KVKK Privacy Notice

This privacy notice has been prepared by DManagers, as the data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

Data controller

DManagers

Website

dmanagers.com

Requests and contact

support@dmanagers.com

The email address above is our only contact channel for all your applications and requests.

DManagers is a software service that uses AI to reply to messages and comments received on Instagram and Facebook accounts, and that lets businesses connect their WhatsApp lines to the dashboard to monitor their conversations and calls. This setup creates two different relationships:

• We are the data controller for our users’ data. We process the data of the business owners and authorized representatives who sign up for the service for purposes and by means that we determine ourselves.
• We are the data processor for end-user data. For the messages and comments sent by our users’ customers and the information shared in chats, the data controller is the business concerned; we process this data only on that business’s instructions.
• We are the data processor for WhatsApp line monitoring. For the conversations, media, call history and recordings of the lines a business connects, and for the data of staff and third parties they contain (people chatted or spoken with, and people saved in the line’s phone contacts), the data controller is the business that connected the line. We process this data only to provide the service and on the business’s instructions; determining the legal basis for processing and informing the data subjects is the business’s responsibility.

Identity

First name, last name, information about the business’s authorized representative.

Contact

Email address, phone number, contents of correspondence.

Social login data

When you log in with Google or Facebook, the name, email address, account ID and profile photo URL shared by that provider (we do not store a copy of the photo).

Customer transactions

Subscription and plan information, message usage counters, request and complaint records.

Transaction security

IP address, session and login records, device and browser information, password hash, access tokens.

Finance

Billing information, payment status and amount (card details stay with the payment provider and are not stored by us).

Visual and audio records

Images sent in chats, post/Reels images, voice messages and their transcriptions.

Social media account data

The ID, name, profile image and permission scope of the connected Instagram account and Facebook Page.

Chat and content data

Direct messages, comments, the bot’s replies, and answers given to the fields you define in the lead collection setup.

Marketing

Your consent and preferences for commercial electronic messages.

WhatsApp conversations

Message texts in one-to-one chats on connected lines; the original version of deleted and edited messages; locations and contact cards; the phone number, WhatsApp name and WhatsApp profile photo of the person chatted with.

WhatsApp contact names

Names saved in the connected line’s phone contacts, matched to the person’s WhatsApp number or ID; solely to show the person in conversations by the name saved on the phone. WhatsApp sends the contacts to the linked device; the dashboard shows only the names of people you have chatted with, not the full contact list.

WhatsApp media

Images, voice recordings, videos and documents sent and received in chats.

Call records and metadata

The direction of the call, the other party’s number and name, start and end time, duration and outcome; if recording is on, the audio recording of the call and the recording announcement.

Staff and third-party data

Data about the staff who use the connected line and the people who chat or talk with them, as contained in the conversations and calls above; for people saved in the line’s phone contacts — even if they have never chatted with the line — their name in the contacts and their WhatsApp number or ID; the line’s number, profile name and connection history.

Depending on their content, WhatsApp conversations may also contain special categories of personal data. We recommend that businesses not use their connected lines to request or share such data.

• Creating your account, verifying your identity and keeping your account secure,
• Providing the service: generating replies to messages and comments on your behalf, and managing chats in the dashboard,
• Providing WhatsApp line monitoring: connecting lines to the dashboard, showing conversations and calls in the dashboard, sending messages and making calls from the dashboard, optional call recording, and email notifications when a line disconnects,
• Fulfilling contractual obligations, and tracking subscriptions and message limits,
• Billing, collecting payments and keeping accounting records,
• Responding to support requests and carrying out communications,
• Running information security processes, and preventing abuse and fraud,
• Improving the service, fixing bugs and measuring its quality,
• Providing information to competent authorities and institutions, and fulfilling legal obligations,
• Carrying out promotional and marketing activities, if you have given your explicit consent.

The processing of personal data for the purposes above is based on the following legal bases set out in Article 5 of KVKK:

Art. 5(2)(a) — Expressly provided for by law

Record-keeping obligations under tax, commercial and e-commerce legislation.

Art. 5(2)(c) — Formation or performance of a contract

Creating memberships, providing the service, subscription and payment collection processes.

Art. 5(2)(ç) — Compliance with a legal obligation

Responding to requests from competent authorities, billing.

Art. 5(2)(e) — Establishment, exercise or protection of a right

Keeping records that would serve as evidence in the event of a dispute.

Art. 5(2)(f) — Legitimate interest

Information security, preventing abuse, improving the service.

Art. 5(1) — Explicit consent

Sending commercial electronic messages, and transfers abroad where no appropriate safeguards are in place.

Personal data is collected by fully or partly automated means through forms on our website and in the dashboard, sign-up and login (including logging in with Google or Facebook), files you upload, email and support correspondence, and the official application programming interfaces (APIs) provided by Meta.

Access to your social media account is set up with the permission you grant on Meta’s own login screen; your account password is never passed on to us at any stage.

In WhatsApp line monitoring, data is collected by automated means through the linked-device session that the business connects with a QR code. This connection is not WhatsApp’s official business interface; conversations and calls are received in real time for as long as the line stays connected. If the business chose to import past conversations when adding the line, then each time the line is (re)paired with a QR code, the one-to-one conversations from the last 30 days that WhatsApp transfers to the linked device (excluding media files) and the calls from the same period in the phone’s call history are also received; this includes messages written and calls made before the connection and during periods when the line was not connected. If the business did not choose this, only conversations and calls after the connection are saved to the dashboard; messages written and calls made before the connection are not imported into the dashboard and are not stored. Even in that case, the initial sync data that WhatsApp sends to the linked device during pairing (which may also include recent chats from before the connection and the phone’s call history) is read for the technical setup of the connection; the old calls and messages it contains are discarded without being saved, and only the technical mapping information needed for the connection to work (such as the mapping between the WhatsApp ID and the phone number of people chatted with) and contact names for showing names in conversations (see below) are stored.

