Privacy Policy
Effective date: 22.09.2026. The current version of this document is always published on this page.
Data Controller / Service Provider
- Legal entity: OSDO Arge Yazılım Sanayi ve Ticaret Limited Şirketi
- Product: osdosistan · Web: osdoarge.com
- Address: Yalı Mah. 6523 Sk. No:32 CB, 35550 Karşıyaka/İzmir
- Registered e-mail (KEP): osdo.arge@hs01.kep.tr
- KVKK / contact e-mail: info@osdoarge.com
- MERSIS/Tax: MERSİS: 0648181278400001 · Vergi No: 6481812784 (Çiğli VD)
1. Introduction and Scope
This Privacy Policy explains how personal data is processed within the osdosistan service provided by OSDO Arge. The service is offered to businesses established in Türkiye and to their customers; processing is carried out in line with Turkey’s Law No. 6698 (KVKK) and the WhatsApp/Meta platform terms.
The service is not offered to individuals located in the European Union. If a business nevertheless wishes to serve customers in the EU, GDPR obligations (including appointing a representative) rest with that business and must be notified to us in advance.
2. Our Roles: Controller and Processor
osdosistan operates on a two-layer data model and assumes different roles in each layer:
- Where we are the controller: Data of the business (SMB) users who sign up (name, contact, business and billing details, knowledge-base content).
- Where we are the processor: Message data of the business’s end-customers. Here the business (SMB) is the controller; we act only as a processor on the business’s behalf and instructions.
Under Art. 12/2 of the KVKK, the controller and the processor are jointly responsible for technical and administrative measures. The division of roles is further set out in the Data Processing Agreement (DPA) signed at each onboarding.
3. Personal Data Processed
3.1 Business (SMB) user data — as controller
- Identity and contact data: name, phone, e-mail.
- Business details: business name, address, representative, tax/billing information.
- Payment data (via the payment service provider; card details are not stored by us).
- Knowledge-base content and Business Rules: the service list, prices, opening hours, policies, FAQ, notes and campaigns the business defines for the assistant, and the general rules the assistant follows. This content is sent to the language-model provider so that the assistant can write its replies (Section 6).
- Transaction security data: sign-in records, IP address, session and device/browser information.
3.2 End-customer data — as processor
- Message content and attached files (photos, audio, documents) — WhatsApp.
- Sender phone number.
- Customer card: name, phone, e-mail, notes and tags recorded by the business or the assistant.
- Message timestamp and delivery metadata.
- Appointment/reservation details (date, time, party size and any additional information the customer shares).
The assistant does not collect information outside the business’s knowledge base. Special categories of personal data (health, belief, political opinion and similar) should not be written to the assistant; where such data appears, the conversation is handed off to a human. A business that will process special-category data because of its sector must notify us before setup and take additional measures.
3.3 Manager channel data
The business owner or representative also manages the assistant over Telegram. This channel carries the representative’s commands, summaries and reports and (if switched on for the business) the manager assistant’s replies. It may also carry the following end-customer data: when a conversation is handed to a human, the channel name and a partly masked customer identifier; the customer’s phone number inside the link of the button used to write to the customer; if the business has switched on this notification, the text of a customer question the assistant could not answer (at most 5 a day); if the manager assistant is on, appointment and customer records the representative asks for. Only a verified representative can access the manager channel. As Telegram is established abroad, this transfer falls under Section 8.
4. How Data Is Collected
- Through e-mails you send us and onboarding conversations.
- Through the account you create in the business panel and the knowledge-base content you enter.
- Through messages and files sent by end-customers to the business’s connected WhatsApp Business line (automated means).
- Through the commands and requests you send via the manager channel (Telegram).
- Through system and security records generated during use of the service (automated means).
The name, e-mail address, phone number (if given) and message you enter in the contact form on our website (osdosistan.com) are stored in our database on our server in Türkiye, together with the type of message (contact or demo request), the page language and the time of sending. Only our authorized staff read this information, in the admin panel; it is used only to answer your question and get back to you. We reply from our company e-mail address; if you gave your phone number, we may also call you. When a new message arrives, our staff receive a Telegram alert that states only the type and language of the message and contains no personal data. If you prefer not to use the form, you can e-mail us directly. When you visit the site, your IP address and the technical information your browser sends are processed on our server in Türkiye to deliver the page to you and keep the site secure; apart from this, the site sends no personal data to a server.
5. Purposes and Legal Bases
- Providing the service and performing the contract (answering customer messages, appointments and reminders, account management) — KVKK Art. 5/2-c.
- Answering the questions you send through the contact form on our website and getting back to you (demo, pricing, setup and other questions) — KVKK Art. 5/2-c where your request concerns entering into a service contract, otherwise legitimate interest, KVKK Art. 5/2-f.
- Billing and financial/legal obligations — KVKK Art. 5/2-ç.
