Privacy policy
Last updated: 25 October 2026
This policy explains how Agenta processes personal data under the EU General Data Protection Regulation (GDPR) and Türkiye's data protection law (KVKK, Law No. 6698). It covers visitors to agenta.digital, our business customers and their staff, and the people who message our customers' businesses.
1. Who is responsible
For the website, customer accounts and billing, the controller is Ömer Ögeday İnan (Agenta), İskele Mah. 2018/8 Sk. No: 8, Urla / İzmir, Türkiye, tax number Urla VD / 4750517527. Contact: info@agenta.digital.
For messages that people send to our customers' businesses (on WhatsApp, Instagram, Messenger, Telegram or the website chat), the business is the controller and Agenta is its processor under the data processing agreement. Questions about such conversations go first to that business.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, e-mail, phone, business name, VAT number, billing details | Creating and running your account, invoicing, support | Contract, Art. 6(1)(b); legal obligation for invoices and tax records, Art. 6(1)(c) |
| Login e-mail, session data (session keys stored only as hashes), device name, platform and notification token of the mobile app | Signing in and sending you notifications about new leads, requests and messages | Contract, Art. 6(1)(b) |
| Message content, platform IDs (WhatsApp ID, Instagram ID, Facebook PSID), profile name, time and channel of messages to our customers | Generating replies, passing requests to the business, summaries and statistics in the business's panel | On behalf of the business (processor, Art. 28) |
| IP address and technical logs, error reports | Security, preventing abuse, fixing errors | Legitimate interest, Art. 6(1)(f) |
| Advertising and analytics cookies (Google Ads, Google Analytics 4, Meta Pixel) | Measuring which channels bring customers | Consent, Art. 6(1)(a); only after you choose “Accept” |
| E-mail or phone, sector and interest in the “Tell me when it's ready” form | Telling you when an AI employee is ready | Consent, Art. 6(1)(a) |
The Agenta mobile app has no ads, no advertising identifiers and no third-party analytics. Face ID and Touch ID checks stay on your device. You can delete your account in the app under Account → Delete my account.
3. Use of artificial intelligence
Bot replies are generated automatically by AI. To write a reply, the customer's message, earlier messages or a summary of the same conversation, and relevant parts of the business's documents are sent to an AI provider (OpenAI, and Google Gemini only if OpenAI is unavailable). Messages are also classified by topic and summarised. AI replies can be wrong. The bot does not take final decisions on appointments, prices or orders; it passes the request to the business, and the business can take over any conversation. No decision with legal or similarly significant effect is taken solely by automated means (Art. 22).
4. Recipients and sub-processors
We share data only with providers that need it to deliver the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Contabo GmbH | Hosting of the application server, database, queue and file storage | Germany (EU) |
| OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.) | Generating replies, classifying messages, summaries and search vectors (embeddings) | USA |
| Google (Gemini API) | Back-up AI provider, only when OpenAI is unavailable | USA |
| Cloudflare, Inc. | DNS, network protection, e-mail relay, encrypted off-site backups (R2), bot check (Turnstile) | USA / worldwide network |
| MailChannels Corp. | Delivering notification e-mails (via Cloudflare) | USA |
| Resend, Inc. | Delivering transactional e-mails (login links, notifications) | USA |
| Functional Software, Inc. (Sentry) | Error monitoring; phone numbers, e-mail addresses, card and bank numbers are masked before sending | USA |
| Meta Platforms Ireland Ltd. | Sending and receiving WhatsApp, Instagram and Messenger messages on channels the customer connects | Ireland (EU) / USA |
| Telegram Messenger Inc. | Telegram channel and notifications, only if the customer turns them on | United Arab Emirates / worldwide |
| 650 Industries, Inc. (Expo), with Apple (APNs) and Google (FCM) | Delivering notifications to the Agenta mobile app (title and short text) | USA |
| Google LLC (Google Calendar) | Writing appointment requests to the customer's calendar, only if the customer connects it | USA |
| Google LLC (Google Ads API) | Reporting ad click IDs of leads to the customer's Google Ads account, only if the customer connects it | USA |
Only for our own billing: PayTR Ödeme Hizmetleri A.Ş. (Türkiye, card payments; card data never reaches us) and Nilvera Yazılım A.Ş. (Türkiye, statutory e-invoices). Only on our website and with your consent: Google Ireland Ltd. (Google Ads, Analytics) and Meta Platforms Ireland Ltd. (Meta Pixel and Conversions API). Integrations a business connects itself (such as Trendyol, Shopify or WooCommerce) are that business's own providers.
5. Transfers outside the EU/EEA
Our servers are in Germany. Agenta is run from Türkiye, so authorised staff access data from Türkiye, and some providers above are in the USA or elsewhere. For these transfers we use the European Commission's standard contractual clauses (for our customers they are part of the data processing agreement) or, for US providers certified under it, the EU–US Data Privacy Framework. We send each provider only the data it needs.
6. How long we keep data
- Conversations and messages while the service runs: at most 24 months by default; older conversations and messages are deleted. A business can ask for a shorter period. Summaries follow the same period. If someone asks not to be messaged again, we keep that request without message content.
- After a contract ends: conversations, documents, catalogues, integration credentials and channel access keys are kept for 90 days (restored if the account is reopened), then deleted.
- Backups: daily database copy on the server for 14 days, encrypted off-site backups for at most 30 days, encrypted archive for point-in-time recovery about 8 days. Deleted data may remain in backups until these periods end.
- Invoices and commercial records: 10 years, as required by Turkish tax law.
- “Tell me when it's ready” sign-ups: at most 12 months; deleted earlier once we notify you or you withdraw consent.
- Error reports: 90 days.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR), and to withdraw consent at any time without affecting earlier processing. Write to info@agenta.digital; we answer within one month. You can also complain to a data protection authority, for example the Dutch Autoriteit Persoonsgegevens or the authority in your own country.
8. Deleting Meta platform data
If you used our service through Facebook, Instagram or WhatsApp and want your data deleted, write to info@agenta.digital. Our Meta data-deletion callback records the request; we verify your identity, delete the data and complete the request within 30 days. You can follow it with your confirmation code at https://api.agenta.digital/webhook/data-deletion. For conversations held by one of our customers, contact that business directly.
9. Security
Data travels over TLS 1.3. Access tokens are stored encrypted (XSalsa20-Poly1305). Each business's data is separated in the database with PostgreSQL row-level security. Backups are encrypted before they leave the server; the storage provider does not hold the keys.
10. Cookies
Essential cookies keep you signed in and protect the service; they need no consent. Advertising and analytics cookies (Google Ads _gcl*, Google Analytics _ga, _ga_*, Meta _fbp, _fbc) are set only if you choose “Accept” in the cookie notice; without consent Google receives no identifiers (Consent Mode v2) and Meta's script is not loaded. With consent we also send conversions such as a sign-up from our server to Meta (Conversions API) without your e-mail or IP address, and measure setup steps in the customer panel without message content. Your choice is stored in the agenta_consent cookie for 180 days for agenta.digital and its subdomains. You can delete cookies in your browser at any time.
11. Changes and contact
We may update this policy and tell active customers about material changes by e-mail. Questions and requests: info@agenta.digital.