To show people in conversations by the names saved on the line’s phone, the contact names that WhatsApp sends to the linked device are also received: the full contact list when the line is paired with a QR code, and any later changes, even if history import is not selected. The dashboard shows only the names of people chatted with, not the full contact list. The WhatsApp profile photo of people chatted with is retrieved from WhatsApp if the person’s WhatsApp privacy settings allow it.

Domestic transfers (Art. 8)

Your personal data may be transferred, limited to the purposes above, to the suppliers that provide us with cloud and hosting services, the payment provider, our accountants and legal counsel, audit firms and, upon request, competent public authorities and institutions.

Transfers abroad (Art. 9)

Some of the AI model providers and cloud infrastructure providers we use to deliver the service are based abroad. As a result, your personal data, including message contents, may be transferred abroad. Transfers are carried out on the basis of appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board, written undertakings or binding corporate rules, and, where these are not available, on the basis of your explicit consent.

Transfers to Meta Platforms companies are necessary by the very nature of the service: this is the only way messages and comments can be received and sent.

WhatsApp line monitoring data

WhatsApp conversations, media and call records are stored and processed on Supabase infrastructure for the database and file storage, and on Railway infrastructure for the application servers. Because these providers are located abroad, the transfer is subject to the Art. 9 safeguards above. WhatsApp data is not transferred to AI providers and is not shared with anyone for advertising or analytics purposes.

By their nature, messages are sent and received through WhatsApp (Meta) infrastructure. In the email notification sent when a line disconnects, only the line’s name and the last four digits of its number are passed to the email delivery provider.

Personal data is retained for as long as necessary for the purpose for which it is processed and for the limitation periods set out in the applicable legislation. When the period ends or the conditions for processing no longer exist, the data is deleted, destroyed or anonymized.

Membership and account data

For the duration of the membership; deleted within 30 days after it ends.

Chat and content data

As long as the account is open; deleted when the account is closed or at your request.

Transaction security records

Up to 12 months.

Invoices and accounting records

10 years, as required by the applicable legislation.

Commercial electronic message consents

3 years after the consent is withdrawn.

WhatsApp messages and call history

As long as the account is open, with no time limit; deleted when the account is closed or on request. If “also delete all its data” is selected when deleting a line from the dashboard, that line’s conversations and call history are deleted immediately; otherwise they are kept.

WhatsApp media files

12 months; at the end of this period the file is deleted and the message record is kept.

WhatsApp call recordings

90 days; at the end of this period the audio file is deleted and the call history is kept.

WhatsApp connection history

180 days (except the line-adding consent and the line deletion record; see below); deleted immediately when the line is deleted with “also delete all its data” selected.

WhatsApp line-adding consent

The date of the consent you gave when adding the line (that the line belongs to your company and that staff were informed in advance) and of the line’s deletion record, together with the user who confirmed it: kept as long as the account is open, even if the line is deleted from the dashboard; not subject to the 180-day period of the connection history. Deleted when the account is closed.

WhatsApp session keys

Deleted when the line is deleted or logged out; no later than 2 days after the line is deleted.

The line’s WhatsApp profile photo and recording announcement

As long as the line is in use; usually deleted within one day when the line is deleted from the dashboard with “also delete all its data” selected, or when the account is closed.

Names in the line’s phone contacts

As long as the line’s session is active. When the line is logged out (from the Dashboard or from the phone) or the line is reconnected with a new QR code, the contact names and the contact names shown in conversations are deleted. When the line is deleted, its contacts are deleted (no later than 2 days after the line is deleted); only the names of people you have chatted with, as shown in conversations, stay with the conversation, and these are also deleted if the line is deleted with “also delete all its data” selected. Deleted immediately when the account is closed.

WhatsApp profile photos of people you chat with

As long as the conversation is kept; when there is a new message in the conversation, the photo is rechecked at most once every 7 days. If the person removes or hides their photo, it is deleted at the next check. Usually deleted within one day when the line is deleted from the dashboard with “also delete all its data” selected, or when the account is closed; conversations of a line deleted without this option selected are kept with their photos.

WhatsApp files when the account is closed or a line is deleted with all its data

After the account or the line is deleted (with “also delete all its data” selected), media files, call recordings, announcements and profile photos are deleted from storage during daily maintenance (usually within one day).

How to submit a deletion request is explained on the Data Deletion page.

Under Article 11 of KVKK, by applying to the data controller, you have the right to:

• learn whether your personal data is being processed,
• request information about it if it has been processed,
• learn the purpose of the processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom it has been transferred,
• request its correction if it has been processed incompletely or inaccurately,
• request its deletion or destruction under the conditions set out in the Law,
• request that corrections, deletions and destructions be notified to the third parties to whom the data has been transferred,
• object to an outcome against you that arises from the analysis of the data exclusively through automated systems,
• claim compensation for damages if you suffer harm due to unlawful processing.

You can submit your requests regarding your rights by email, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

1. Write to support@dmanagers.com from the email address registered in our system. Using your registered address is necessary for us to verify your identity.
2. Write “KVKK Request” in the subject line and state your request clearly.
3. If you wish, you can sign your application with a secure electronic signature or mobile signature and send it to the same address.

Your application must include your first name, last name, Turkish national ID number (passport number for foreign nationals), contact details we can use to reply to you, and the subject of your request.

We will resolve your request free of charge as soon as possible depending on its nature, and within 30 days at the latest. If the process requires an additional cost, a fee may be charged according to the tariff set by the Board. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in any case, within 60 days of the application date.

Details on how data is processed are on the Privacy Policy page, and the terms of use of the service are on the Terms of Service page.