Privacy Notice (KVKK)

Data controller

Data controller: Avarit.AI — Göktuğ Kocauşu (sole proprietorship).

Contact: info@avaritai.com

Personal data we process

• Identity and contact: name, email address; phone number and company name if you provide them. With Google sign-in, your Google account ID, name and email address.
• Account security: a one-way hash of your password (the password itself is not stored), two-step verification and session records.
• Billing and payment: billing name, address and tax details, balance and payment history. Card details are processed by the payment institution iyzico; we do not store your card number.
• Service usage: agent settings, knowledge base content you upload, campaign lists, call records (time, duration, number, status), call transcripts and summaries.
• Website forms: the name, email, phone, company and message you enter in demo, contact or call-back forms.
• Technical data: IP address, browser and device information, access and security logs.
• Session interaction data (only with your explicit consent): clicks, scrolling, mouse movements, page transitions, error and speed measurements and the structure of the screen on the website and in the user panel. Input fields are masked; passwords, card details, phone numbers, email addresses and AI agent instruction texts are not recorded; in the panel, on-screen text is masked by default; payment and wallet pages are not recorded at all. Recordings made while you are signed in to your account are linked to your account; the recording of the visit in which you open an account may also be linked to it.
• Campaign label and ad click identifier (at sign-up): if you arrive through an advertisement or campaign link and open an account, the campaign labels in the link (e.g. source, medium and campaign name) and, where present, the ad click identifier. Your browsing history and the pages you visited are not part of this record. If you have given explicit consent, the ad click identifier may be reported to the relevant advertising platform to measure the ad's result; only the click identifier, the conversion time and an order identifier are sent, and your name and email are not shared.
• Consent records: which version of which text you accepted and when, with the IP address and browser information at that time.

The total count without identifiers on the website (only total numbers per day and source) contains no personal data and is therefore not listed here.

Purposes and legal grounds

• Opening your account, verifying your identity, providing AvaritCall, running calls, producing transcripts and summaries, support: establishment and performance of a contract (KVKK 5/2-c).
• Answering demo, contact and call-back requests sent through website forms: directly related to the establishment of a contract (5/2-c).
• Invoicing, tax and accounting records, records under Law No. 5651, requests of competent authorities: compliance with a legal obligation (5/2-ç).
• Account and system security, prevention of abuse and fraud, service improvement: legitimate interest (5/2-f).
• Keeping consent records and records relevant to potential disputes: establishment, exercise or defence of a right (5/2-e).
• Session recording and usage analysis to find errors and difficulties in the sign-up and usage flows on the website and in the user panel and to improve the product: your explicit consent only (KVKK 5/1).
• Storing the campaign label and ad click identifier with your account to measure which advertisements and campaigns actually lead to sign-ups: legitimate interest (5/2-f).
• Keeping the campaign label in a cookie in your browser for at most 30 days and reporting the ad click identifier to the relevant advertising platform to measure the ad's result: your explicit consent only (KVKK 5/1).

Your explicit consent is not required to open an account or use the service; these rely on the legal grounds above.

Explicit consent is requested only for session recording, usage analysis and ad result measurement; not giving it does not affect opening an account or using the service.

How we collect data

Electronically, partly by automated means, through the sign-up form, Google sign-in, your use of the panel and API, payment steps and system logs.

Session interaction data is collected by automated means from your browser only if you have given explicit consent; the campaign label and ad click identifier are collected from the link you arrived through when you open an account.

Who we share data with

Personal data may be shared with the following groups of recipients, only as far as needed for the purposes above:

• Suppliers of the service's technical infrastructure: server hosting, speech recognition, AI response generation, speech synthesis and email delivery providers.
• Google: for authentication if you choose Google sign-in.
• Payment institution (iyzico): for payments and invoicing.
• Advertising platforms: only with your explicit consent, the ad click identifier, the conversion time and an order identifier, to measure the ad's result.
• Telecommunications operators: number and signalling data required to set up calls.
• Accountants and legal advisers: for legal obligations and the protection of rights.
• Competent public authorities: where required by law.

Session recordings are kept on our own infrastructure; they are not transferred to third-party analytics or advertising services and are not sold.

Data of people our customers talk to

For people called by, or calling, the voice assistant of a customer using AvaritCall ("call participants"), roles and responsibilities are as follows:

• The customer is the data controller. The customer decides whom to call, which data is processed for which purpose, what the agent says and how call results are used.
• Avarit.AI is the data processor. It processes this data only on the customer's behalf and instructions and to provide the service; it does not use it for its own purposes, sell it or use it for marketing.
• Data processed: phone number; name, company and similar variables in lists uploaded by the customer; the call transcript, summary, outcome and labels; call time and duration.
• Avarit.AI is responsible for the security of the system: under KVKK Art. 12 it takes the technical and organisational measures needed to protect the data against unlawful access, loss and disclosure (encryption in transit, authorisation and access control, access logs and confidentiality) and notifies the customer without delay of any data breach it becomes aware of.
• All other obligations lie with the customer: lawful collection of the data of people to be called, a valid legal ground for processing, informing call participants, obtaining explicit consent and commercial message consent where required, checking the Message Management System (İYS), honouring opt-outs, the agent's script and the information it gives, and the use, retention and onward transfer of call results.
• Call participants should send their KVKK Art. 11 requests to the customer as data controller. Requests reaching Avarit.AI are forwarded to the customer without delay, and Avarit.AI provides the technical support the customer needs to answer them.
• This data is kept while the customer's account is open and as the customer configures; when the account is closed it is deleted, subject to statutory retention obligations.

Retention

Account data is kept while your account is open and afterwards for the general limitation periods; invoices and accounting records for 10 years under tax and commercial law; access and security logs for the period required by law. Session recordings are deleted automatically after at most 30 days; if you withdraw your explicit consent, the session recordings made from that browser are deleted. The campaign label and ad click identifier are kept with your account until your account is deleted. Data is then deleted, destroyed or anonymised.

Your rights (KVKK Art. 11)

You have the right to learn whether your personal data are processed, to request information if they have been processed, to learn the purpose of the processing and whether the data are used in line with that purpose, to know the third parties to whom your personal data are transferred, to request correction if the data are incomplete or inaccurate, to request deletion or destruction under KVKK Art. 7, to request that these operations be notified to the third parties to whom the data were transferred, to object to an adverse outcome resulting solely from analysis by automated systems, and to claim compensation if you suffer damage due to unlawful processing.

You can withdraw the explicit consent you gave for session recording, usage analysis and ad result measurement at any time via the “Cookie preferences” link on the website. When you withdraw it, recording stops; the session recordings made from that browser and the campaign label cookie are deleted.

Send your request from the email address registered with us to info@avaritai.com. Requests are answered free of charge within 30 days at the latest.