletion is implemented as a multi-stage pipeline rather than a single instantaneous event, for two important reasons. First, accidental deletion is one of the most common forms of self-inflicted customer harm \u2014 accounts are sometimes deleted in error during a heated moment, by a departing employee, or as the result of a misunderstood UI flow \u2014 and a short reversibility window prevents irreversible data loss in those cases. Second, our backup architecture intentionally retains snapshots for disaster recovery; a deletion operation must propagate through both live systems and rolling backups, which inherently takes time. The deletion pipeline therefore has the following stages, each with its own retention characteristics:"}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Soft delete (Day 0 to Day 7, or Day 30 for non-self-service):"})," Data is marked as deleted in our metadata, removed from all customer-facing surfaces (UI, search, API responses), and access tokens are revoked. The underlying records remain physically present in the database but are inaccessible to all paths except internal recovery tooling. If you change your mind, contact support within this window and recovery is straightforward."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Hard delete from production (after grace period, within 30 days of original request):"})," Data is physically removed from primary production databases, search indexes, AI vector stores, and object storage. Recovery becomes impossible from this point onward except by restoring from backup (which we will not do absent extraordinary circumstances such as a regulator-ordered hold)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Backup expiration (within 90 days):"})," Our rolling backup strategy retains daily snapshots for 30 days and weekly snapshots for 90 days. Deleted data persists in those backups until the backups themselves expire and are cycled out of the rotation. Backups are stored encrypted and are accessed only for disaster-recovery operations under strict change-management; we do not query backups for any business purpose, including responding to access requests."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Sub-processor purge (parallel timeline, within 30 days):"})," Notification is sent to relevant sub-processors (Meta, Twilio, OpenAI, AWS, etc.) instructing them to delete derivative copies of the data they hold under our DPAs. Each sub-processor's own deletion timeline applies; we track confirmation receipts."]})]}),(0,n.jsx)("h2",{children:"6. Method 1: Self-Service (Fastest)"}),(0,n.jsx)("p",{children:'The fastest, most convenient way to delete your data is through the in-app self-service flow. The self-service path requires no email exchange, no identity verification (because you are authenticated through your active session), no waiting for a support agent, and starts the deletion clock immediately. The flow is intentionally protected behind a "Danger Zone" affordance with explicit confirmation prompts and a built-in 7-day grace peri
1od to prevent accidental deletions, but otherwise it is one click and done. Step-by-step:'}),(0,n.jsxs)("ol",{children:[(0,n.jsxs)("li",{children:["Sign in at ",(0,n.jsx)("a",{href:"https://chatpilots.ai/signin",children:"chatpilots.ai/signin"})]}),(0,n.jsxs)("li",{children:["Navigate to ",(0,n.jsx)("strong",{children:"Settings \u2192 Account \u2192 Danger Zone \u2192 Delete Account"})]}),(0,n.jsx)("li",{children:"Type your email to confirm."}),(0,n.jsx)("li",{children:"Receive confirmation email with a 7-day grace period to reverse if needed."}),(0,n.jsx)("li",{children:"After 7 days, deletion proceeds automatically."})]}),(0,n.jsx)("h2",{children:"7. Method 2: Email Request"}),(0,n.jsxs)("p",{children:["If you prefer to submit a deletion request through our Data Protection Officer, or if you cannot access your account to use the self-service method, you can send a formal written request via email to ",(0,n.jsx)("a",{href:"mailto:".concat(u,"?subject=Data%20Deletion%20Request"),children:u}),". Email requests undergo a more rigorous identity verification process since we must ensure that the person requesting deletion is actually the account holder, not an impersonator attempting to harm your business. To speed up processing and ensure your request is handled properly, please include the following information in your email (the more detail you provide, the faster we can complete verification):"]}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Subject line:"}),' Use exactly "Data Deletion Request" as the subject to help our workflow route your message to the correct team. Requests with unclear subjects may take longer to process.']