Privacy policy

Who we are

DestekBotu is a business established in the United Kingdom and is the data controller for this notice. Address: 20 Wenlock Road, London N1 7GU, United Kingdom. Contact: destek@destekbotu.com

We process personal data under the UK GDPR and the Data Protection Act 2018.

For data belonging to our customers’ own end users, the customer is the controller and DestekBotu acts as processor.

What we process

Account data: name, email address, trading name, tax number, billing details.

Usage data: session records, IP address (stored hashed), activity logs.

Content data: the material a customer teaches the bot, and the content of conversations with their end users.

Lawful basis

Performance of a contract: creating an account, providing the service, invoicing.

Legitimate interests: keeping the platform secure, preventing abuse, improving the service.

Legal obligation: retaining accounting and tax records.

Security

A customer’s AI provider key and integration credentials are stored encrypted with AES-256-GCM. Once saved, neither is shown back on any screen or returned by any API.

Isolation between customers is enforced in the database rather than in application code (PostgreSQL row-level security, FORCE ROW LEVEL SECURITY). One customer’s data cannot be reached from another customer’s session even if the application code is wrong, because the database refuses it. This is verified by automated tests on every release.

Our own administration screens have no view of customer conversations or knowledge base content; they show counts only.

Site and API traffic is encrypted with TLS.

Sharing and international transfers

Our servers are in Europe (Germany).

The sub-processors we rely on to provide the service: OpenAI — Generating answers; Meta Platforms — WhatsApp messaging infrastructure; Hostinger — Server and database hosting. We tell customers before adding a new one to this list.

To generate answers, message content is sent to our AI provider (OpenAI). WhatsApp conversations run on Meta Platforms infrastructure.

Transfers outside the United Kingdom rely on adequacy regulations or on the International Data Transfer Agreement (IDTA) / UK Addendum.

A customer may supply their own AI provider key so that processing runs through their own account.

Retention

Account and billing records are kept for the period required by UK tax law.

Conversation content is kept while the account is open. Customers can download or permanently delete their conversation history and knowledge base themselves, from the Settings screen, without asking us.

Data breaches

Where a personal data breach occurs, we notify the Information Commissioner’s Office within 72 hours where the risk requires it, and the people affected as well where the risk to them is high.

Where the customer has to make a notification of their own as controller, we provide what they need without delay.

Your rights

Under the UK GDPR you have the right to access your data, have it corrected or erased, restrict or object to processing, and receive it in a portable form.

Send requests to destek@destekbotu.com. We respond within one month.

If you are unhappy with our response you may complain to the Information Commissioner’s Office (ico.org.uk).

For customers in Türkiye — KVKK

For customers established in Türkiye and their end users, the customer is the data controller and DestekBotu the processor under Law No. 6698 on the Protection of Personal Data (KVKK).

Transfer abroad falls under article 9 of the KVKK: the data is processed by a business established in the United Kingdom, on servers in Europe, and sent to the AI provider to generate answers. Informing end users of that transfer and establishing a lawful basis for it is the customer’s obligation; we supply the technical detail they need for it on request.

Data subjects address their KVKK requests to the customer. Where the customer asks, we assist with the access, correction, deletion and export needed to meet them.

The Turkish authority is the Kişisel Verileri Koruma Kurumu (kvkk.gov.tr).

Cookies

Only essential cookies are used, for session management and to keep a demo conversation going. No marketing, tracking or profiling cookies are set, so no separate consent is sought under PECR.