Privacy Policy

1. Data we process (your account)

We process your name, email address, business details, billing information, and technical records of your use of the service (session, usage metering, security logs), plus your communications with us.

2. End-customer data (as processor)

To operate the assistant, your customers’ message content (including voice messages) and contact details (e.g. phone number) are processed on your instructions. Voice messages are converted to text to generate a reply; the audio itself is not stored, only the text transcript is kept. You are the controller of this data; processing is subject to the data-processing terms between us.

Data processed per channel: on WhatsApp, the phone number and WhatsApp profile name; on Instagram, the Instagram-scoped user ID, name and username; on Telegram, the Telegram user ID and name; on web chat, whatever the customer enters. On every channel we also keep the message content and timestamps, the event data the platform sends for non-text messages (image, audio, location, etc.), and the replies the assistant generated together with the AI model that produced them.

This data is used only to manage the business’s communication with its customers: it is not used for marketing, not sold to third parties and not used to train AI models. Message delivery is subject to Meta’s WhatsApp Business Policy and Instagram Platform Policy, and on Telegram to Telegram’s terms.

3. Instagram connection

When you connect your Instagram professional account through Instagram Login, we request only these permissions: instagram_business_basic (your account ID, username and account type) and instagram_business_manage_messages (to receive and reply to Direct Messages sent to your account). The access token Instagram issues is stored encrypted at rest with AES-256-GCM and used only for these purposes.

When a customer sends your account a Direct Message, we process: the Instagram-scoped user ID (IGSID), the customer’s Instagram name and username (read once so you can recognise the conversation), the message content and timestamps, and replies you send yourself from the Instagram app (the AI then stops in that conversation). We use this data only so the assistant can reply on your behalf and to show the conversation in your dashboard; we do not use it for advertising, profiling, resale or AI model training. We do not access your posts, comments, followers or other account content.

You can remove the connection at any time from the dashboard (Channels) or in Instagram under Settings > Apps and websites. When you remove it in Instagram, Meta notifies us and we disconnect automatically; when you request data deletion through Meta, we delete the connection and all conversation history that came in through it (see the Data Deletion Request page).

4. Purposes & legal bases

We process data to provide the service and perform our contract, for billing, for security and abuse prevention (legitimate interest), to comply with legal obligations, and to communicate with you.

5. AI processing

To generate replies, message content is processed by our primary AI provider Anthropic (Claude). This processing is carried out under a DPA and Standard Contractual Clauses (SCCs), and your data is not used to train models. If the primary provider is temporarily unavailable, replies may be generated by an AI model running on the infrastructure of Cloudflare (Workers AI), an existing sub-processor. Voice messages are converted to text using speech recognition, also on Cloudflare Workers AI; the audio is processed transiently and not stored.

6. Sub-processors

To deliver the service we use these sub-processors: Anthropic (AI), Cloudflare (hosting, database and AI infrastructure — including voice-to-text and the backup AI model), Meta Platforms (message transport via WhatsApp and Instagram) and Brevo (transactional email). The current list is available on request.

7. Storage location & security

Item photos you upload are stored within the European Union (Cloudflare R2, EU jurisdiction). So they load quickly, photos of public items may be cached temporarily on Cloudflare’s network in the data centre nearest to the device opening them, which may be outside the EU. When the assistant sends a photo via WhatsApp, Instagram or Telegram, that channel keeps its own copy on its own servers.

Files you drop in the assistant chat (CSV, Excel, PDF, photos) are stored within the European Union (Cloudflare R2, EU jurisdiction) for 30 days and then deleted automatically. To set up your records, the content of these files is processed by our AI provider Anthropic; this processing may take place outside the EU (United States). We recommend not putting your customers’ personal data in these files.

Customer questions the assistant could not answer are stored encrypted within the European Union (Cloudflare D1, EU jurisdiction) as a short question with names, numbers and contact details removed, so we can show them to you in the "To check" list. For the weekly check, the text of your knowledge pages is sent to our AI provider.

Your data is stored within the European Union (Cloudflare D1, EU jurisdiction) and encrypted at rest with AES-256-GCM. Access controls and audit logging are applied.

8. International transfers

AI processing may involve a transfer to our US provider (Anthropic); such transfer is protected by Standard Contractual Clauses (SCCs) and appropriate safeguards under KVKK. Voice-to-text and backup AI processing may run on Cloudflare’s global network under our existing data-processing agreement.

9. Retention

We keep your account data while your account is active and for applicable legal periods. Customer message content is retained per your business’s retention period (default 90 days). Summarised usage records kept for billing (message counts, dates, amounts) are retained for 10 years under Turkish tax and commercial law. Deletion on request.

10. Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection; under KVKK Art. 11 you have rights including information and correction/deletion. To exercise: inbox@secan.tech.

11. Cookies

We use only the essential cookies needed to maintain your session. We do not use advertising or third-party tracking cookies.

12. Changes & contact

We may update this policy and will notify you of material changes. Controller: SECAN BİLİŞİM TEKNOLOJİLERİ LİMİTED ŞİRKETİ, Etiler Mah. Evliya Çelebi Cad. No: 23/107, Muratpaşa, Antalya 07010, Türkiye. Contact: inbox@secan.tech.