Every service provider that touches your data is on this list

Access to the AI model

AI features run per company: the company owner switches them on from the AI screen and gives consent; without the owner’s consent no data is sent to a model. The active route today is OpenRouter, and the models in use are Anthropic’s Claude models. We have no direct contract with model providers (such as Anthropic); OpenRouter forwards the request, which may be processed on Anthropic’s own infrastructure or on the cloud infrastructure serving the model (Amazon Bedrock, Google Vertex AI). Requests to OpenRouter are sent so that they are routed only to endpoints with data retention disabled (zero data retention) and that do not use data for training; free (data-collecting) models are not used in automated tasks. Zero data retention concerns the endpoint that processes the request; limited retention for abuse monitoring is subject to the relevant provider’s terms.

The data sent to the model depends on the feature you switch on: in AI chat, the message you write, the conversation history and the AI agent’s instructions (chat does not access your panel records); in the automated task that runs overnight, the previous day’s conversation text from your connected messaging account (WhatsApp, Chatwoot) and the related lead record. The conversation text includes internal (private) team notes in your messaging account. From the lead record only the name, stage and the needs profile the AI previously extracted are sent; custom fields and Conversation Tracking notes are not sent. Document parsing (PDF text and e-invoice XML) runs on the platform’s own servers, and no data is sent to a model for it.

EVREN is operated by SSB and hosted in Türkiye; it is not active at present. Once switched on, data on that route does not leave Türkiye and this page is updated beforehand.

Services that receive no personal data

Some services supply data to the platform but receive no personal data from us, so they are not subprocessors. For example, we get exchange rate data from CollectAPI; no personal data is sent to that service.

Providers for subscription and credit payments (no tenant data)

Card payment for your Müşavir subscription and AI credit packages is taken through iyzico Ödeme Hizmetleri A.Ş. (Türkiye). As a payment institution licensed under Law No. 6493, iyzico processes card data under its own responsibility as an independent data controller; it has no access to tenant data on the platform. We store only iyzico customer and subscription reference codes and the last four digits of the card.

Services the tenant connects

The services below only run if you connect them. Credentials are stored encrypted with AES-256-GCM; data goes to these providers during an action you start.

If you do not connect one of these services, the related task either runs on the platform’s own infrastructure or does not run; connecting them is optional. E-invoices, e-archive invoices, e-dispatch notes and e-SMM are transmitted to GİB only once you connect your own provider account: you issue the document and your provider transmits it; Müşavir is not a private integrator and does not transmit documents on your behalf through its own account.

Change notification

When a new subprocessor is added, or the scope of data an existing one processes expands:

1. The change is announced at least 30 days in advance on this page and by email to tenant administrators.
2. Tenants with a data processing agreement can send a reasoned objection through the contact page within that period.
3. For changes made for urgent security reasons, notice is given as soon as possible, together with the reason.
4. This notice applies to the platform subprocessors table above. Services you connect (the tenant-connected services table) are enabled by your choice and under your own agreement with the provider; when we add a new function to one of them we announce it, but no data is sent until you connect the service.