- Security, abuse prevention and service quality — legitimate interest, KVKK Art. 5/2-f.
- Responding to legal claims and establishing/protecting rights — KVKK Art. 5/2-ç and 5/2-e.
- Marketing and promotional messages — only with your explicit consent (Art. 5/1). Consent is not a precondition of the service; withholding or withdrawing it does not affect the service.
Disclosure and explicit consent are handled separately; consent is never embedded in the disclosure text.
6. AI, Automated Processing and Model Training
Assistant replies are generated using a large language model. On first contact the assistant clearly tells end-customers that it is an AI assistant working on behalf of the business.
- No model training: Messages and knowledge-base content processed within the service are not used by us to train AI models. The terms in force of the model provider (OpenAI) and of the decision-layer provider (TypeSafe) likewise exclude training on data sent through the API; that commitment rests on each provider’s terms in force.
- Decision layer: What the end-customer’s message asks for (such as a new appointment, a change to an appointment or a question for information) and the assistant’s next step (such as offering a suitable time, asking a question or handing over to a representative) are determined by a separate classification model (TypeSafe) that does not write reply text; the reply text is written by the language model (OpenAI). The latest messages of the conversation (up to 20) are sent to the decision layer; phone numbers, e-mail addresses, IBANs and similar numbers and links are masked before sending, names and the rest of the message content are not. The knowledge base and the Business Rules are not sent to the decision layer.
- Knowledge base sent to the model: So that the assistant can write accurate replies, the business’s details (opening hours, address, service list and prices), the Business Rules text and the published policy, FAQ and note records in the knowledge base (at most 6000 characters in total for these records) are sent to the language-model provider (OpenAI) with every end-customer message, regardless of the message’s topic; other knowledge-base content is sent when it matches the question. If the business writes personal data into these fields (for example an employee’s name or phone number), that data is sent too; personal data should therefore not be written into these fields unless necessary.
- No fully automated decisions: No fully automated decision producing legal or similarly significant effects is made about a person.
- Scope limit: The assistant answers only from the business’s knowledge base; if the answer is not there it does not invent one and hands the conversation to a human. Price negotiation, medical and legal advice are out of scope by design.
7. Sub-processors and Third Parties
The following sub-processors are used to deliver the service. The current list is also published on the Sub-processor List page.
| Sub-processor | Country | Purpose | Data transferred |
|---|---|---|---|
| OpenAI, L.L.C. | USA | Large language model: writing the assistant’s replies to end-customer messages, tagging the message topic and drafting a knowledge-base answer for a question the assistant could not answer | The end-customer’s message and the last 10 turns of the conversation; with every reply, the business’s details, service list, Business Rules text and the published policy, FAQ and note records of the knowledge base (at most 6000 characters in total for these records); other knowledge-base content matching the question; results of operations such as the customer’s name and appointment details |
| TypeSafe AI, Inc. | USA | Decision layer: classifies what the end-customer’s message asks for and chooses the assistant’s next step; does not write reply text | The latest messages of the conversation (up to 20); phone numbers, e-mail addresses, IBANs and similar numbers and links are masked before sending, names and the rest of the message content are not. The knowledge base and the Business Rules are not sent |
| Meta Platforms Ireland Ltd. | Ireland (group infrastructure incl. USA) | WhatsApp Business messaging channel | Message content and attachments, sender phone number, delivery metadata |
| Telegram FZ-LLC | United Arab Emirates | Manager channel: notifications, summaries and reports for the business representative | Commands of the business representative; on handoff, the channel name and a partly masked customer identifier, and the customer’s phone number inside the link of the button used to write to the customer; if the business has switched on this notification, the text of a customer question the assistant could not answer (at most 5 a day) |
| SB SunucumBurada Bilişim Hizmetleri | Türkiye | Hosting and database | All service data (primary storage) and contact-form messages from our website |
| PayTR Ödeme Hizmetleri A.Ş. | Türkiye | Subscription billing | Billing and payment data of the business user |
Our relationship with sub-processors rests on each provider’s terms of service and, where offered, its data processing addendum. Business users are notified before any change to the sub-processor list takes effect. Apart from these, personal data is disclosed only to legally authorized public authorities, to the extent required by law.
Our website (osdoarge.com) is hosted on the infrastructure of Netlify, Inc. (USA). When you visit the site your IP address, and when you submit the contact and demo forms the information you enter, are processed through this provider. Netlify does not process the data of businesses or end-customers within the osdosistan service.
8. International Transfers
As shown in Section 7, reply generation, the decision layer, the messaging infrastructure and the manager channel necessarily run through providers established abroad. Message content and related metadata are therefore transferred abroad. The primary database and storage are in Türkiye; transfers abroad are limited to the minimum data required for the service to function.
