Privacy Policy

1. Introduction

This Privacy Policy is prepared by YUSUF BOYACIGİL ("Yaverin", "we", "us") to inform you about how personal data is processed through the yaverin.com website and Yaverin services.

Yaverin is a platform that enables small and medium-sized businesses ("Merchants") to provide AI-assisted responses to their customers on WhatsApp Business and Instagram Direct. This policy covers site visitors, Merchant clients, and the end-customers of Merchants.

The authoritative version of this policy is in Turkish (/gizlilik), which governs in the event of any conflict.

2. Yaverin's Role: Data Processor

When processing personal data of a Merchant's end-customers, Yaverin acts as a data processor. The Merchant is the data controller for that data under applicable law, including Turkey's Personal Data Protection Law (KVKK).

Yaverin processes such data solely on the Merchant's instructions and for the purpose of providing the service. It does not share this data with third parties or use it for its own commercial purposes.

For data collected directly from site visitors and Merchant clients, Yaverin acts as the data controller.

3. Personal Data We Process

3.1 End-Customer Data (as Data Processor)

The following data is processed to deliver the service on behalf of Merchants:

• Name and contact details (as shared via WhatsApp/Instagram)
• Message content and conversation history
• Order information (pulled from the Merchant's connected e-commerce system)
• Communication channel and timestamps

3.2 Merchant Data (as Data Controller)

• Business name, authorized contact details
• Uploaded knowledge base content (product catalog, FAQs, policies)
• Platform usage and analytics data
• Billing and payment information

3.3 Site Visitor Data (as Data Controller)

• Name, email, and message submitted via the contact form
• Technical log data (IP address, browser type, visit timestamp)

4. Purposes and Legal Bases

• Performance of a contract: Processing necessary to provide the service you have subscribed to.
• Legitimate interests: Service security, quality improvement, and fraud prevention, where these do not override your rights.
• Legal obligation: Compliance with applicable data retention requirements.
• Consent: For marketing communications, where required by law.

5. Data Retention

• Conversation history: period set by the Merchant or up to 2 years
• Merchant account data: 10 years after account closure (required by Turkish Commercial Code Art. 82)
• Contact form submissions: 2 years after the request is resolved
• Log records: up to 6 months

Data is securely deleted when retention periods expire.

6. Data Sharing

To provide the service, Yaverin works with the following service providers (subprocessors), which may access data only to the extent necessary to deliver the service and under contractual safeguards:

• Meta Platforms Ireland Ltd. — WhatsApp and Instagram messaging infrastructure
• Hetzner Online GmbH (Germany) — server and hosting infrastructure
• Cloudflare, Inc. (USA) — content delivery network, DNS, and inbound email routing
• Resend — outbound email delivery
• Fireworks AI, Inc. (USA) — AI model processing to generate replies

Data may also be shared in the following circumstances:

• The Merchant: End-customer data is shared with the relevant Merchant as data controller.
• Legal requirement: Where required by court order or applicable law.

Where data is transferred abroad, the conditions required by KVKK are observed.

Your data is never sold or shared for advertising purposes.

7. Data Security

Yaverin applies technical and organizational measures to protect personal data, including:

• TLS encryption in transit and at rest
• Access controls and role-based authorization
• Regular security reviews
• Staff confidentiality obligations

8. Your Rights

You have the right to request access to, correction of, or deletion of your personal data. Under KVKK Article 11, you also have the right to object to automated processing and to request that we restrict processing in certain circumstances.

To exercise these rights, contact us at hello@yaverin.com.

9. Data Deletion Requests

You can request deletion of your personal data:

• Business clients and site visitors: Contact us directly. Email hello@yaverin.com with the subject "Data Deletion Request". After we verify your identity, we complete your request within 30 days by deleting, destroying, or anonymizing the relevant personal data.
• End customers: For end-customer data, Yaverin acts as a data processor. Deletion requests should be directed to the business you contacted (the data controller). Yaverin deletes the data on that business's instruction.

Data subject to a statutory retention obligation is destroyed at the end of the applicable period.

10. Cookies

The Yaverin marketing site uses only essential technical cookies. No advertising or third-party tracking cookies are used. Where Cloudflare Web Analytics is active, it operates without cookies and collects only anonymous, aggregated data.

11. Policy Updates

This policy may be updated from time to time. Material changes will be announced on the site. The current version is always available at yaverin.com/en/privacy.

12. Contact

For privacy-related questions: hello@yaverin.com