Chatinbox Privacy Policy

Introduction

Welcome to Chatinbox. Chatinbox is a cloud-based CRM platform that lets you bring your customer relationship and communication processes, including social messaging apps, together under one roof. This Privacy Policy explains how your personal data and other information is collected, used, transferred, stored and protected while you use the services offered by Chatinbox.

Chatinbox treats the protection of the confidentiality and integrity of personal data as a fundamental principle, and undertakes to comply with all applicable data protection rules, in particular the European Union General Data Protection Regulation (GDPR), the legislation on the protection of personal data in force in Türkiye and other relevant legislation.

By accessing or using the platform, you declare that you have read and understood this Privacy Policy and that you accept the principles set out in it. If you do not accept any part of this Policy, please do not use the Chatinbox services.

Scope and definitions

1. Scope

1.1. This Privacy Policy applies to:

• the Chatinbox website and web application,
• Chatinbox mobile applications,
• the Chatinbox API and its integrations,
• all personal data processed through the support and communication channels offered by Chatinbox.

1.2. When we process end-user data on behalf of our corporate customers, we act in most cases as a data processor. For data such as our own user accounts, billing and security logs, however, we may hold the capacity of data controller. This distinction is defined separately on the basis of contracts and processes.

2. Definitions

2.1. Within this Policy:

• Chatinbox / the Company: Chatinbox Yazılım Arge ve Teknoloji Limited Şirketi. Registered address: İstanbul, Türkiye.
• Services: covers all products and services offered by Chatinbox; web, mobile and API-based solutions.
• Personal Data: any information relating to an identified or identifiable natural person.
• Data Subject: the natural person whose personal data is processed; may be a Chatinbox user, customer, prospective customer, supplier or visitor.
• Data Controller / Data Processor: the natural or legal person who, under applicable legislation, determines the purposes and means of processing personal data, or processes them on behalf of the data controller.

Information we collect and how we use it

3. Types of information

3.1 Information users provide directly

The information you send us directly while using our services may include:

• account and profile information (such as first name, surname, work email, phone number, company title and role),
• user content you create and send through Chatinbox (messages, conversation records, attachments, files, images, videos, voice recordings),
• invoice information used in subscription and billing processes and references relating to payment instrument details,
• your support requests, feedback, complaints, survey answers and other written or verbal correspondence with Chatinbox.

3.2 Information collected automatically

When you use Chatinbox, our systems may automatically process various technical data:

• device and browser information (such as browser type, operating system, device type, language preference),
• IP address and approximate location based on the IP address,
• sign-in and sign-out times, session duration, pages and features accessed,
• technical data on system performance, errors and log records,
• usage statistics obtained through cookies and similar technologies.

In most cases this information does not directly reveal your identity; however, when combined with other information it may become personal data.

3.3 Information obtained from third parties

If you use our services integrated with certain third party services, we may receive specific information from those providers. For example:

• conversation content and metadata through integrations with WhatsApp, Instagram, Facebook or other messaging platforms,
• usage patterns and performance information through analytics tools such as Google Analytics 4 and Microsoft Clarity,
• limited information arising from your social media interactions relating to Chatinbox.

We would remind you that in such integrations the privacy policies of the relevant third parties also apply.

4. Purpose of use

4.1. The personal data collected may be used for the following purposes:

• to provide, operate, maintain and improve the Chatinbox services,
• to carry out account creation, identity verification and secure sign-in,
• to let you run message and customer relationship processes and to make communication within the team easier,
• to manage subscription and payment processes and to meet billing and accounting obligations,
• to improve the system by analysing usage statistics, error and performance data,
• to detect and prevent security threats, fraud and unauthorised access attempts,
• to send important changes to the services, security warnings and mandatory notifications,
• where you have given explicit consent, to send campaigns, announcements, newsletters and promotional content,
• to comply with legal obligations and to respond to requests from official institutions and organisations,
• to resolve disputes, protect and defend our rights in line with our legitimate interests.

In every case the processing of personal data is based on legal grounds compliant with the data protection legislation in force.

Sharing and international transfers

5. Sharing of information

5.1. Chatinbox does not share users' personal data with third parties arbitrarily; sharing takes place only in the following situations and to the extent necessary:

• service providers we receive support from in delivering the service, such as hosting, cloud storage, security, customer support, communication and payment institutions,
• authorised institutions and organisations under legal obligations; court decisions, requests from administrative authorities, or for the establishment, exercise and protection of legal rights,
• commercial transactions involving the transfer of all or part of Chatinbox, mergers, demergers, restructuring or asset sales,
• data transfers to third party systems through integrations, based on your explicit consent or carried out on your instruction.

Other than in these cases, your personal data is not shared with third parties for marketing or similar purposes.

6. International data transfers

6.1. Given the nature of its services, Chatinbox may process and store your data on servers located inside or outside Türkiye. Where personal data is transferred to infrastructure in different countries, contractual, technical and administrative security measures compliant with applicable data protection rules are taken.

