Personal Data Protection Notice (KVKK)

This is a courtesy translation for information only. The Turkish version is legally binding: KVKK Aydınlatma Metni (Türkçe).

Last updated: October 3, 2026

Pursuant to Article 10 of Personal Data Protection Law No. 6698 ("KVKK"), this notice explains how the personal data of representatives and employees of businesses using the FoxTekno service, and of visitors to our website, are processed.

1. Data controller

FoxTekno Yazılım Ltd. Şti.
Address: Bursa
MERSIS no.: 125432425
Email: [email protected]

For messages received from a business's own customers, the business concerned is the data controller; FoxTekno acts as a data processor, processing this data on behalf of and on the instructions of the business.

2. Personal data processed

Identity: first and last name, business name.
Contact: email address, phone number (if provided).
Customer transaction: plan, usage and billing information, support requests, sign-up source (referral code, campaign tag).
Transaction security: irreversible hash of the password, two-step verification data, IP address, browser/device information, session and login records.
Marketing: your preference for campaign and product news communications, only if you have given consent.
Message content: messages, voice messages and images received through the channels connected by businesses (on behalf of the business).

3. Purposes of processing

Opening the account, providing the service and performing the contract,
Generating and delivering replies to customer messages on behalf of the business,
Ensuring account security and preventing abuse and unauthorized access (e.g. notification of sign-in from a new device),
Sending service emails such as verification, password reset and usage limit notices,
Fulfilling legal obligations and responding to requests from competent authorities,
Announcing campaigns and product news, if you have given consent.

4. Legal grounds

Your personal data are processed on the grounds set out in Article 5(2) of the KVKK: processing is directly related to the conclusion or performance of a contract (c), necessary to fulfil a legal obligation (ç), necessary for the establishment, exercise or protection of a right (e), and necessary for our legitimate interests provided that your fundamental rights and freedoms are not harmed (f). Commercial electronic messages are sent only on the basis of your explicit consent, which you may withdraw at any time.

5. Transfers

Your personal data are shared with the following service providers to the extent necessary to provide the service:

Google LLC (Gemini AI API: message content for generating replies; name and email if you choose to sign in with Google),
Cloudflare, Inc. (delivery of site traffic, attack and bot protection),
Meta Platforms and Telegram (delivery of messages on the channels connected by the business, under their own terms),
Our email delivery service provider and our hosting (server) service provider,
Public authorities and institutions legally authorized to request data (upon request).

Since some of these providers have servers located abroad, data may be transferred abroad in accordance with the procedures and safeguards set out in Article 9 of the KVKK.

6. Method of collection

Data are collected electronically, by automated or partly automated means, through sign-up and settings forms, Google sign-in, use of the dashboard, connected messaging channels and cookies.

7. Retention periods

Account data are kept for as long as the account remains open and for the limitation periods set out in the applicable legislation.
Conversations are deleted automatically at the end of the period chosen by the business (90 days by default).
Security records are kept for 12 months.
When an account is deleted, its users, channels, conversations and documents are deleted immediately.

8. Cookies

Our website does not use advertising or tracking cookies. Only cookies that are strictly necessary for the operation and security of the service are used:

ft_session: keeps you signed in (30 days if "Remember me" is selected, otherwise until the browser is closed).
ft_device: remembers your device so that we can warn you when someone signs in from an unrecognized device (1 year).
gsign_state: verifies that a Google sign-in belongs to you (10 minutes).
ft_admin_session: used only while our support team is reviewing your account.
Cloudflare security cookies (e.g. __cf_bm, cf_clearance): used to distinguish bot traffic.

Because strictly necessary cookies are required to provide the service, they are not subject to explicit consent. You can delete cookies in your browser settings; in that case you will be signed out.

9. Your rights

Under Article 11 of the KVKK, you have the right to: learn whether your personal data are processed; request information if they have been processed; learn the purpose of processing and whether data are used in line with that purpose; know the third parties in Türkiye or abroad to whom data are transferred; request correction if data are incomplete or inaccurate; request erasure or destruction under the conditions set out in Article 7 of the KVKK and request that these actions be notified to third parties to whom the data were transferred; object to any outcome against you arising from analysis exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.

10. Applications

You can send requests regarding your rights to [email protected] from the email address registered to your account, so that we can verify your identity, or send them in writing to the address above. Applications are concluded free of charge within 30 days at the latest.

See also: Privacy Policy · Terms of Service