Privacy Policy
Last updated: 29 June 2026
This Privacy Policy explains how SECAN BİLİŞİM TEKNOLOJİLERİ LİMİTED ŞİRKETİ processes data of the business owners who use Secan Asistan. We are the controller of your account data and the processor of your customers’ data, acting on your instructions.
1. Data we process (your account)
We process your name, email address, business details, billing information, and technical records of your use of the service (session, usage metering, security logs), plus your communications with us.
2. End-customer data (as processor)
To operate the assistant, your customers’ message content and contact details (e.g. phone number) are processed on your instructions. You are the controller of this data; processing is subject to the data-processing terms between us.
3. Purposes & legal bases
We process data to provide the service and perform our contract, for billing, for security and abuse prevention (legitimate interest), to comply with legal obligations, and to communicate with you.
4. AI processing
To generate replies, message content is processed by our AI provider Anthropic (Claude). This processing is carried out under a DPA and Standard Contractual Clauses (SCCs), and your data is not used to train models.
5. Sub-processors
To deliver the service we use these sub-processors: Anthropic (AI), Cloudflare (hosting and database), Meta/WhatsApp (message transport) and Brevo (transactional email). The current list is available on request.
6. Storage location & security
Your data is stored within the European Union (Cloudflare D1, EU jurisdiction) and encrypted at rest with AES-256-GCM. Access controls and audit logging are applied.
7. International transfers
AI processing may involve a transfer to our US provider (Anthropic); such transfer is protected by Standard Contractual Clauses (SCCs) and appropriate safeguards under KVKK.
8. Retention
We keep your account data while your account is active and for applicable legal periods. Customer message content is retained per your business’s retention period (default 90 days). Deletion on request.
9. Your rights
Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection; under KVKK Art. 11 you have rights including information and correction/deletion. To exercise: inbox@secan.tech.
10. Cookies
We use only the essential cookies needed to maintain your session. We do not use advertising or third-party tracking cookies.
11. Changes & contact
We may update this policy and will notify you of material changes. Controller: SECAN BİLİŞİM TEKNOLOJİLERİ LİMİTED ŞİRKETİ, Etiler Mah. Evliya Çelebi Cad. No: 23/107, Muratpaşa, Antalya 07010, Türkiye. Contact: inbox@secan.tech.