Sub-processor List
Effective date: 22.09.2026. The current version of this document is always published on this page.
This page lists the sub-processors used to deliver the osdosistan service. In line with the rule against “general and ambiguous statements” in the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation, recipients are shown by name, country and purpose.
Sub-processors in Use
| Sub-processor | Country | Purpose | Data transferred |
|---|---|---|---|
| OpenAI, L.L.C. | USA | Large language model: writing the assistant’s replies to end-customer messages, tagging the message topic and drafting a knowledge-base answer for a question the assistant could not answer | The end-customer’s message and the last 10 turns of the conversation; with every reply, the business’s details, service list, Business Rules text and the published policy, FAQ and note records of the knowledge base (at most 6000 characters in total for these records); other knowledge-base content matching the question; results of operations such as the customer’s name and appointment details |
| TypeSafe AI, Inc. | USA | Decision layer: classifies what the end-customer’s message asks for and chooses the assistant’s next step; does not write reply text | The latest messages of the conversation (up to 20); phone numbers, e-mail addresses, IBANs and similar numbers and links are masked before sending, names and the rest of the message content are not. The knowledge base and the Business Rules are not sent |
| Meta Platforms Ireland Ltd. | Ireland (group infrastructure incl. USA) | WhatsApp Business messaging channel | Message content and attachments, sender phone number, delivery metadata |
| Telegram FZ-LLC | United Arab Emirates | Manager channel: notifications, summaries and reports for the business representative | Commands of the business representative; on handoff, the channel name and a partly masked customer identifier, and the customer’s phone number inside the link of the button used to write to the customer; if the business has switched on this notification, the text of a customer question the assistant could not answer (at most 5 a day) |
| SB SunucumBurada Bilişim Hizmetleri | Türkiye | Hosting and database | All service data (primary storage) and contact-form messages from our website |
| PayTR Ödeme Hizmetleri A.Ş. | Türkiye | Subscription billing | Billing and payment data of the business user |
Those Established Abroad
In the list above, OpenAI (USA), TypeSafe (USA), Meta (Ireland / group infrastructure incl. USA) and Telegram (United Arab Emirates) are established abroad. Transfers to these providers fall under Art. 9 of the KVKK.
To place these transfers on a compliant legal basis under KVKK Art. 9, the process of signing the Board’s Standard Contract and notifying the Board within five business days of signature is being carried out; the basis in force is stated on this page once completed.
The primary database and storage are in Türkiye. Data transferred abroad is limited to the minimum required for the service to function: message content, recent conversation history, business details and knowledge-base content sent to the model provider (OpenAI) so a reply can be written; the latest messages, with numbers and links masked, sent to the decision layer (TypeSafe) so the assistant’s next step can be chosen; content and metadata passing through the messaging platform so the message can be delivered; and the summaries, reports and end-customer data listed in Section 3.3 of the Privacy Policy sent over the manager channel (Telegram).
Change Notification
Where a sub-processor is added or changed, business users are notified before the change takes effect, so the business can update its own disclosure notice. The provider reserves the right to make such changes for service continuity.
Model Training
Messages and knowledge-base content processed within the service are not used by us to train AI models. The terms in force of the model provider (OpenAI) and of the decision-layer provider (TypeSafe) likewise exclude training on data sent through the API; that commitment rests on each provider’s terms in force, and this page is updated if those terms change.
Currency
This list is current as of 22.09.2026. For questions: info@osdoarge.com