Privacy Policy

1. Scope and Data Controller

This Privacy Policy explains how BozLat AI ("we", the "Service") processes the personal data of businesses using the platform ("Customers") and people who communicate with Customer bots ("End Users"), including under Türkiye's Personal Data Protection Law No. 6698 (KVKK).

2. Data We Collect

• Customer account data: name, email, phone number, business information, and payment records. Card details are processed by the payment provider and are not stored by us.
• End-user conversation data: bot conversations and contact details shared through WhatsApp, Instagram, web chat, or phone.
• Usage data: login times, features used, and error logs used to improve service quality.
• Visit records: when you visit the site we record, server-side, your IP address, browser user-agent, page viewed, referring address, language, and device type. This is a structured form of the server access log, kept under legitimate interest for security and traffic analysis, and is not subject to cookie consent.
• Contact form data: name, business name, phone/email, selected channel, message content, and explicit consent timestamp.

3. How We Use Data

We process data only to provide the Service, manage accounts, bill customers, provide technical support, and meet legal obligations. End-user conversation data belongs to the relevant Customer and is not used for purposes unrelated to that Customer's bot.

Legal bases for processing (KVKK Art. 5 / GDPR Art. 6):

• Performance of a contract — account and service data
• Explicit consent — contact form and marketing data
• Legal obligation — payment and invoice records (10 years under tax law)
• Legitimate interest — security and service quality logs, and visit records (IP, page, browser information)

4. Data Sharing and Sub-processors

We do not share personal data with third parties unless legally required. We use the following sub-processors to provide the Service:

Contracts with these providers limit their access to data solely to the provision of the relevant technical service.

International transfers

For providers located outside Türkiye in the table above, your personal data is transferred abroad. Such transfers are carried out under Article 9 of KVKK, relying on the data subject's explicit consent or one of the appropriate safeguards provided by law (standard contract, undertaking, etc.). For transfers subject to GDPR, the European Commission's Standard Contractual Clauses (SCCs) apply.

5. Data Security

Data is transmitted over encrypted HTTPS/TLS connections and access is limited to authorized systems. Passwords are stored using one-way hashing. Our systems undergo regular security assessments.

6. Data Retention

• Account and service data: Duration of subscription + 6 months after account closure.
• Conversation logs: Active plan duration + 1 year.
• Payment and invoice records: 10 years as required by tax law.
• Contact form data: 6 months from consent date.
• Security logs: 90 days.
• Visit records: 12 months.

7. Your Rights Under KVKK

Under Article 11 of KVKK, you have the following rights:

• Whether your data is being processed
• Requesting information if it is being processed
• Learning the purpose and whether it is used accordingly
• Learning about domestic/international transfers
• Requesting correction of incomplete/inaccurate data
• Requesting deletion or destruction under KVKK
• Requesting notification of corrections/deletions to third parties
• Objecting to results arising from automated analysis
• Requesting compensation for damages

Additional rights under GDPR (if you are in the EU/EEA)

• Withdraw your consent at any time (GDPR Art. 7(3)) — withdrawal does not affect the lawfulness of processing carried out beforehand. You can change cookie preferences via the “Cookie Preferences” link in the footer.
• Request data portability (Art. 20)
• Request restriction of processing (Art. 18)
• Object to processing based on legitimate interests and to direct marketing (Art. 21)
• Lodge a complaint with a supervisory authority (Art. 77). In Türkiye: the Personal Data Protection Authority (kvkk.gov.tr).

To exercise these rights, contact us at destek@boz.lat or use our online request form. Requests are answered within 30 days.

8. Cookie Policy

Our website uses the following categories of cookies:

No consent-requiring measurement runs before you give consent. You can change or withdraw your choice at any time via the “Cookie Preferences” link in the footer. You can also manage and delete cookies through your browser settings; blocking essential cookies may impair the functioning of the service.

9. Children's Privacy (Under 18)

Our Service is not directed at persons under 18 years of age, and we do not knowingly collect personal data from them. If we become aware that we have processed data of a user under 18, we will promptly delete it.

10. Data Breach Notification

In the event of a personal data breach affecting your data, the competent authority will be notified within 72 hours under KVKK Art. 12/5. In case of high-risk breaches, affected individuals will be notified as soon as possible.

11. Changes

We may update this Policy from time to time. The current version is always published on this page. Material changes will be announced via platform notification or email.

12. Contact

For questions about this Privacy Policy or data subject requests: destek@boz.lat

→ Online Data Request Form