Privacy policy

Who we are

DestekBotu is a business established in London, England, and is the data controller for this notice. Address: 20 Wenlock Road, London N1 7GU, United Kingdom. Contact: destek@destekbotu.com

We process personal data under UK law: the UK GDPR and the Data Protection Act 2018. Our supervisory authority is the Information Commissioner’s Office (ICO).

For data belonging to our customers’ own end users, the customer is the controller and DestekBotu acts as processor.

What we process

Account data: name, email address and company name. When a licence is invoiced, the trading name, tax number and address you give us for it are processed too.

Usage data: session records (browser information and a one-way digest of the IP address), activity logs. In server access logs the IP address is masked to the network (the last octet of an IPv4 address and the last 96 bits of an IPv6 address are dropped).

Content data: the material a customer teaches the bot, the content of conversations with their end users, and the notes a team leaves on those conversations (closing notes, answers marked as wrong).

End-user data (as processor): WhatsApp number, profile name, message content, and the delivery status WhatsApp reports for messages sent to them (delivered, read); for web chat, a session id and message content. Where a customer has let the bot look at photos and voice messages, those are processed too; the files themselves are not kept, and a voice message’s transcript stays in the conversation. Where a customer has let the bot take down details for a follow-up, the name, phone number, email address and request an end user gives the bot so that someone gets back to them are processed too; the request is emailed to the customer’s owner and admins and kept with the conversation. For the customer’s statistics, each request’s topic, language, reply times and whether it was handed to the team are kept with the conversation.

Contact form and the demo chat on the site: the question you asked, the bot’s answer, the email address and company name you left, and a hash of your IP address. If you ask us to get back to you in the demo chat and leave your name, phone number or email address, those are processed too, and used only to get back to you. The topic and language of demo conversations, and whether the bot could answer, are kept in our own statistics to improve the demo.

Our WhatsApp demo number: when you write to it, your WhatsApp number, profile name, messages, the photos and voice messages you send, and the delivery status of our replies. Photos the bot looks at and voice messages it listens to are deleted from Twilio once used; a voice message’s transcript stays in the conversation. These conversations are part of the demo statistics above too.

Lawful basis

Performance of a contract: creating an account, providing the service, invoicing.

Legitimate interests: keeping the platform secure, reviewing signup requests and preventing abuse, answering contact requests, improving the service.

Legal obligation: retaining accounting and tax records.

Security

A customer’s AI provider key and integration credentials are stored encrypted with AES-256-GCM. Once saved, neither is shown back on any screen or returned by any API.

Isolation between customers is enforced in the database rather than in application code (PostgreSQL row-level security, FORCE ROW LEVEL SECURITY). One customer’s data cannot be reached from another customer’s session even if the application code is wrong, because the database refuses it. This is verified by automated tests.

Our own administration screens have no view of customer conversations or knowledge base content; they show counts only.

Site and API traffic is encrypted with TLS. The server is reached by key only; password login is disabled. The database is backed up daily, encrypted, and backups are kept for 14 days; the key that opens them is not kept on the server.

Sharing and international transfers

Our servers are in Europe (Germany).

The sub-processors we rely on to provide the service: OpenAI (AI features: answers, photos and voice messages, knowledge search, integration setup, note drafts, fix suggestions and request statistics); Meta Platforms (WhatsApp messaging infrastructure); Hostinger (Server, database and email hosting). We tell customers before adding a new one to this list.

For the AI features, the content each one needs is sent to our AI provider (OpenAI): message content, to generate answers, with incoming photos and voice messages where the customer has turned that on (voice messages to be transcribed); knowledge entries and incoming questions, turned into numerical vectors to search the knowledge; and, while a customer sets up an integration, the API document they upload and the response to the connection test.

When a team member closing a conversation asks for a draft note, the messages since it was last closed go to the same provider; when someone asks for a fix to an answer marked as wrong, so do the last few messages before that answer, the answer itself, the right information they wrote and the entries the answer came from. Drafts and suggestions are shown only to the person who asked and are not kept in our system unless that person saves or applies them. For the customer’s statistics page, the messages of each customer request go to the same provider to determine the request’s topic and the language the customer wrote in; the topic and language are kept with the conversation and deleted with it.

WhatsApp conversations run on Meta Platforms infrastructure. When a customer connects a system they use to their bot (an e-commerce platform, for example), the bot sends that system what it needs to look up an answer, such as an order number. Those systems are services the customer chose and connected, not our sub-processors.

Our own WhatsApp demo number runs on Twilio (US) infrastructure: messages written to it, and our replies, pass through Twilio and Meta. Twilio keeps its message records, and any attachment the bot did not use, under its own retention rules. Our customers’ numbers do not go through Twilio.

Transfers outside the United Kingdom rely on adequacy regulations or on the International Data Transfer Agreement (IDTA) / UK Addendum.

A customer may supply their own AI provider key; every AI step described above for their workspace then runs through their own account.

Retention

Account and billing records are kept for the period required by UK tax law.

Conversation content is kept while the account is open. Customers can download or permanently delete their conversation history and knowledge base themselves, from the Settings screen, without asking us.

When an account is closed, content data is deleted within 30 days.

Contact form records, and the details you leave in the demo chat for us to get back to you, are kept for a reasonable period after your request is dealt with, and deleted on request. Follow-up requests taken down by our customers’ bots are kept with the conversation they belong to and deleted with it.

Server access logs are kept for at most 30 days.

Data breaches

Where a personal data breach occurs, we notify the ICO within 72 hours where the risk requires it, and the people affected as well where the risk to them is high.

Where the customer has to make a notification of their own as controller, we provide what they need without delay.

Your rights

Under the UK GDPR you have the right to access your data, have it corrected or erased, restrict or object to processing, and receive it in a portable form.

Send requests to destek@destekbotu.com. We respond within one month.

If you are unhappy with our response you may complain to the Information Commissioner’s Office (ico.org.uk).

A note for customers established in Türkiye (KVKK)

This notice is governed by UK law. This section exists to help our customers established in Türkiye meet the obligations their own law places on them.

For customers established in Türkiye and their end users, the customer is the data controller and DestekBotu the processor under Law No. 6698 on the Protection of Personal Data (KVKK).

Transfer abroad falls under article 9 of the KVKK: the data is processed by a business established in the United Kingdom, on servers in Europe, and sent to the AI provider for the AI features (answers, photos and voice messages, knowledge search, integration setup, note drafts, fix suggestions and request statistics). Informing end users of that transfer and establishing a lawful basis for it is the customer’s obligation; we supply the technical detail they need for it on request.

Data subjects address their KVKK requests to the customer. Where the customer asks, we assist with the access, correction, deletion and export needed to meet them.

The Turkish authority is the Kişisel Verileri Koruma Kurumu (kvkk.gov.tr).

Cookies

Only essential cookies are used: for session management, to remember the language you chose, and to keep a demo conversation going. No marketing, tracking or profiling cookies are set, so no separate consent is sought under PECR.

Changes

When we update this notice we change the date above. Material changes are notified to customers at the account’s registered email address.