Privacy Policy

1. Who we are and our roles

Service provider: Clevortex. Contact: info@clevortex.com; for personal data requests: kvkk@clevortex.com.

For the conversations businesses have with their customers and the bookings they take, the business you are dealing with (clinic, restaurant, shop, etc.) is the data controller. Clevortex processes this data on the business's behalf and on its instructions (data processor).

Clevortex is the data controller for businesses' Clevortex accounts, subscriptions and billing details.

2. Data we receive from Instagram and WhatsApp

When you message a business on Instagram or WhatsApp, the following data reaches us through Meta's official messaging interfaces:

• Message content (the text you write; voice messages and images are not processed)
• Your Instagram username and account ID (if you write on Instagram)
• Your phone number and WhatsApp profile name (if you write on WhatsApp)
• The date and time of messages
• Details you share for a booking, reservation or order: name, phone number, date and time, service or product, and any address or notes

A business that connects its account to Clevortex grants only messaging and basic account information permissions; we do not access your posts, followers or any other accounts.

3. Purposes and legal bases

• Answering your messages and questions with AI-assisted replies — performance of a contract / steps at your request (GDPR Art. 6(1)(b)) and the business's legitimate interest in responding (Art. 6(1)(f))
• Creating, changing and cancelling bookings, reservations or orders — performance of a contract (Art. 6(1)(b))
• Handing the conversation over to a member of the business's staff when needed (Telegram notification) — legitimate interest (Art. 6(1)(f))
• Security, abuse prevention and troubleshooting — legitimate interest (Art. 6(1)(f))
• Complying with legal obligations — legal obligation (Art. 6(1)(c))

Your data is not used for advertising, profiling or sale, and is never sold to third parties. We do not make decisions producing legal or similarly significant effects about you solely by automated means; you can always ask to speak to a person.

4. Masking

Before a message is sent to an AI provider, your name, phone number and Turkish ID number are masked automatically (e.g. "[AD_1]", "[TEL_1]"). E-mail addresses, street addresses and anything else you write in the message (e.g. a health complaint) may currently be passed on unmasked; we recommend sharing such details with the assistant only when necessary. The mapping used to reverse the masking is kept only on our own servers, for at most 7 days.

5. Retention

• Message logs: 90 days, then deleted automatically
• Masking mappings: at most 7 days
• Booking, reservation and order records: while the business account is open; deleted within 30 days after the business closes its account
• Error logs: 90 days
• Support access logs (which record authorised staff viewed): 2 years
• Records that must be kept by law (e.g. invoices): for the statutory period

6. Sub-processors

We work with the following providers to deliver the service; each processes data only for the stated purpose:

• Natro (Türkiye) — Hosting of the database, automation and e-mail servers; records are stored in Türkiye
• Netlify, Inc. (USA) — Hosting and running the website, the chat window and the dashboard application; no records are stored permanently
• OpenAI, L.L.C. (USA) — AI replies for subscribers' assistants and for the demo chat on our website (in separate projects); content is not used for model training
• Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (Ireland / USA) — Delivery of WhatsApp and Instagram messages
• Telegram FZ-LLC (United Arab Emirates) — Delivering new request and handover notifications to the business
• Google (Gmail) (USA / Ireland) — Operations notifications, no personal data

Under its API terms, OpenAI does not use the content sent to it to train its AI models.

7. International transfers

Our database and automation servers are in Türkiye (Natro). The dashboard and the online booking form run on Netlify (USA); the AI replies of the assistant and of the demo chat on our website are generated with OpenAI (USA), in separate projects; WhatsApp and Instagram messages are delivered via Meta's infrastructure and notifications to the business via Telegram. Transfers to these providers abroad take place only to the extent the service requires and, for Turkish law, under KVKK Art. 9. Where the GDPR applies, transfers outside the EEA/UK rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision. In text sent to AI providers, your name, phone number and Turkish ID number are masked (see Masking).

8. Your rights

Depending on the law that applies to you, you have the right to:

• access your personal data and obtain a copy
• have inaccurate data corrected
• have your data erased
• restrict or object to processing, including processing based on legitimate interests
• data portability (receive the data you provided in a machine-readable format)
• withdraw consent at any time where processing is based on consent
• lodge a complaint with a supervisory authority — in Turkey the Personal Data Protection Authority (KVKK), in the EU/UK the authority of your country of residence

To exercise these rights, contact the business first, or use the form on our Data Deletion page or write to kvkk@clevortex.com. We respond within 30 days (GDPR: within one month, extendable by two months for complex requests).

9. Security

Data is transmitted over encrypted connections (HTTPS); each business can only see its own data (row-level access control). Authorised staff access for support is protected by two-factor authentication and every access is logged.

10. Changes

We may update this policy. We will announce material changes on this page and by email to businesses.