AI Agent by Netfone

AI Agent Privacy Policy

Status: ✅ Published Published at: https://aiagent.netfone.com.tr/privacy-en.html (English) · Turkish + bilingual version: https://aiagent.netfone.com.tr/privacy.html Effective date: 05.05.2026 Last updated: September 1, 2026

ENGLISH — Privacy Policy

1. Data Controller

Netfone Telekom Limited Şirketi ("Netfone", "we") operates the AI Agent platform.

This Privacy Policy is prepared in accordance with Turkish Personal Data Protection Law No. 6698 (KVKK), EU General Data Protection Regulation (GDPR), and Meta Platform Terms.

2. What is AI Agent?

AI Agent is a B2B SaaS platform that powers customer service operations for businesses with AI-driven automated responses. Our customers (e.g., clinics, restaurants, e-commerce stores) connect their social-media accounts to AI Agent; incoming messages are answered by AI on their behalf.

Supported channels:

3. What Data Do We Collect?

3.1 Data Collected from Instagram

When our business customer (tenant) connects their Instagram Professional account to AI Agent, the following data is collected:

| Data category | Specific data | Source | |---|---|---| | Account info | Instagram Scoped User ID (IGSID), username, profile picture | Meta Graph API | | Message content | DM text you send to our business customer | Meta webhook | | Media content | Images, videos, voice notes, files you send | Downloaded via Meta CDN | | Interaction metadata | Message timestamp, Meta message ID (MID) | Meta webhook |

Important: We only collect data from users who initiated contact with our business customer. We never proactively message users or build lead lists — Instagram Messaging Policy prohibits this anyway.

3.2 Derived Data

From the collected message/media content, we generate the following derived data to produce AI responses:

| Derived data | Generation method | |---|---| | Voice note transcripts | Automatic speech recognition (cloud-based AI service) | | Image visual descriptions | Vision-capable AI model (cloud-based AI service) | | PDF/document text extraction | Document parsing (local — not sent to any external service) | | AI-generated reply text | Large language model (cloud-based AI service) | | Conversation language tag (ISO code of the chat language, e.g. "en") | Deterministic text analysis (local — content is not sent to any external service for this purpose) |

On messaging channels (WhatsApp / Instagram / Messenger), a one-line notice is delivered at first contact stating that the conversation is answered by an AI-powered digital assistant and recorded for service quality (with a link to this page).

4. Why Do We Process Your Data?

| Purpose | Legal basis (GDPR) | |---|---| | Generating automated responses on behalf of our business customer | Legitimate interest (Art. 6(1)(f)) | | Allowing the business customer to view their conversation history | Performance of contract (Art. 6(1)(b)) | | Service quality monitoring, error handling | Legitimate interest (Art. 6(1)(f)) | | Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |

What we don't do:

5. Who Do We Share Data With?

Your data is shared with the following data processors (sub-processors) only when strictly necessary for service delivery:

| Sub-processor | Data shared | Purpose | Server location | |---|---|---|---| | Meta Platforms Inc. | Message routing (Instagram Graph API) | Delivering messages to AI Agent and replies back | US/EU | | OpenAI, L.L.C. | Message text, audio for Whisper, images for vision | LLM response generation, transcription | US | | Google LLC (optional) | TTS text (voice channel only) | Generating voice responses | US/EU | | Our business customer (tenant) | Full conversation with you | Operating their own customer-service workflow | Turkey |

International transfers are made under explicit consent or adequacy decisions (Art. 49 GDPR / KVKK Art. 9). Sub-processor DPAs (Data Processing Agreements) are appended to this Policy.

6. How Long Do We Retain Your Data?

| Data type | Retention period | Then | |---|---|---| | Message content (text) | 90 days (default; tenant configurable up to 365 days) | Content auto-deleted; billing record retained 5 years (Turkish Tax Procedure Law) | | Media files (image, audio, video) | 90 days (default; tenant configurable up to 365 days) | Auto-deleted | | Phone call audio recording | 30 days (default; tenant configurable up to 365 days) | Auto-deleted | | Call transcript | 90 days (default; tenant configurable up to 365 days) | Auto-deleted | | Account connection info (IGSID, username) | While connection is active | 30 days after tenant disconnects | | Conversation language tag (ISO code; not content) | While the conversation record exists | Deleted together with the conversation | | Backups/logs | 60 days | Auto-deleted |

7. Your Rights (GDPR + KVKK)

You have the following rights:

  1. Right of access — Know what data we process about you
  2. Right to rectification — Correct inaccurate data
  3. Right to erasure (Right to be forgotten) — Request data deletion
  4. Right to object — Object to specific processing
  5. Right to data portability — Receive your data in machine-readable format
  6. Right to object to automated decision-making — Opt out of AI responses and request human handoff (just message "I want to speak to a human")
  7. Right to lodge a complaint — With KVKK Authority (https://www.kvkk.gov.tr) or your local EU DPA

8. How to Delete Your Data

Three options:

9. Data Security

10. Children's Privacy

AI Agent and Instagram are not intended for users under 13. Data we discover belongs to a child is deleted immediately.

11. Policy Changes

We reserve the right to modify this Policy. Material changes are published on this page 30 days in advance.

12. Contact

For all KVKK/GDPR-related requests:

For Turkish residents: applying to Netfone is mandatory before lodging a KVKK complaint (KVKK Art. 13). We respond within 30 days of your request.