You own your records; we process them on your behalf

Why roles matter

KVKK and GDPR hold every party that handles data responsible according to its role. When you enter a customer record into the platform, you decide why and how it is processed, so you are the data controller. Müşavir stores, displays and processes that record on your behalf, so it is the data processor. Informing data subjects, obtaining explicit consent where needed and choosing the legal basis are the controller’s tasks.

For our own subscribers’ account details, panel session records and requests that reach our marketing site, Müşavir is the controller. That data is described in our privacy policy.

Processing on your instructions

• We process tenant data only to provide the service, answer your support requests, keep the platform secure and meet legal obligations.
• We do not sell tenant data, use it for ad targeting or give it to AI model training.
• We aim to bind the subprocessors we work with directly to obligations at the same level; for AI requests, the request reaches the model provider (such as Anthropic) through OpenRouter; the list is on the subprocessors page.

Conversation report and morning email

You can export the conversation report to Excel. The report contains conversation notes, call dates, and the days and direction of messaging; message content is not exported. Every export is written to the audit trail. Each morning your team members receive an email listing their appointments and tasks for the day; the list includes person names and is sent through our existing email subprocessor, Mailgun.

Retention approach

• During the subscription: Records are kept until you delete them. Deletion is done from the panel, subject to permissions. Statutory retention periods for accounting records are your responsibility; the platform keeps those records unless you delete them.
• When the subscription ends: You get time to export, after which data is deleted from the live system. Copies in backups expire on their own when the backup retention cycle completes.
• Conversation records: When you delete a person, their conversation notes are deleted too; their open calls and reminders are archived.
• Audit trail: Actions such as deletions, exports and changes made by AI are written to the audit trail with who and when.
• Security and operational logs: Kept for a limited period for troubleshooting and security.

Data processing agreement

We sign a data processing agreement on request. It covers the subject and duration of processing, data categories, technical and organizational measures, subprocessor approval, cross-border transfer safeguards, breach notification, and return and deletion at the end of the contract. When you switch on AI features, your responsibility to inform the people concerned and obtain explicit consent where needed, and the cross-border transfer in those features, are also covered by the agreement. Send your request through the contact page.