UlakChat ("Company", "we", "our") is committed to protecting the privacy of our users. This Privacy Policy explains what personal data we collect, how we process it, with whom we may share it, and the rights you have, in connection with the ulakchat.com website and the UlakChat SaaS platform.

1. Data Controller

The data controller responsible for your personal data under this policy is:

Name: Berk Karasu (Sole Proprietorship)
Address: GELİNCİK MAH. DEFNE SK. NO: 9 İÇ KAPI NO: 7 MERKEZ/SİNOP, TURKEY
Email: [email protected]
Tax Office / Tax ID: Sinop / 5200367113

This policy applies when you use our website, platform, support channels, and integrations.

2. Personal Data Collected

The following personal data may be collected when you use UlakChat services:

2.1. Data You Provide Directly

Identity Information: First name, last name.
Contact Information: Email address.
Account Information: Username, password (stored as a hash), profile details.
Payment Information: Payment details processed through the iyzico payment infrastructure. Your card information is not stored by UlakChat; all payment data is processed within iyzico's PCI-DSS compliant infrastructure.
Social Media Information: Account IDs, access tokens, and profile information for Facebook, Instagram, and other integrations.

2.2. Data Collected During Service Usage

Chatbot Message Content: Message history between users and chatbots (solely for the purpose of providing the service).
Technical Information: IP address, device and browser information, operating system, screen resolution.
Usage Data: In-platform interactions, feature usage frequency, session durations.
Preferences: Language and theme settings, notification preferences.

3. Purposes of Data Processing

Your personal data is processed for the following purposes:

Creating, verifying, and managing user accounts,
Creating and managing chatbot flows,
Providing social media integrations,
Subscription management, payment processing, and invoicing,
Performance measurement, debugging, and analytics reporting,
Personalizing user experience (theme, language, preferences),
Providing technical support and customer service,
Ensuring platform security and preventing misuse,
Fulfilling legal obligations and resolving potential disputes,
Marketing communications (newsletters, campaigns) with explicit consent.

4. Legal Basis for Data Processing

Your personal data is processed based on the following legal grounds under Turkish Personal Data Protection Law (KVKK) No. 6698, Article 5, and where applicable, under the GDPR:

Performance of a contract: Providing subscription services, account management, and payment processing.
Legitimate interest: Platform security, debugging, performance improvement, and analytics.
Legal obligation: Tax legislation, log records under Turkish Law No. 5651.
Explicit consent: Marketing communications, analytics cookies, and optional data processing activities.

5. Services and Third Parties

UlakChat works with the following third-party service providers to deliver its services:

Cloudflare: DDoS protection, SSL certificates, CDN, and web security.
Hetzner: Hosting and infrastructure services (data may be stored on Hetzner servers).
Google Analytics: Anonymous analysis of site traffic and user behavior.
iyzico: Online payment processing. Card information is processed and stored solely by iyzico.
Facebook / Instagram API: Authentication, messaging, and chatbot integration.

These service providers can only access the data necessary for the provision of the service and operate within the framework of their own privacy policies.

Use of Google Analytics

UlakChat uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, to analyze website traffic and improve our services. GA4 collects anonymized data about how you use our site through cookies and similar technologies (e.g., pages visited, time spent on site, device type, city-level geographic information).

Your IP addresses are anonymized during processing. This data is not used to personally identify you and is stored on Google servers.

You can disable this data collection at any time by rejecting the "Analytics" category in our cookie preferences panel. You may also use Google's official Opt-Out tool: https://tools.google.com/dlpage/gaoptout

For more information about GA4: https://policies.google.com/privacy

6. International Data Transfers

Some of the service providers used by UlakChat (Cloudflare, Google Analytics, Facebook/Instagram API) may process data on servers located outside of Turkey. In such cases:

Data transfers are conducted in accordance with Article 9 of KVKK No. 6698, to countries that provide adequate protection or to data controllers that commit to adequate safeguards.
GDPR compliance, Standard Contractual Clauses (SCCs), or equivalent security measures are required from service providers receiving data transfers.
Payment data is processed by iyzico within Turkey and is not transferred abroad.

7. Data Retention Period

When a user account is deleted, personal data is permanently deleted within a maximum of 90 days.
Log records maintained under Turkish Law No. 5651 are retained for a maximum of 2 years.
Payment and invoice records are retained for 10 years as required by tax legislation.
Cookies and localStorage data are retained according to browser settings, depending on their type.
Data whose retention period has expired is periodically deleted or anonymized.

8. Data Sharing

Data may be shared with the service providers listed in Section 5 where necessary for the provision of the service.
Limited data is shared with iyzico for payment processing.
Only necessary identification data is shared through Facebook and Instagram APIs.
Data may be transferred in response to legal requests from official authorities.
Data is not shared with third parties for commercial purposes without explicit consent.
UlakChat never sells personal data to third parties under any circumstances.

9. Cookies and Similar Technologies

UlakChat uses cookies and localStorage to improve its services.

Essential Cookies: Login, security, privacy preferences.
Analytics Cookies: Site performance and usage analysis (Google Analytics).
Preference Cookies: Remembering language and theme preferences.
Social Plugin Cookies: Social media integrations.
Local Storage: Language and theme preferences, access tokens.

For detailed information about cookies, please see our Cookie Policy page. Users can change their preferences through browser settings or the cookie management panel on our site.

10. Data Security

UlakChat implements the following technical and administrative measures to protect your personal data:

Encryption: Sensitive data is encrypted with AES-256.
Communication Security: All data transmission occurs over HTTPS (TLS).
Access Control: Data access is restricted through Role-Based Access Control (RBAC).
Password Security: User passwords are stored using hash algorithms and are never recorded in plain text.
Monitoring and Logging: Regular logging and access controls are implemented.
Security Testing: Scheduled penetration tests and security audits are conducted.

11. User Rights

Under KVKK (TURKEY) and GDPR (EU), users have the following rights:

To learn whether their personal data is being processed,
To request information if their data has been processed,
To learn the purpose of processing and whether data is used in accordance with its purpose,
To know the third parties to whom personal data has been transferred, domestically or abroad,
To request correction of incomplete or inaccurately processed data,
To request deletion or destruction of personal data under the conditions set forth in the applicable law,
To object to processing,
To exercise the right to data portability,
To object to any outcome arising from automated analysis of their data,
To withdraw marketing consent,
To claim compensation for damages caused by unlawful processing of personal data.

To exercise these rights, you may send an email to [email protected]. Your requests will be responded to free of charge within a maximum of 30 days.

12. Age Policy

UlakChat services are subject to the age policies of the integrated social media platforms (Facebook, Instagram, etc.). Users are required to meet the minimum age requirements set by the respective social media platforms.

If it is determined that personal data belonging to an individual who does not meet the minimum age requirement has been collected, the relevant data will be deleted immediately. If you become aware of such a situation, please contact us at [email protected].

13. Policy Changes

This Privacy Policy may be updated as necessary. Changes take effect immediately upon publication.

In the event of significant changes, our users will be notified through one or more of the following methods:

Sending a notification to the registered email address,
Displaying an in-platform notification or banner,
Updating the "Last Updated" date on the Privacy Policy page.

If you do not accept the updated policy, you reserve the right to discontinue your use of the service.

14. Contact

For any questions or requests regarding this privacy policy, your personal data, or your rights, you can reach us through the following channels:

Email: [email protected]
Web: ulakchat.com

15. Consent and Effective Date

By continuing to use UlakChat services, you are deemed to have accepted this Privacy Policy. This policy entered into force in March 2026.