For example, for users covered by the GDPR, standard contractual clauses and additional safeguards are applied to transfers to recipients outside the European Union. For users in Türkiye, the provisions of the Personal Data Protection Law on transfers abroad are followed.

Cookies, retention and security

7. Cookies and similar technologies

7.1. Chatinbox may use cookies and similar technologies on its website and applications. These technologies are used for purposes such as:

• allowing the site and the platform to perform their core functions,
• remembering your session information,
• storing your preferences,
• measuring and improving performance,
• producing analytical and statistical reporting to the extent necessary,
• subject to your explicit consent, measuring advertising performance and ad attribution (including click identifiers of platforms such as Google and Meta, e.g. gclid/fbclid).

7.2. You can block cookies partly or completely through your browser settings; in that case some Chatinbox functions may not work properly. Chatinbox is not responsible for problems arising from this.

7.3. Analytics and marketing/advertising cookies are only enabled with your explicit consent (cookie consent); if you do not give consent, these cookies are not set. Click identifier information stored for ad attribution (gclid/fbclid) is likewise kept only when you give consent.

7.4. If you do not give cookie consent, the analytics tools we use do not write cookies to your browser; however, without using cookies, they may continue to collect limited usage statistics under a temporary identifier specific to that single page view. This may cover the page you visit, an approximate location derived from your IP address, browser and device information, and in-page activity such as scrolling, mouse movement and clicks. Because no cookie is used, this information is not combined across your visits and is not used to identify you directly. The tools we use for this purpose are Google Analytics 4, Meta Pixel and Microsoft Clarity, which presents page usage as heatmaps and session recordings. Where these providers are located abroad, article 6 applies.

8. Data retention and deletion periods

8.1. Your personal data is kept only for as long as the processing purposes require and limited to the minimum periods stipulated by the legislation in force. When those periods expire or the processing purpose ceases to exist, the data is deleted, destroyed or anonymised by appropriate methods.

8.2. In determining retention periods, mandatory periods in the relevant legislation, limitation periods, audit and evidence obligations and the balance of legitimate interests are taken into account.

9. Data security

9.1. Chatinbox applies administrative and technical measures generally accepted in the industry in order to keep personal data secure. Within this scope:

• encryption protocols such as TLS/SSL are used during data transmission,
• stored data is encrypted with strong algorithms where appropriate,
• multi-factor authentication and role-based access controls are applied,
• access logs and security events are monitored,
• regular tests and audits are carried out against security vulnerabilities,
• staff are made aware of confidentiality and information security matters.

9.2. Aware that no system can provide absolute security, a continuous improvement approach is adopted in order to reduce possible risks to a minimum.

Other provisions

10. Children's privacy

10.1. By its business model Chatinbox is intended for professional and corporate use; it does not offer a service aimed at children. It does not knowingly collect data from persons under the age of 13. If such a case is identified, the relevant records are deleted or anonymised within a reasonable time.

11. Third party sites and organisations

11.1. Links to third party websites or services may be provided through Chatinbox, and Chatinbox may also be used integrated with third party messaging and social media platforms. The privacy policies, terms of use and data security practices of these third parties are entirely independent of Chatinbox.

We therefore recommend that you review the policies and statements of those providers separately. Chatinbox is not responsible for the data processing activities third party service providers carry out in their own domains.

12. Updates to the policy

12.1. This Privacy Policy may be revised from time to time due to technological and legal developments, changes in our business processes or updates within the scope of the service. When significant changes are made, users will be informed by a reasonable method (in-platform notification, email or announcement on the website). Continuing to use the services after the changes means that you accept the new provisions of the Policy.

13. Limitation of liability

13.1. General principle: Chatinbox takes the utmost care to apply all technical and administrative measures reasonably necessary to protect personal data and ensure confidentiality. Nevertheless, given the nature of the internet and digital systems, the Data Subject accepts in advance that no system can provide absolute security.

Without prejudice to mandatory rules of law in force, Chatinbox may only be held liable for damages arising from attacks, leaks, interruptions and similar events that are reasonably unforeseeable and unpreventable where its own intent or gross negligence is present.

13.2. The customer's data responsibility and obligations: In most cases Chatinbox acts as a data processor in respect of its corporate customers' end-user data. In this context, customers holding the capacity of data controller over that personal data are themselves responsible for fulfilling their disclosure obligations under Turkish data protection law, the GDPR and other relevant legislation, for obtaining the necessary explicit consents, for not processing data unlawfully, and for the lawfulness of the data transferred to integration channels.

13.3. Third party services and integrations: Chatinbox may offer integration with third party platforms such as WhatsApp, Instagram and Facebook. The privacy policies, terms of use and data security practices of these platforms are entirely independent of Chatinbox. Chatinbox cannot be held liable for data breaches, interruptions or security weaknesses arising from the systems or infrastructure of third party service providers, or for damages that may arise from the use of those services.

13.4. Indirect damages and loss of profit: Without prejudice to mandatory provisions in force, Chatinbox shall not be liable for any loss of profit, loss of data, business interruption, loss of reputation, or any indirect, special, incidental or consequential damage that may arise in connection with the processing of personal data or the performance of obligations under this Policy.

