These texts are drafts under legal review. · Version 1.2
Guestkite Privacy Policy (DRAFT)
Last updated: 7 October 2026 (draft). The Turkish version prevails in case of conflict.
This policy explains how personal data of the staff of businesses using Guestkite, panel users and visitors to our website is processed. It is prepared under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Disclosure Obligation.
1. Data controller
TAG Yazılım ve Bilgi Teknolojileri Sanayi Ticaret Limited Şirketi ("Guestkite") Address: Kundu Mah. 33006 Sok. No:8/N Aksu / Antalya, Türkiye · MERSİS: 0815117464000001 Email: kvkk@guestkite.com
2. What this policy covers
Guestkite processes data in two roles:
- As controller (this policy): account data of businesses, people who log in to the panel, staff in the businesses' Telegram team groups, invoices and support messages, website visits.
- As processor (not covered here): conversations, requests, orders and stay details between a business and its guests, patients or customers. The business is the controller of that data. Guests can see the business's privacy notice with the "🔒 Privacy" button or
/privacyin the chat, and exercise their rights primarily against the business. Guestkite processes that data only on the business's instructions under the Data Processing Agreement.
3. Data, purposes and legal bases
| Data | Purpose | Legal basis (KVKK art. 5/2) |
|---|---|---|
| The business's notice email (confirmed) | Sending contract, security and service notices | (c) performance of a contract, (ç) legal obligation (e.g. breach notices) |
| Telegram user ID, name and username (at login and in team groups) | Logging in, knowing who is authorised for which business, sending team replies to the right person | (c) entering into and performing a contract |
| Business name, sector, settings, plan, usage counts | Providing the service, applying plan limits | (c) performance of a contract |
| Billing data (company name, tax number, address) | Invoicing, accounting records | (ç) legal obligation |
| Session cookie, login attempts, IP address (for rate limiting) | Account security, preventing abuse | (f) legitimate interest |
| Messages staff send to customers and approval records (safety log) | Applying the business's safety settings (content check, approved members) | (c) performance of a contract, (f) legitimate interest |
| Support messages | Answering questions, fixing errors | (c), (f) |
| Records needed to establish or defend a right | Disputes | (e) establishing, exercising or protecting a right |
We do not make the service conditional on consent. We do not send marketing emails; if we start, we will ask for permission separately.
4. How we collect data
Electronically and automatically: when you log in through our Telegram bot (or the business's own bot), use the panel, or write to us.
5. Recipients
| Recipient | Why | Country |
|---|---|---|
| Cloudflare, Inc. | Hosting, storage, security, translation and AI processing | United States, European Union and other countries |
| Telegram | Delivering login codes and notifications | Outside Türkiye |
| SMTP2GO | Sending email verification codes and service notices (only the email address and the notice text) | Outside Türkiye |
| Our accountants | Invoices and statutory records | Türkiye |
| Competent public authorities | If required by law | Türkiye |
Full current list: Sub-processors.
Transfers abroad: Guestkite runs on Cloudflare, so your data is stored and processed outside Türkiye. Under KVKK Article 9 we are working to sign the Turkish standard contract with Cloudflare. Status on 7 October 2026: not yet signed; we have applied to Cloudflare. We will update this policy when the status changes.
6. Retention
| Data | Period |
|---|---|
| Account and settings | While the account is open; deleted 30 days after the owner closes it |
| Panel session | 30 days (ends immediately on logout) |
| Invoices and accounting records | 10 years (Tax Procedure Law, Commercial Code) |
| Record of accepting the terms (who, version, when, business name) | 10 years, even after the account is deleted (evidence of the contract; KVKK art. 5/2-e) |
| Safety log | 90 days |
| Server logs | Up to 7 days |
| Backups | Deleted data may remain in automatic backups for up to 30 more days |
7. Cookies and browser storage
The panel uses one strictly necessary session cookie (keeps you logged in, valid 30 days, not readable by other sites). Preferences such as language and the last selected business are stored in your browser. We use no advertising or analytics cookies, so we show no consent banner.
8. Artificial intelligence
Translation, voice-to-text and the AI assistant run on open-weight models on Cloudflare Workers AI. We do not use your data, or the businesses' customer data, to train AI models.
9. Your rights (KVKK art. 11)
You may learn whether your data is processed and request information; learn the purpose and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; request correction of incomplete or wrong data; request deletion or destruction under KVKK Article 7 and that these actions be notified to recipients; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
How to apply: fill in the Data Subject Request Form and send it from your registered email to kvkk@guestkite.com, by registered electronic mail (KEP), or in writing to our address. We answer free of charge within 30 days.
If you are a guest or customer of a business and your request concerns your conversations with that business, apply to that business. You can also delete your data yourself with the "🔒 Privacy" button in the chat. We forward such requests that reach us to the business within 5 business days.
10. Changes
When we change this policy we update the date above and announce important changes in the panel and by email.