}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Your registered email address:"})," The email address associated with your ",a," account. This must match what we have on file; if you have multiple accounts, specify which one(s) you want deleted."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Phone number (optional but helpful):"})," If you registered using or have associated a phone number (particularly common for WhatsApp Business integrations), providing it aids verification and ensures phone-linked data is also removed."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Scope of deletion:"})," Clearly specify what you want deleted. Options include: (a) full account deletion including all personal data, content, contacts, and settings; (b) partial deletion of specific data categories such as voice recordings only, chat history only, specific contacts, or specific date ranges; (c) deletion of data associated with a particular End-User only (if you are processing a Data Subject Access Request from one of your customers); or (d) anonymization rather than deletion (preserving analytics value while removing personally identifiable elements)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Reason for deletion (optional):"})," While not required by law, a brief explanation of your reason helps us improve our service and ensures we correctly interpret the scope. Common reasons include: no longer using the service, switching to a competitor, privacy concerns, compliance with regulatory obligations, or simply wanting to start fresh. Your reason does not affect whether we will process the request \u2014 we will honor it regardless."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Legal basis citation (optional):"})," If you are making the request under a specific legal framework (GDPR Article 17, KVKK Article 11, CCPA \xa71798.105, etc.), citing the specific article helps our legal team process your request with full awareness of applicable statutory timelines and procedures."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Preferred response method and timing:"}),' Let us know if you have a preference for how we should communicate during verification (email, phone, scheduled call) and whether you have any time constraints (e.g., "I need this completed before a specific date for regulatory reasons").']})]}
1),(0,n.jsx)("p",{children:"We acknowledge receipt of all deletion requests within 48 hours during business days. Verification of your identity typically takes 3 business days, after which the actual deletion process begins and is completed within 30 calendar days from the original request. If your request is unusually complex or implicates data held by multiple sub-processors, we may extend this period by up to 60 additional days (as permitted by GDPR Article 12(3)) with written notice to you explaining the reasons for the extension."}),(0,n.jsx)("h2",{children:"8. Method 3: Postal Mail"}),(0,n.jsx)("p",{children:"For customers who prefer to submit a deletion request through traditional postal mail \u2014 perhaps because of corporate documentation policies that require physical evidence of regulatory submissions, or because the request is being made by a legal representative on behalf of an estate or incapacitated person \u2014 we accept written deletion requests sent to our Data Protection Officer at the address below. Postal requests undergo the same identity-verification process as email requests and may take an additional 5\u201310 business days to reach our team and be entered into our case-management system. Please include a return address (postal or email) so we can confirm receipt and communicate during processing. Send to:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:s}),(0,n.jsx)("li",{children:"Attention: Data Protection Officer"}),(0,n.jsx)("li",{children:o})]}),(0,n.jsx)("h2",{children:"9. Identity Verification"}),(0,n.jsx)("p",{children:"Identity verification before processing a deletion request is not bureaucratic friction \u2014 it is a fundamental safeguard that protects you against malicious deletion attacks. An attacker who guesses or obtains your email address could otherwise impersonate you, request deletion, and irreversibly destroy your business data; or a disgruntled former employee, jealous partner, or competitor could try to harm you by issuing fraudulent deletion requests. To prevent this, every non-self-service deletion request undergoes identity verification proportionate to the sensitivity and scope of the request. Verification is free of charge for genuine data subjects and is normally completed within 1\u20133 business days; we use the minimum verification necessary for the request type. Verification methods include:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Confirmation email sent to your registered address."