KVKK, WhatsApp and customer data: what to look for in an AI assistant

You collect a phone number the moment a customer messages you. Add a name, an appointment, maybe a note about what they wanted. That is personal data, and in Turkey how you handle it is governed by KVKK. Adding AI to the mix does not change the rules. It just makes it more important to know where your data goes.

What is KVKK, in plain terms?

KVKK is Turkey's personal data protection law. It sets rules for collecting, storing, and using people's personal data, and it gives customers rights over their own information. It applies to you, the business owner, not only to the tools you use. So the tools you choose either make your job easier or harder.

Does adding AI to WhatsApp change your KVKK duties?

Not really. The duty was always yours. But AI adds a fair question: where does the message go to be understood, and who can see it? A careful setup keeps customer data in one clear place, protects it, and does not scatter it across services you cannot account for. A vague setup should make you pause.

What should a careful vendor actually do?

Look for concrete practices, not slogans. Here is what good looks like:

• Data stored in the European Union. A clear, named place your data lives, not "somewhere in the cloud".
• Encrypted phone numbers. The most sensitive field, protected at rest.
• Each business isolated. Your customers' data is walled off from every other business on the platform.
• Privacy-by-design. Protection built in from the start, not bolted on after a problem.
• AI disclosure. The assistant tells your customer it is an AI on the first message, so nobody is misled.
• Human handover. A person on your side can take over any conversation at any time.

Secan Asistan is built this way. Data is stored in the European Union, phone numbers are encrypted, and each business is isolated from every other one.

A word on the word "compliant"

Be careful with any tool that promises you compliance. KVKK compliance is not a badge a vendor hands you. It is a shared responsibility. Your vendor secures the platform, and you handle your own duties: telling customers what you collect, having a lawful reason to collect it, and honouring their rights. A good vendor gives you solid ground to stand on. It does not pretend to sign off your legal homework for you.

Questions worth asking any vendor

• Where, exactly, is my customer data stored?
• Are phone numbers and sensitive fields encrypted?
• Is my business kept separate from others?
• Can I delete a customer's data when they ask?
• Does the assistant tell people it is an AI?

If the answers are vague, keep looking. If they are clear and in writing, you have something to work with.

See how it handles a conversation

Curious how it behaves with a real customer? Try it on your own business and notice how it discloses it is an AI up front. Set it up in a few minutes and see for yourself. Start free at /register.