Skip to content
Müşavir
TR RU

Privacy Policy

Last updated: 20 October 2026

This document is a translation. In case of any discrepancy, the Turkish version prevails. Turkish version

This Privacy Policy explains how Müşavir Teknoloji ve Yazılım A.Ş. (“Müşavir”, “we”) collects, uses, shares and protects personal data when you visit musavir.co or use the Müşavir application. We act as the data controller for our own website and account data, and as a data processor for the business data our customers store in the application.

1. Data we collect

Account data

Name, e-mail address, phone number, the company you belong to and your role. This is required to create an account, authenticate you and apply permissions. If you verify your mobile number by SMS code (optional, Turkish +90 numbers only), the verified number is used for phone sign-in and account security; a number is linked to one account only (KVKK Art. 5/2-c and f).

Payment and billing data

Billing name, address, Turkish ID or tax number, payment amount and date, iyzico customer and subscription reference codes and the last four digits of the card. We never hold the full card number. This data is processed only when you make a payment: it is required to collect the fee and issue an invoice when you buy AI credits and once paid subscriptions are opened. Subscription billing is currently closed.

Customer content

Data you enter into the application; customers, quotes, invoices, accounting records, personnel records, files and messages. You decide what goes in; we process it on your instructions to provide the service.

Technical data

IP address, browser and device information, pages visited and error diagnostics. We use this to keep the service available, investigate faults and prevent abuse.

Communications

Messages you send us by e-mail, phone or the contact page, and our replies.

Personal data is collected electronically, by automatic means, through contact and request forms, e-mail and the application.

2. Why we process it and on what legal basis

  • To provide the service: performance of a contract with you or your company (KVKK Art. 5/2-c).
  • To secure the service: our legitimate interest in preventing unauthorised access and abuse (KVKK Art. 5/2-f).
  • Subscription and AI credit payments and invoicing: payment and billing data is processed for the performance of a contract (KVKK Art. 5/2-c) and to meet our legal obligation to issue and keep invoices (KVKK Art. 5/2-ç).
  • To meet legal obligations: accounting, tax and record-keeping duties under Turkish law (KVKK Art. 5/2-ç).
  • To respond to contact and demo requests: processing directly related to establishing a contract (KVKK Art. 5/2-c) or our legitimate interest in answering your request (KVKK Art. 5/2-f).
  • Commercial electronic messages: promotional email, SMS and phone calls are made only on the consent you give at sign-up in a separate box, which is not a condition of registration (Law No. 6563). Your opt-ins and opt-outs are recorded with the text version, date, channel and IP address; where the legislation requires it, we report them to the Message Management System (İYS). You can switch each channel on or off separately under Profile > Communication permissions in the panel. You can also withdraw it at any time through the opt-out link in any message, through İYS or by writing to us; account-related service messages do not depend on this consent. Texts: commercial message consent, KVKK privacy notice, explicit consent text.
  • E-invoice recipient check: to decide whether an invoice is issued as an e-invoice or an e-archive invoice, GİB's public register of e-invoice users is downloaded daily and kept in our system (KVKK Art. 5/2-ç and data made public, Art. 5/2-d).

3. Sign-in with Google

If you sign in with Google, we receive your name, e-mail address and profile picture from Google to create and identify your account. We do not receive your Google password, and we do not request access to your Gmail, Drive or contacts. You can disconnect the Google connection at any time from your Google Account security settings; your Müşavir account remains and you can continue signing in by e-mail.

4. Recipients of data

We share data only with the following providers that help us run the service:

  • Hetzner (Germany): hosting. Servers we manage in Hetzner’s data center in Germany; databases, files and backups are kept on this infrastructure.
  • Cloudflare (headquartered in the USA): DNS, content delivery and security layer; IP address and request information.
  • Mailgun (USA): transactional e-mail such as sign-in codes, notifications and reconciliation letters; recipient name, e-mail address and e-mail content.
  • NETGSM (Türkiye): one-time code and reminder SMS; phone number and message content.
  • OpenRouter (USA): AI model routing gateway that forwards the request to the model provider serving the chosen model; the request may be processed on Anthropic's own infrastructure or on the cloud infrastructure serving the model (Amazon Bedrock, Google Vertex AI), whose processing region may also be outside the USA. Requests are sent so that they are routed only to endpoints with data retention disabled (zero data retention) where offered and that do not use data for model training. The models in use today are the Claude models of Anthropic (USA), the model provider OpenRouter forwards requests to. AI features run per company, once the company owner switches them on and gives consent; in AI chat the message the user writes, the conversation history and the AI agent's instructions are then transferred (chat does not access panel records), and in automated tasks the conversation text from the connected messaging account and the related lead record.
  • EVREN AI platform (Türkiye): open-source language models operated by SSB and hosted in Türkiye; data does not leave the country. Not active at present; once switched on, the message written in AI chat, the conversation history and the AI agent's instructions are processed there.
  • The active AI route today is OpenRouter; EVREN is not active at present. We have no direct contract with model providers (such as Anthropic); our relationship is with OpenRouter and EVREN.
  • iyzico Ödeme Hizmetleri A.Ş. (Türkiye): card collection when you make a payment (one-time AI credit packages; the subscription fee once paid subscriptions are opened); name or company name, email, mobile phone, Turkish ID or tax number, billing address and IP address. Card data is processed by iyzico under its own responsibility as a payment institution licensed under Law No. 6493; we store only iyzico customer and subscription reference codes and the last four digits of the card.

