Gizlilik Politikası

Effective date: 28 October 2026

This is the English version of the Puhera Privacy Policy. If it differs from the Turkish version, the Turkish version prevails.

Puhera is a service that lets businesses run AI-powered chat assistants on their websites and messaging channels (Telegram, WhatsApp, Facebook Messenger, Instagram). This policy explains how your personal data is processed when you use Puhera, under Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data controller

Company: ARYBER TEKNOLOJİ LİMİTED ŞİRKETİ ("Aryber", "we")
Address: Esenyalı Mah. Yanyol Cad. Varyap Plaza No: 61 İç Kapı No: 247, Pendik / İstanbul, Türkiye
Email: [email protected]
MERSİS No: 0086179911400001

2. Our two roles

There are two kinds of people on Puhera, and Aryber's role differs for each.

Our customers (businesses that sign up for Puhera and their dashboard users): Aryber is the data controller for account, billing and usage data.
End users (people who chat with a business's assistant on its website or on a messaging channel): Aryber processes their messages on behalf of, and on the instructions of, that business. The business is the data controller for this data and Aryber is the data processor. End users should exercise their rights primarily with the business they chatted with; we forward any requests we receive to that business.

3. Data we process, purposes and legal bases

Identity and contact (customer): name, email, phone number, Aryber Hub account ID. Purpose: account creation, sign-in, verification (email and SMS codes), support. Legal basis: entering into and performing the contract.
Organization and billing: business name, subscription, credit transactions, invoice details. Purpose: running the subscription, payment and invoicing. Legal basis: performance of the contract; legal obligation (tax).
Content uploaded by the business: knowledge base documents and web pages, product catalog, automation flows. Purpose: generating the assistant's answers; documents are also stored with the AI provider for search (OpenAI file search). Legal basis: performance of the contract (on behalf of the business).
Conversation data (end user): message content, channel ID (e.g. Messenger/Instagram user ID, WhatsApp phone number), display name, timestamps, button clicks. Purpose: generating answers, handing over to a live agent, showing conversation history to the business. Legal basis: processing on behalf of the business (the business is the controller).
Live support and forms: agent messages, form fields filled in during the chat (name, email, phone). Purpose: letting the business follow up with its customer. Legal basis: processing on behalf of the business.
Voice assistant: transcript of the call, caller number; audio is processed in real time and no audio recording is stored in Puhera. Purpose: running the voice assistant and keeping conversation history. Legal basis: processing on behalf of the business.
Meta connection data: IDs of connected Pages, Instagram accounts and WhatsApp numbers, encrypted access tokens, name of the account that granted permission. Purpose: running the channels the customer selected. Legal basis: performance of the contract.
Technical and security: IP address, device/browser information, session and application logs. Purpose: security, abuse prevention, debugging. Legal basis: legitimate interest; legal obligation (Turkish Law No. 5651).
Feedback and analytics: answer ratings, unanswered questions, usage statistics. Purpose: measuring assistant quality. Legal basis: legitimate interest.

4. How we collect data

Data is collected automatically from what you enter in the dashboard and mobile app, from the chat tools (web widget and share link), from notifications (webhooks) sent to us by the messaging platforms you connect, and from system logs.

5. Meta platform data (Facebook, Instagram, WhatsApp)

When a business connects Puhera to Meta products with "Connect with Facebook" or with manually entered credentials:

We access only the Page, Instagram account and WhatsApp number the business selects; the business sets the scope of access in the Meta dialog.
We process messages sent to these assets only to let the assistant reply, hand over to a live agent and show the conversation history to the business.
We do not sell data received from Meta, use it for advertising, build profiles with it or use it to train AI models.
Access tokens are stored encrypted and are never shown in any interface.
When the business removes the connection in Puhera or removes the Puhera app in its Meta settings, the tokens are treated as invalid; on a deletion request they are permanently deleted (see the Data Deletion Instructions).

6. Processing with AI

To generate answers, the message content, relevant knowledge base excerpts and the latest messages of the conversation are sent to AI model providers:

OpenAI: text answers, speech and transcription, document search. According to the provider, API data is not used for model training by default and is kept for up to 30 days for abuse monitoring. Knowledge base documents, however, are also kept with OpenAI so they can be searched, and are deleted there when the document, the knowledge base or the organization is deleted.
Google (Gemini): image generation. With paid API use, prompts and responses are not used to improve Google's products.
Cohere: ranking search results.