}),(0,n.jsx)("li",{children:"OTP to your registered phone (if applicable)."}),(0,n.jsx)("li",{children:"Additional verification for large accounts (government-issued ID if necessary)."})]}),(0,n.jsx)("h2",{children:"10. Deletion Timeline"}),(0,n.jsxs)("table",{children:[(0,n.jsx)("thead",{children:(0,n.jsxs)("tr",{children:[(0,n.jsx)("th",{children:"Stage"}),(0,n.jsx)("th",{children:"Timeline"})]})}),(0,n.jsxs)("tbody",{children:[(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Request acknowledgment"}),(0,n.jsx)("td",{children:"Within 48 hours"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Identity verification"}),(0,n.jsx)("td",{children:"Within 3 business days"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Grace period (self-service)"}),(0,n.jsx)("td",{children:"7 days"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Account access revocation"}),(0,n.jsx)("td",{children:"Immediate on approval"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Production database deletion"}),(0,n.jsx)("td",{children:"Within 30 days"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Backup deletion"}),(0,n.jsx)("td",{children:"Within 90 days (rolling backup rotation)"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Third-party service notification"}),(0,n.jsx)("td",{children:"Within 30 days"})]}),(0,n.jsxs)("tr",{children:[(0,n.jsx)("td",{children:"Confirmation email"}),(0,n.jsx)("td",{children:"Upon completion"})]})]})]}),(0,n.jsx)("h2",{children:"11. Third-Party Notification (GDPR Art. 19)"}),(0,n.jsx)("p",{children:'GDPR Article 19 imposes on every controller a positive duty to communicate any rectification, erasure, or restriction of processing carried out under Articles 16, 17(1), or 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. KVKK Article 11 contains an analogous "\xfc\xe7\xfcnc\xfc ki\u015filere bildirme" obligation. In practice, this means that when you exercise your right to erasure with us, we are legally required to push the deletion downstream to every sub-processor that holds a derivative copy of your data \u2014 not just delete it from our own systems. We have built our sub-processor management to supp
1ort this: each sub-processor relationship is governed by a Data Processing Agreement requiring them to honour onward deletion notices, and we maintain an internal register that lets us issue deletion notifications systematically rather than by ad-hoc email. Affected sub-processors typically include:'}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Meta (WhatsApp data)"}),(0,n.jsx)("li",{children:"Twilio (SMS/voice records)"}),(0,n.jsx)("li",{children:"OpenAI (any cached data \u2014 typically zero retention)"}),(0,n.jsx)("li",{children:"Paddle (retained only per tax law requirements)"}),(0,n.jsx)("li",{children:"AWS (infrastructure-level backups)"}),(0,n.jsx)("li",{children:"SendGrid (email logs)"})]}),(0,n.jsx)("h2",{children:"12. Data Anonymization Alternative"}),(0,n.jsx)("p",{children:"Anonymisation is a privacy-engineering technique that transforms personal data into a form from which a specific individual can no longer be identified by any reasonably likely means, taking account of all objective factors including the cost and the amount of time required for identification, the available technology, and technological developments. Properly anonymised data falls outside the scope of GDPR and KVKK altogether (GDPR Recital 26), which means it can be retained, shared, and analysed without further restriction. For some categories of data we offer anonymisation as a constructive alternative to outright deletion: it preserves analytical and statistical value (useful both for our service improvement and for your own operational reporting) while extinguishing the personal-data character that triggered your erasure right. Anonymisation is irreversible by design; once applied, the data cannot be re-linked to a specific individual. Important caveats:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Anonymisation removes all direct identifiers (name, email, phone, IP, account ID) and applies statistical techniques (k-anonymity, generalisation, perturbation) to indirect identifiers."}),(0,n.jsx)("li",{children:"The output may still be useful for aggregate metrics, A/B-test reporting, AI-model improvement (only on opted-in datasets), and regulatory benchmarking."}),(0,n.jsx)("li",{children:"Anonymisation cannot be reversed or re-identified; we have no technical mechanism to undo it."