KVKK Privacy Notice

1. Data controller

The data controller under KVKK is the legal entity identified below.

Data controller

Pointo Teknoloji A.Ş.

Address

Kızılırmak Mah. Dumlupınar Bulvarı No: 9/A YDA Center Kat: 9 Daire: 351, Çankaya / Ankara

Tax office / number

Çankaya VD. 7300603011

Request address

[email protected]

2. Personal data we process

Depending on the nature of the service and our relationship with you, we process the following categories of data:

• Identity and contact data: name, company name, email address, phone number, billing address.
• Customer transaction data: account and plan details, credit balance and credit consumption records, support requests, contract and consent records.
• Financial data: invoice details, payment amount and date, payment reference. We never see or store card numbers or security codes; payment takes place in the infrastructure of a payment institution licensed under Law no. 6493.
• Transaction security data: IP address, session and login records, browser and device information, error and access logs.
• Voice and content data: recordings, transcripts, texts, agent flows and knowledge base content you upload or generate while using the service.
• Calendar connection data (if you connect Google Calendar): the email address of the connected Google account, encrypted access tokens, the list of calendars in your account, events on the calendars you select (processed in memory only to calculate availability, not stored) and the IDs of the appointment events Voxlin creates.
• Marketing and enquiry data: information you share in demo and reseller application forms and, where you give explicit consent, your communication preferences.

3. Processing purposes

We process personal data only for the following purposes, in a manner connected and proportionate to them:

• Creating your account, providing access to the service and authenticating you.
• Running voice agent, text-to-speech and speech-to-text functions, metering usage and calculating credit deduction.
• If you connect a calendar, enabling the AI agent to find free times on the calendars you select and to create, update or cancel the appointment event; if you turn on automatic meeting joining, enabling the AI meeting agent to join the meetings you select.
• Taking subscription and credit purchases, invoicing them and keeping accounting records.
• Handling support requests and investigating faults and complaints.
• Keeping the service secure, preventing abuse and fraud, and maintaining system logs.
• Producing aggregated and non-identifiable usage statistics in order to improve the service.
• Meeting statutory retention, disclosure and response obligations towards competent authorities.
• Sending promotional and informational messages where you have given explicit consent.

4. Legal grounds for processing

Your data is processed on the following legal grounds under Article 5 of KVKK: direct relation to the conclusion or performance of a contract (Art. 5/2-c); compliance with a legal obligation of the controller (Art. 5/2-ç); being expressly provided for by law (Art. 5/2-a); establishment, exercise or protection of a right (Art. 5/2-e); and our legitimate interests provided that your fundamental rights are not harmed (Art. 5/2-f).

Only processing that requires explicit consent (for example commercial electronic messages or non-essential cookies) relies on your consent. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out until then.

5. Call recordings and cases where the customer is the controller

Businesses that use Voxlin to speak with their own customers are the data controller for the personal data processed in those conversations; Voxlin acts as a data processor within the meaning of Articles 8, 9 and 12 of KVKK and processes the data only on the customer's instructions.

Informing the individual before recording starts, obtaining explicit consent where required, disclosing that the conversation is handled by an AI agent, and setting retention periods for recordings are the customer's obligations. Voxlin provides the technical means for these obligations but does not assume legal responsibility for them.

Voice identity creation (voice cloning) may only be used with recordings you own the rights to or for which you have obtained the individual's explicit consent. A person's voice is protected as part of their personality rights; unauthorised use breaches both this agreement and the law.

6. Transfer of personal data

Your data may be transferred, limited to the purposes above, to payment institutions, cloud infrastructure and hosting providers, AI model providers, e-invoice and accounting service providers, telecommunications operators and legally competent public authorities.

All our servers are located in Türkiye; your personal data is not transferred abroad. A current list of contracted providers is shared upon request sent to [email protected].

7. Retention periods

Account and contract data is kept for the limitation periods under the Turkish Code of Obligations following the end of the relationship; invoice and accounting records are kept for 10 years under the Tax Procedure Law and the Turkish Commercial Code.

Recordings, transcripts and agent content are kept for as long as you keep them in your account; when you delete them from the console or close your account they are erased or anonymised as soon as the law permits. Security logs are kept for a maximum of 2 years.

Calendar connection access tokens are kept only while the connection is active and are deleted immediately when you disconnect. The email address of the connected account is kept only while booking resources still refer to it, so that you can reconnect the same account; calendar and event IDs are kept with the related booking resources and appointment records and are deleted with them.

8. Your rights as a data subject

Under Article 11 of KVKK you have the right to:

• Learn whether your personal data is processed and, if so, request information about it.
• Learn the purpose of processing and whether the data is used in line with that purpose.
• Know the third parties in Türkiye or abroad to whom the data is transferred.
• Request correction of incomplete or inaccurate data.
• Request erasure or destruction of the data within the conditions of the law.
• Request that correction, erasure and destruction be notified to third parties to whom data was transferred.
• Object to an adverse outcome produced solely by automated analysis.
• Claim compensation for damage arising from unlawful processing.

9. How to apply

You may send your request to [email protected] by email, or in writing to Kızılırmak Mah. Dumlupınar Bulvarı No: 9/A YDA Center Kat: 9 Daire: 351, Çankaya / Ankara, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request must state your name, contact details and the subject of the request.

Requests are concluded free of charge within 30 days at the latest; where the process entails an additional cost, the fee set by the Board may be charged. If your request is refused or you receive no reply in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 of KVKK.

10. Google Calendar connection

If you connect Google Calendar under Integrations > Calendar in the console, the calendar connection data listed in section 2 is processed for the booking and meeting purposes in section 3. Calendar access is requested only when you start the connection yourself, and you can disconnect at any time in the same place.

This data is processed on the ground of direct relation to the conclusion or performance of a contract (Art. 5/2-c). Keeping the email address of the connected account after a disconnect, so that you can reconnect the same account, relies on our legitimate interests provided that your fundamental rights are not harmed (Art. 5/2-f).

For the personal data of your customers contained in calendar events (for example the name and, depending on your settings, the phone number of the person booking), your business is the data controller; Voxlin processes it as a data processor only on your instructions, as described in section 5.

Appointment events and calendar queries are sent to Google as the calendar provider chosen by your business; Google processes this data under the agreement between your business and Google. Data received from Google is not sold, not used for advertising and not used to train general-purpose AI models; see section 12 of the Privacy Policy for details.

You can exercise your rights regarding this data as listed in section 8, using the procedure in section 9.

11. Changes

This notice may be updated as the service or the legislation changes. The current version is always published on this page; material changes are notified to the email address registered to your account.