To place these transfers on a legal basis compliant with KVKK Art. 9, the process of signing the Board’s Standard Contract and notifying the Board is being carried out; once completed, the basis in force is stated in this section. Transfers are in all cases limited to the minimum data required for the service to function.
Business (SMB) users must state this transfer in their own disclosure notices to end-customers; a ready disclosure notice is provided to them during setup.
9. Retention and Disposal
| Data | Retention period | Basis / note |
|---|---|---|
| End-customer message content | 90 days | The message body is irreversibly masked at the end of the period; the record itself remains without personal data |
| Files attached to conversations (photos, audio, documents) | 90 days | The file is deleted at the end of the period and when the account is deleted |
| End-customer contact reference (phone number in the conversation) | 90 days after the conversation falls silent | Masked if the conversation has stayed silent for that period |
| Appointment records | 90 days after the appointment date | Customer name, contact reference and appointment note are masked; the appointment record itself remains for reporting |
| Customer card (name, phone, e-mail, notes, tags) | Until the business deletes it or the account is deleted | The personal details of a card deleted in the panel are permanently deleted; conversation records follow their own period |
| Knowledge-base content and Business Rules | Until the account is deleted | The business can delete records in the panel. Deleted 7 days after the account-deletion request |
| AI processing records | Link to the person 30 days, record 90 days | Error, cost and quality review |
| Images and videos generated in the content studio | 30 days | Items marked as favourites are kept until the account is deleted |
| Business (SMB) account data | Until the account is deleted | Deleted or anonymized 7 days after the account-deletion request; the records in the rows below are kept for their own periods |
| Summary record of a business that has left the service (business name, representative name, phone, e-mail, address, reason for leaving) | 730 days | Created only when the account is closed and anonymized by an administrator |
| Invoices and financial records | 10 years | TCC Art. 82 (the longer of TCC and Tax Procedure Law applies) |
| Audit (access and action) records | 12 months | Security and abuse investigation |
| Website contact-form messages | 30 days | Automatically deleted from our database in Türkiye 30 days after sending; our authorized staff may delete them earlier. Any reply we send you by e-mail and the correspondence that follows are kept separately as e-mail correspondence |
| Messaging-consent records (explicit consent / commercial-message approval) | 3 years after the consent ends | Proof of consent and opt-out status (Regulation on Commercial Communication and Commercial Electronic Messages, Art. 13(2)) |
| Destruction (deletion) records | 3 years | Regulation on the Deletion, Destruction or Anonymization of Personal Data, Art. 7(3) |
| Data-subject application records | 3 years after the request is concluded | Proof of statutory response |
When a period expires, the data is deleted, destroyed or anonymized under Art. 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymization of Personal Data. For end-customer data the method applied is irreversible masking of the message body and of the name, contact reference and note; the record itself remains without personal data. This runs as an automated job at regular intervals; periodic destruction never runs at intervals of more than six months. System backups are kept for at most 30 days; deleted data leaves the backups at the end of that period.
See the Data Deletion Instructions page for deletion requests.
10. Security
- Encryption in transit (TLS).
- Third-party access keys and credentials (tokens) are stored with AES-256 envelope encryption; passwords are irreversibly hashed.
- Least-privilege principle and role-based access controls.
- Tenant (business) isolation is enforced at the database level through row-level security (RLS); every request can reach only the rows of its own business.
- Avoiding unnecessary writing of personal data to application logs.
- Representative verification on the manager channel; customer messages are never executed as management commands.
11. Data Breach Notification
Where a personal data breach becomes known: for data we control, notification is made to the Personal Data Protection Board as soon as possible and in any case within 72 hours, and to the affected individuals within the shortest reasonable time. For data we process on behalf of a business, we notify that business without delay; the obligation to notify the Board rests with the business. The notification chain follows a written internal procedure.
12. Your Rights (KVKK Art. 11) and How to Apply
You have the rights to learn whether your personal data is processed, request information about it, learn the purpose and whether data is used accordingly, know the third parties to whom it is transferred at home or abroad, request correction of incomplete or incorrect data, request deletion or destruction, request that such actions be notified to transferees, object to an adverse result arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.
For the application procedure, required information and time limits, see the Data Subject Application Form and Procedure page. If you are applying as an end-customer, the controller is the business you interact with; you should address your request to it first, and you may also send it to us.
13. Cookies and Local Storage
Our website (osdoarge.com) uses no cookies, local storage or third-party analytics/tracking. If a non-essential cookie is introduced in future, a separate Cookie Policy will be published and your explicit consent obtained beforehand. The business panel uses only cookies strictly necessary to maintain your session.
14. Changes, Version and Effect
This policy may be updated. Business users are notified a reasonable time before material changes take effect. The current version is published on this page. Effective date: 22.09.2026.
In case of conflict between the Turkish and English versions, the Turkish text prevails.