}),(0,n.jsx)("li",{children:"This option is preferred where you want historical analytics value preserved without identifiable individuals."}),(0,n.jsx)("li",{children:"You may always insist on full deletion instead; anonymisation is offered, not imposed."})]}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Removes all identifying information."}),(0,n.jsx)("li",{children:"Retains aggregated/statistical data for analytics."}),(0,n.jsx)("li",{children:"Cannot be reversed or re-identified."}),(0,n.jsx)("li",{children:"Preferred when we need historical analytics data."})]}),(0,n.jsx)("h2",{children:"13. Meta WhatsApp Data Deletion Callback"}),(0,n.jsx)("p",{children:"Meta (the parent company of Facebook, Instagram, and WhatsApp) requires all third-party applications integrated with its platforms to implement a standardized Data Deletion Callback mechanism. This is a server-to-server technical interface that enables individual users to request deletion of their data from a third-party app by revoking that app's access through Meta's own privacy settings, without needing to contact the third party directly. We have implemented this callback in full compliance with Meta's requirements, and it provides an additional convenient channel for you to delete data from our Platform if you connected our service through Facebook Login, Instagram Business Login, or similar Meta authentication flows."}),(0,n.jsxs)("p",{children:["The process works as follows: when you revoke app access to ",a," through Meta's settings, Meta's servers automatically send a signed deletion request to our callback endpoint. The request contains your Meta user identifier (a stable, anonymous ID that we can map back to your account in our system) and is cryptographically signed with our app secret so we can verify authenticity. Upon receiving and validating the request, our systems queue deleti
1on of your account data and all associated personal information. Meta provides a confirmation URL we return to them, which they display to you confirming the deletion was received."]}),(0,n.jsx)("p",{children:"To use this method to delete your data via Meta:"}),(0,n.jsxs)("ol",{children:[(0,n.jsxs)("li",{children:["Open the Facebook or Instagram app (or use the web version) and navigate to your account settings. On Facebook, go to ",(0,n.jsx)("strong",{children:"Settings & Privacy \u2192 Settings \u2192 Apps and Websites \u2192 Active"}),". On Instagram, navigate to ",(0,n.jsx)("strong",{children:"Settings \u2192 Apps and Websites \u2192 Active"}),"."]}),(0,n.jsxs)("li",{children:['Locate "',a,'" or "wsaas" in the list of connected apps.']}),(0,n.jsx)("li",{children:'Click or tap the app name to open its permissions page, then select "Remove" or "Disconnect" to revoke access.'}),(0,n.jsx)("li",{children:"Meta will prompt you to confirm and optionally choose to delete all associated data. Select the deletion option."}),(0,n.jsx)("li",{children:"Meta sends us an automated signed deletion request within minutes of your confirmation. No action from you is needed beyond this point."}),(0,n.jsx)("li",{children:"We process the request within 30 days (typically within 7-14 days), deleting your account, personal data, message history, and any Meta-linked identifiers from our systems."}),(0,n.jsx)("li",{children:"We retain deletion logs (showing that a deletion was performed, but not the deleted data itself) for audit compliance purposes for 2 years."})]}),(0,n.jsxs)("p",{children:["Technical details for developers and compliance officers: our Data Deletion Callback URL is registered with Meta at ",(0,n.jsxs)("code",{children:["https://",c,"/api/meta/data-deletion-callback"]}),", implementing the specification at ",(0,n.jsx)("a",{href:"https://developers.facebook.com/docs/development/create-an-app/app-dashboard/data-deletion-callback",target:"_blank",rel:"noreferrer",children:"Meta's Data Deletion Callback documentation"}),". The callback accepts HTTP POST with Meta's signed request format, verifies the HMAC-SHA256 signature, decodes the payload containing the user_id, performs account-level deletion operations, and returns a JSON response with a confirmation_code and status URL. We retain no personal data in the callback logs; only deletion confirmation timestamps are logged."]}),(0,n.jsx)("h2",{children:"14. Deletion Confirmation"}),(0,n.jsx)("p",{children:"Closing the loop on a deletion request is itself a compliance obligation: the right to erasure is meaningful only if the data subject has documentary evidence that the deletion was actually performed. We therefore generate a written confirmation for every completed deletion request, sent to the email address you used to make the request (or to the postal address for mailed requests). The confirmation is structured for easy filing in your own compliance records and contains the following elements:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Timestamp of deleti