Where your company connects its own accounts (İmzala, PayTR, Paraşüt, your own Turkcell e-Şirket account, WhatsApp and Chatwoot), those providers receive data under your own agreement with them, during operations you initiate. For e-invoices, e-archive invoices, e-dispatch notes and e-SMM your company is the data controller: you issue the document, Müşavir passes the document data (document content, recipient name, tax or national ID number, address, line items and amounts) to the provider you connected on your instruction, and the provider transmits it to the Revenue Administration (GİB) under your company's tax obligations. Müşavir is not a private integrator. We store the credentials you supply encrypted and never return them to the browser. See the Subprocessors page for the current list and details.

5. International transfers

Your data is hosted in Hetzner’s data center in Germany. Sending data from Türkiye to Germany and to the other subprocessor countries, including the USA, is a cross-border transfer under Article 9 of the Turkish Personal Data Protection Law (KVKK) and is carried out under the appropriate safeguards of Article 9/4. These transfers rely on the standard contracts published by the Personal Data Protection Board; signing them and notifying the Authority is in progress.

6. Retention

  • Account data: kept while your account is active.
  • Customer content: after the subscription ends it can be exported for 30 days; it is then deleted from live systems and removed from backups within at most 30 more days.
  • Statutory retention obligations are reserved: data that must be kept under the Tax Procedure Law and the Turkish Commercial Code, such as accounting records and e-documents, may be kept with restricted access for that period (up to 10 years) and is deleted when it ends. Your own statutory retention remains the responsibility of your company as data controller; we recommend exporting your data before the export period ends.
  • Payment and billing data: kept for 10 years under the Tax Procedure Law (VUK) and the Turkish Commercial Code (TTK), then deleted.
  • Contract acceptance records: the record of your acceptance of the pre-contract information form and distance sales agreement for the subscription and for AI credits (acceptance date, accepted text version, name or company name, email, tax identity and IP address at the time) is kept to prove that the contract was formed. It is retained even if your account is deleted; only its link to the user account is removed (KVKK Art. 5/2-a and e).
  • Support request attachments: attachments that pass the virus scan are deleted 2 years after the request is closed; files that cannot be scanned or remain in quarantine are deleted after 7 days. An infected file is deleted immediately; for security purposes only a masked file name, the file hash (SHA-256) and the detected virus name are kept (KVKK Art. 5/2-f).
  • Technical logs: kept for 90 days for security and troubleshooting.
  • Contact requests on the marketing site: kept for 2 years unless a contract follows.

7. Security

Access is scoped per company and per module at the application layer; row-level security in the database blocks anonymous access. Credentials for third-party services are encrypted with AES-256-GCM. Traffic is served over TLS. The database is backed up every 6 hours; regular restore testing is our target.

8. Your rights

Under KVKK Article 11/1 you have the right to:

  • (a) learn whether your personal data is processed,
  • (b) request information about it if it is processed,
  • (c) learn the purpose of processing and whether it is used for that purpose,
  • (ç) know the third parties in Türkiye or abroad to whom it is transferred,
  • (d) request correction if it is incomplete or inaccurate,
  • (e) request deletion or destruction under the conditions of KVKK Article 7,
  • (f) request that actions under (d) and (e) be notified to third parties to whom the data was transferred,
  • (g) object to a result against you arising exclusively from analysis by automated systems,
  • (ğ) claim compensation for damage caused by unlawful processing.

Write to [email protected] and we will respond within 30 days at the latest. If your request is rejected, you find the answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board under KVKK Article 14. If your data was entered by a company using Müşavir, we will direct your request to that company as the controller. How to apply, recipients, transfers abroad and retention periods are set out in detail in the KVKK Privacy Notice.

If you are in the European Union and the GDPR applies, you also have the rights of access, rectification, erasure, restriction, objection and data portability, and the right to lodge a complaint with your local supervisory authority.

9. Cookies

We use the minimum cookies needed to keep you signed in and to keep the site working. See our Cookie Policy for the full list.

10. Changes

We update this policy when the service changes. Material changes are announced in the application or by e-mail before they take effect.

11. Contact

Müşavir Teknoloji ve Yazılım A.Ş. · [email protected] · [email protected]