13.5. Cap on liability: Chatinbox's total liability is limited to the total subscription/service fee paid to Chatinbox by the relevant user or customer in the twelve (12) month period before the date the relevant claim arose. This cap does not apply to cases arising from Chatinbox's intent or gross negligence, or to situations where limiting liability is not legally possible.

13.6. Force majeure and events beyond control: Chatinbox assumes no liability where it is unable to fulfil its obligations, or is delayed in doing so, because of events that may be considered force majeure and that develop beyond its reasonable control; such as natural disaster, war, acts of terror, civil unrest, strike, lockout, general electricity or communication infrastructure outages, acts and transactions of public authorities, or large-scale cyber attacks.

13.7. Mandatory provisions reserved: No provision in this section may be interpreted as setting aside mandatory rules that apply where, under the law in force, Chatinbox's liability cannot be wholly excluded or limited in advance.

14. Contact

For any questions, requests and feedback regarding this Privacy Policy or the processing of your personal data, you can reach us through the following channels:

• Email: hello@chatinbox.net
• Address: İstanbul, Türkiye
• Phone: +90 216 372 9400

15. AI Connector (Claude, ChatGPT)

15.1. Scope: This section applies to the Chatinbox AI connector. The connector is operated by Chatinbox Yazılım Arge ve Teknoloji Limited Şirketi ("Chatinbox"). It is a remote MCP server at https://mcp.chatinbox.net/mcp. A firm administrator can add it to Anthropic's Claude app. If the connector is added to OpenAI's ChatGPT app, or to another AI app through Smithery's connection service, this section applies as well; which of these routes are open is stated on the setup page. In this section, "the app" is the AI app in which the administrator set up the connection. The connector lets the administrator ask the app for the firm's WhatsApp conversation and message counts. The connector only reads; it cannot send messages or create, change or delete records. Setup and usage steps are at chatinbox.net/en/claude-connector.

15.2. Data collected: Only a firm administrator can set up the connection. The administrator types the firm code, username and password used for the Chatinbox panel into the Chatinbox sign-in page. These are checked by Chatinbox's own authentication, the same sign-in the Chatinbox panel uses, only to verify the person's identity and administrator role. The password is not stored and is not written to logs. The session keys received during the check are not stored either; they are discarded as soon as the check ends. For the connector, the following data is kept:

• Connection record: firm number, the administrator's user number, the identifier of the client that set up the connection (the app, or Smithery if the connection was set up through Smithery), and the times the connection was created, expires, was last used and was revoked,
• Key hashes: one-way SHA-256 hashes of authorization codes and of access and refresh tokens; the codes and tokens themselves are not stored,
• Event log: event type (sign-in, consent, code exchange, refresh, revocation, tool call), outcome, error code, duration, firm and user number, and time.

These records contain no patient, customer or staff names, phone numbers, e-mail addresses, postal addresses or message text. The numbers given to the app are calculated at request time from the message records Chatinbox already processes for the firm; the results are not stored separately by Chatinbox.

15.3. Usage and storage: This data is used only to verify the administrator's identity and role, to produce the numbers the app requests, and to keep the connection secure (detecting unauthorised use, fixing errors, providing support). It is not used for any other purpose. The data is stored in Chatinbox's database; traffic to and from the connector is encrypted with TLS. An access token is valid for 60 minutes and a connection for 7 days; an expired token cannot be used.

15.4. Third-party sharing: When the administrator asks the app a question, the app requests statistics through the connector. Chatinbox sends only the answer to that request, and only to the provider of the app where the connection was set up: Anthropic for Claude, OpenAI for ChatGPT. If the connection was set up through Smithery, the answer passes through Smithery's connection server on its way to the app the administrator uses and to that app's provider. The answer consists of numbers, dates, the firm's time zone and the fixed definitions of the numbers. Patient, customer or staff names, phone numbers, e-mail addresses, postal addresses, message text and passwords are not sent. The numbers sent may be processed on servers outside Türkiye. What happens inside the app (questions, answers, chat history) is governed by that provider's own terms: Anthropic's terms and privacy policy, OpenAI's terms of use and privacy policy, Smithery's privacy policy. Connector data is not shared with any other third party, without prejudice to the legal obligations listed in section 5.

15.5. Data retention: The connection record, key hashes and event log are kept for at most 2 years, in line with the log-record rule in section 6 of the KVKK notice. When this period ends, the records are deleted, destroyed or anonymised.

The administrator can disconnect at any time in the app where the connection was set up. In Claude: under Customize > Connectors, find Chatinbox and click Remove; in ChatGPT and other apps, remove the connection in the app's connection settings. To have the connector turned off for the whole firm, or to request deletion of these records, write to the address below.

15.6. Contact: For questions and requests about the connector, write to hello@chatinbox.net or call +90 216 372 9400. How to apply under Turkish data protection law is set out in section 8 of the KVKK notice.