1on."}),(0,n.jsx)("li",{children:"Summary of deleted data categories."}),(0,n.jsx)("li",{children:"Unique confirmation code for your records."}),(0,n.jsx)("li",{children:"Mention of any data retained per legal obligations."})]}),(0,n.jsx)("h2",{children:"15. Re-Activation Period"}),(0,n.jsx)("p",{children:"Recognising that deletion decisions are sometimes made impulsively, in error, or as the result of a misunderstanding (a legitimate user pressing the wrong button, a departing employee deleting the company account in anger, an upset moment that passes), we apply a 7-day reversibility window between the deletion request and the irreversible hard-delete stage. During this period your account is locked \u2014 features are inaccessible, scheduled messages are paused, integrations are disconnected \u2014 but the underlying data remains physically present in our systems and can be restored with a single command. Reactivation requires you to log in (which proves you still control the email address used for verification) or to contact our support team with information sufficient to verify your identity. Reactivation restores your data, settings, integrations, and subscription state to where they were at the moment of deletion request. After the 7-day grace period elapses, the data enters the hard-delete stage described in Section 5; from that point onward deletion is final and irreversible, and we will not attempt restoration from backups except under extraordinary circumstances such as a regulator-ordered legal hold."}),(0,n.jsx)("h2",{children:"16. Denial of Deletion Request"}),(0,n.jsx)("p",{children:"The default outcome of a deletion request is approval and execution. We deny or limit deletion requests only in the small number of narrow circumstances expressly permitted under data-protection law, where overriding interests recognised by the legislator make full deletion impossible or inappropriate. Denial is never a discretionary commercial decision on our part \u2014 it is an objective application of the legal exceptions under GDPR Article 17(3), KVKK Article 28, and analogous provisions in other jurisdictions. Where we deny or limit a request, we communicate the decision in writing, identify the specific legal exception relied upon, describe what data will be retained and for what defined period, and set out the appeal procedure. The narrow grounds on which we may deny or limit deletion are:"}),(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Data necessary to comply with a legal obligation."}),(0,n.jsx)("li",{children:"Data necessary for establishment, exercise, or defense of legal claims."}),(0,n.jsx)("li",{children:"Processing necessary for scientific/historical research with safeguards (rare)."}),(0,n.jsx)("li",{children:"Unverifiable identity of the requestor."})]}),(0,n.jsx)("p",{children:"Denials include written justification and appeal instructions."}),(0,n.jsx)("h2",{children:"17. Appeals"}),(0,n.jsx)("p",{children:"Every denial of a deletion request, every partial fulfilment that you consider inadequate, and every delay beyond the statutory 30-day window must be capable of independent review \u2014 first internally and then externally to ensure that data-protection rights are not nullified by the very entity tasked with respecting them. We provide a clearly defined three-stage appeals path, beginning with internal review by our DPO (who will reconsider the request with fresh eyes and is empowered to overrule the original decision), then escalating to your supervisory authority (which has formal investigatory and enforcement powers), and finally to the courts (which can award both injunctive relief and damages). Pursuing later stages does not require completing earlier stages, but we encourage starting with internal appeal because it is the fastest and least costly route to resolution. The appeal options are:"}),(0,n.jsxs)("ol",{children:[(0,n.jsxs)("li",{children:["Request internal appeal to our DPO: ",(0,n.jsx)("a",{href:"mailto:".concat(u),children:u})]}),(0,n.jsxs)("li",{children:["If unresolved, file a complaint with your supervisory authority:",(0,n.jsxs)("ul",{children:[(0,n.jsx)("li",{children:"Turkey: KVKK"}),(0,n.jsx)("li",{children:"EU: Your national DPA"}),(0,n.jsx)("li",{children:"UK: ICO"}),(0,n.jsx)("li",{children:"California: Attorney General"})]})]}),(0,n.jsx)("li",{children:"Seek judicial remedy under GDPR Art. 79 or equivalent law."})]}),(0,n.jsx)("h2",{children:"18. Contact"}),(0,n.jsx)("p",{children:"The single best channel for any data-deletion enquiry \u2014 questions about scope, requests for fulfilment, escalation of an outstanding ticket, complaints about handling \u2014 is our Data Protection Officer's dedicated mailbox. The DPO operates independently of the commercial and product teams and reports directly to senior management on data-
