LEGAL
Privacy Policy
Last updated: August 2026
This is a draft; legal review is recommended before publication.
This Privacy Policy explains for what purposes and how Response360 processes personal data. It is prepared to align with KVKK and GDPR requirements.
1. Data controller
Response360 [company name / address / VERBİS no]. Contact: [email protected]. With respect to a tenant’s own customer data, the tenant is the “controller” and Response360 acts as “processor” (see the Data Processing Agreement).
2. Personal data processed
- Customer message content (text and attachments).
- Contact identifiers: phone number, email address.
- Business (tenant) information and authorized-user account details.
- Usage and log data (audit records, IP address, timestamps).
3. Purposes of processing
- Running omnichannel customer communication.
- AI triage: matching a message to a suitable FAQ answer.
- Routing sensitive/uncertain messages to a human queue.
- Consent-based broadcast messaging.
- Billing, account management, and security/audit logging.
4. Legal bases
Data is processed on the bases of contract performance, legal obligation, legitimate interest, and — for commercial electronic messages — explicit consent (KVKK arts. 5-6 / GDPR art. 6).
5. Retention
Message and queue data is retained for a limited period (a TTL defined by RETENTION_DAYS) and automatically deleted at the end of that period. Opt-out (STOP / DUR / İPTAL) records are kept permanently to prevent renewed contact. [Statutory retention periods to be detailed separately.]
6. Transfers and sub-processors
The following sub-processors are used to deliver the Service; data is positioned to reside in the EU (Frankfurt) region:
- AWS SES (email delivery) — eu-central-1 / Frankfurt.
- MongoDB Atlas (database) — Frankfurt.
- WhatsApp Business Platform provider (BSP; technically 360dialog) — WhatsApp messaging infrastructure.
- OpenAI-compatible AI provider — message classification (FAQ matching only; no freeform generation).
7. Your rights
Under KVKK art. 11 you have the rights to access your data, have it rectified, request its erasure/destruction, object to processing, and seek remedy for damages. Under GDPR you additionally have the right to data portability. Requests may be sent to [email protected].
8. Cookies
No marketing/analytics cookies are used; only technical storage strictly necessary for the site to function. See the Cookie Policy for details.