Aryber does not use customer content or conversation data to train its own models. The assistant's answers are generated automatically and may be wrong; the business can hand the conversation over to a live agent.

7. Transfers and sub-processors

We share data only with the parties needed to provide the service. Some of the providers below are outside Türkiye; these transfers are made under the standard contracts published by the Turkish Personal Data Protection Board under KVKK Art. 9, and the contracts are notified to the Authority within 5 business days of signature. Transfers to messaging channels are necessary to reply on the platform the customer selected and the end user chose to write on.

Contabo GmbH — servers, database, file storage and email delivery (Aryber's own mail server). Location: European Union (France, Lauterbourg data center).
OpenAI — answer generation, speech and transcription, knowledge base search. Location: USA.
Google (Gemini API) — image generation. Location: USA and Google facilities.
Cohere — ranking search results. Location: Canada / USA.
PostHog (EU Cloud) — application logs and debugging. Location: Germany (Frankfurt).
Meta Platforms (WhatsApp, Messenger, Instagram) — receiving and sending messages on channels the customer connected. Location: USA / Ireland.
Telegram — the Telegram bot the customer connected. Location: based in the UAE; data centers in several countries.
Netgsm — SMS verification codes and the voice assistant's phone line (SIP). Location: Türkiye.
LiveKit — LiveKit Cloud: the voice assistant's audio stream, phone connection, speech-to-text, text-to-speech and language model. Location: USA-based; audio is processed on LiveKit's global server network.
Aryber Hub (Aryber's own system) — single sign-on, subscription and payment. Location: European Union (Contabo).
Competent authorities — legal requests. Location: Türkiye.

We do not sell your data to third parties.

8. Retention

Account: When you delete your account, your user record and sessions are permanently deleted immediately. Organizations where you are the only member are deleted with all their data, and the knowledge base copies held by the AI provider are removed as well.
Organization data (chatbots, knowledge base, conversations): kept as long as the organization exists. Conversations, chatbots and documents deleted one by one in the dashboard are removed from view and kept in an archive until the organization is deleted; they are permanently deleted on written request to [email protected]. Copies of deleted knowledge base documents held by the AI provider are removed immediately.
Billing records: for the period required by tax law.
Unanswered question logs: 180 days; feedback comments: 365 days.
Meta connection tokens: until the connection is removed; immediately and permanently on a deletion request.
Access (traffic) logs: at least 1 and at most 2 years, as required by Law No. 5651.
AI provider abuse-monitoring logs: up to 30 days under the provider's policy.

9. Security

All traffic is encrypted with HTTPS. API keys and channel tokens are stored encrypted in the database and are not shown in interfaces. Notifications from messaging platforms are verified by signature. Each organization's data is kept separate and accessed with role-based permissions.

10. Cookies

Puhera uses only the cookies and browser storage that are strictly necessary for the service to work:

puhera.com: a session cookie and a form security (CSRF) cookie; both expire after 2 hours.
Dashboard and mobile app: the sign-in key, the selected organization, language, theme and interface preferences are kept in the browser's local storage.
Chat tools (web widget and share link): the visitor's chat session, conversation history and feedback are kept in the browser's local storage so the chat continues where it left off after a page reload.

We do not use advertising, analytics or tracking cookies, and we do not share this data with third parties. Strictly necessary cookies do not require consent. You can clear this data in your browser settings; you will then be signed out and the chat history will be removed from your browser.

11. Your rights

Under KVKK Art. 11 you have the right to learn whether your data is processed, request information about it, learn the purpose of processing and the parties it is transferred to, ask for incomplete or incorrect data to be corrected, deleted or destroyed, ask for these actions to be notified to the recipients, object to a result against you that arises from automated analysis, and claim compensation for damage caused by unlawful processing. If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection, and you may lodge a complaint with your local supervisory authority.

You can send your request to [email protected], with information that lets us verify your identity. We answer requests free of charge within 30 days at the latest. If you are not satisfied with our answer, you can file a complaint with the Turkish Personal Data Protection Board. How to apply is set out in the KVKK Privacy Notice.

12. Children

Puhera is a service for businesses; people under 18 are not allowed to create an account.

13. Changes

When we update this policy we change the effective date and notify account owners of material changes by email.