1protection matters, ensuring that deletion decisions are made on legal merit rather than on commercial preference. Mailbox details, response targets, and escalation procedures are summarised below."}),(0,n.jsxs)("ul",{children:[(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Email (DPO):"})," ",(0,n.jsx)("a",{href:"mailto:".concat(u,"?subject=Data%20Deletion%20Request"),children:u})]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Postal mail:"})," ",s,", Attention: Data Protection Officer, ",o]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Acknowledgment SLA:"})," within 48 hours."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Verification SLA:"})," within 3 business days."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Completion SLA:"})," within 30 calendar days (extendable by up to 60 additional days for unusually complex cases under GDPR Art. 12(3), with written notice and reasons)."]}),(0,n.jsxs)("li",{children:[(0,n.jsx)("strong",{children:"Out-of-scope queries:"})," general billing questions go to ",(0,n.jsx)("a",{href:"mailto:".concat(l),children:l}),"; security incidents go to ",(0,n.jsx)("a",{href:"mailto:".concat(h),children:h}),"."]})]}),(0,n.jsx)(x,{title:"Need to delete your data?",text:"Our DPO will process your request within 30 days, per GDPR and KVKK requirements."})]})}const P={terms:{title:"Terms of Service",eyebrow:"Legal Agreement",key:"terms",Component:function(){return(0,n.jsx)(v,{})}},privacy:{title:"Privacy Policy",eyebrow:"Privacy & Data Protection",key:"privacy",Component:function(){return(0,n.jsx)(w,{})}},refund:{title:"Refund Policy",eyebrow:"Billing & Refunds",key:"refund",Component:function(){return(0,n.jsx)(j,{})}},"data-deletion":{title:"Data Deletion Request",eyebrow:"User Data Rights",key:"data-deletion",Component:function(){return(0,n.jsx)(A,{})}}};function k(){const e=window.location.pathname.replace(/^\/+/,"").replace(/\/$/,"");let t=e;"privacy-policy"===e?t="privacy":"terms-of-service"===e?t="terms":"refund-policy"===e?t="refund":"data-deletion-instructions"===e||"data-deletion-request"===e?t="data-deletion":"cookies"===e?t="cookie-policy":"aup"===e&&(t="acceptable-use");const i=P[t];if((0,r.useEffect)(()=>{if(i){document.title=i.title+" | "+a+" - "+s;var e=document.querySelector("meta[name='description']");e&&e.setAttribute("content",i.title+" of "+a+" by "+s+". Effective "+p+".")}var t={htmlOverflow:document.documentElement.style.overflow,htmlHeight:document.documentElement.style.height,bodyOverflow:document.body.style.overflow,bodyHeight:document.body.style.height,bodyBg:document.body.style.background};document.documentElement.style.overflow="auto",document.documentElement.style.height="auto",document.body.style.overflow="auto",document.body.style.height="auto",document.body.style.background="#050814";var r=document.getElementById("root");return r&&(r.style.height="auto",r.style.minHeight="100vh",r.style.overflow="visible"),function(){document.documentElement.style.overflow=t.htmlOverflow,document.documentElement.style.height=t.htmlHeight,document.body.style.overflow=t.bodyOverflow,document.body.style.height=t.bodyHeight,document.body.style.background=t.bodyBg}},[i]),!i)return(0,n.jsxs)("div",{className:"lp-page",children:[(0,n.jsx)("style",{children:g}),(0,n.jsx)(f,{active:""}),(0,n.jsxs)("div",{className:"lp-hero",children:[(0,n.jsx)("h1",{children:"Page Not Found"}),(0,n.jsx)("p",{className:"lp-hero-updated",children:"The page you're looking for doesn't exist."})]}),(0,n.jsx)(y,{})]});const o=i.Component;return(0,n.jsxs)("div",{className:"lp-page",children:[(0,n.jsx)("style",{children:g}),(0,n.jsx)(f,{active:i.key}),(0,n.jsxs)("div",{className:"lp-hero",children:[(0,n.jsx)("div",{className:"lp-hero-eyebrow",children:i.eyebrow}),(0,n.jsx)("h1",{children:i.title}),(0,n.jsxs)("div",{className:"lp-hero-meta",children:[(0,n.jsxs)("span",{children:["Last updated: ",p]}),(0,n.jsxs)("span",{children:["Version: ",m]}),(0,n.jsx)("span",{children:"Effective immediately"})]})]}),(0,n.jsx)("div",{className:"lp-body",children:(0,n.jsx)("div",{className:"lp-card",children:(0,n.jsx)(o,{})})}),(0,n.jsx)(y,{})]})}}}]); 2//# sourceMappingURL=9484.33e62e74.chunk.js.map
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.