Privacy Policy
Last updated: 9 July 2026
This Privacy Policy explains how SECAN BİLİŞİM TEKNOLOJİLERİ LİMİTED ŞİRKETİ processes data of the business owners who use Secan Asistan. We are the controller of your account data and the processor of your customers’ data, acting on your instructions.
1. Data we process (your account)
We process your name, email address, business details, billing information, and technical records of your use of the service (session, usage metering, security logs), plus your communications with us.
2. End-customer data (as processor)
To operate the assistant, your customers’ message content (including voice messages) and contact details (e.g. phone number) are processed on your instructions. Voice messages are converted to text to generate a reply; the audio itself is not stored, only the text transcript is kept. You are the controller of this data; processing is subject to the data-processing terms between us.
3. Purposes & legal bases
We process data to provide the service and perform our contract, for billing, for security and abuse prevention (legitimate interest), to comply with legal obligations, and to communicate with you.
4. AI processing
To generate replies, message content is processed by our primary AI provider Anthropic (Claude). This processing is carried out under a DPA and Standard Contractual Clauses (SCCs), and your data is not used to train models. If the primary provider is temporarily unavailable, replies may be generated by an AI model running on the infrastructure of Cloudflare (Workers AI), an existing sub-processor. Voice messages are converted to text using speech recognition, also on Cloudflare Workers AI; the audio is processed transiently and not stored.
5. Sub-processors
To deliver the service we use these sub-processors: Anthropic (AI), Cloudflare (hosting, database and AI infrastructure — including voice-to-text and the backup AI model), Meta/WhatsApp (message transport) and Brevo (transactional email). The current list is available on request.
6. Storage location & security
Your data is stored within the European Union (Cloudflare D1, EU jurisdiction) and encrypted at rest with AES-256-GCM. Access controls and audit logging are applied.
7. International transfers
AI processing may involve a transfer to our US provider (Anthropic); such transfer is protected by Standard Contractual Clauses (SCCs) and appropriate safeguards under KVKK. Voice-to-text and backup AI processing may run on Cloudflare’s global network under our existing data-processing agreement.
8. Retention
We keep your account data while your account is active and for applicable legal periods. Customer message content is retained per your business’s retention period (default 90 days). Deletion on request.
9. Your rights
Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection; under KVKK Art. 11 you have rights including information and correction/deletion. To exercise: inbox@secan.tech.
10. Cookies
We use only the essential cookies needed to maintain your session. We do not use advertising or third-party tracking cookies.
11. Changes & contact
We may update this policy and will notify you of material changes. Controller: SECAN BİLİŞİM TEKNOLOJİLERİ LİMİTED ŞİRKETİ, Etiler Mah. Evliya Çelebi Cad. No: 23/107, Muratpaşa, Antalya 07010, Türkiye. Contact: inbox@secan.tech.