Privacy Policy

1. Introduction

This Privacy Policy describes how Ses Kimya Temizlik Ürünleri Gıda Sanayi Ve Ticaret Anonim Şirketi ("we", "us", "our", or "OGR System") collects, uses, stores, and protects information when you use OGR System and its products, including OGR Messaging at messaging.ogrsystem.com OGR Mail at mail.ogrsystem.com, OGR E-commerce at ecommerce.ogrsystem.com, OGR Muhasebe at muhasebe.ogrsystem.com, OGR Apartman at apartman.ogrsystem.com, OGR Spor at spor.ogrsystem.com, and OGR Games at games.ogrsystem.com (collectively, the "Services").

We are based in Türkiye and operate under Turkish law (Law No. 6698 on the Protection of Personal Data — KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR). By using our Services, you agree to the practices described in this Policy.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

3.1 Account Information

When you register for an account on any of the Services, we collect:

• Full name and business name
• Email address and phone number
• Hashed password
• Subscription and billing information (processed by third-party payment providers)

3.2 Messaging Channel Data

When you connect a messaging channel (WhatsApp Business, Instagram, Facebook Messenger, Telegram), we collect and process:

• Channel access tokens and account identifiers (e.g., WhatsApp phone number ID, Instagram business account ID, Facebook page ID, Telegram bot token)
• Inbound and outbound message content, timestamps, and message identifiers
• Customer profile metadata returned by the channel APIs (e.g., display name, profile picture URL)
• Media files (images, video, audio, documents) attached to messages

3.3 Email Account Data (OGR Mail)

When you connect an email account via IMAP/SMTP to OGR Mail, we collect and process:

• Email server credentials (IMAP/SMTP host, port, encryption type, username, encrypted password)
• Inbound and outbound email content, headers, attachments, and timestamps
• AI-generated email summaries, response drafts, and translation results stored in association with the source email
• Sub-user assignments indicating which mailboxes a sub-account is permitted to access

3.4 E-commerce Store Data (OGR E-commerce)

When you operate a store on OGR E-commerce, or shop at a store hosted on it, we collect and process:

• Shopper account details, delivery and billing addresses, and order history
• Order, shipment, return, and invoice records, including marketplace order data imported from Trendyol and Hepsiburada
• Payment transaction references and bank transfer records (card data is processed by the payment provider and is never stored on our servers)
• Marketing consent records and SMS/email delivery logs

3.5 Accounting Data (OGR Muhasebe)

When your company uses OGR Muhasebe, we collect and process:

• Company details (name, tax number, address, logo) and team member accounts with their assigned roles
• Contact (customer and supplier) records, including names, phone numbers, tax numbers, and running balances
• Debit and credit entries, expense records, payment methods, dates, and descriptions you enter

3.6 Building Expense Data (OGR Apartman)

When your building uses OGR Apartman, we collect and process:

• Building and unit details, the manager's IBAN, and resident accounts
• Bills and invoices uploaded by the manager, the per-unit shares calculated from them, and payment status per unit
• Payment receipts uploaded by residents, approval decisions, and piggy-bank movements
• Push notification subscriptions and in-app notification history

3.7 Odds Analysis Data (OGR Spor)

When you use OGR Spor, we collect and process:

• Membership status, membership expiry date, and last sign-in time
• A history of the analyses you run (the odds, bookmaker, match, and filters you queried, and the number of past matches found), shown to you as your recent analyses and to administrators to monitor usage. Analysis history is deleted automatically after 90 days.

Football match results and odds shown in OGR Spor come from the public football-data.co.uk dataset and do not contain personal data.

3.8 Game Data (OGR Games)

OGR Games does not require an account and does not collect personal data. Game progress, settings, and your language and theme preference are stored only in your own browser (local storage) and are not sent to us. You can delete them at any time by clearing your browser's site data.

3.9 Technical and Usage Data

• IP address, browser type, operating system, and device identifiers
• Session and authentication tokens
• Application logs and error reports
• Feature usage analytics (aggregate, non-identifying)

4. How We Use Your Information

• Service delivery: Routing messages between you and your customers, executing automation flows, generating AI-assisted replies.
• Account management: Authentication, billing, customer support, and platform notifications.
• Security: Detecting and preventing fraud, abuse, and unauthorized access.
• Legal compliance: Meeting our obligations under KVKK, GDPR, and applicable platform terms (Meta, Telegram).
• Improvement: Understanding aggregate usage patterns to improve product reliability and features.

We do not sell, rent, or share your personal data, message content, or end-customer data with advertisers or third-party data brokers.

5. AI Processing

Our products integrate with third-party large language model providers to power AI features:

• OGR Messaging — uses OpenAI, Anthropic, and Google Gemini for intent classification and AI-assisted reply generation.
• OGR Mail — uses OpenAI for email summaries, reply drafts, and automatic translation between Turkish and the original message language.
• OGR Apartman — uses Anthropic Claude to read uploaded bills and payment receipts and extract amounts, due dates, and IBAN matches for the manager to review.
• OGR E-commerce, OGR Muhasebe, OGR Spor, and OGR Games — do not send any data to large language model providers.

When you enable AI features, the relevant content (message text or email content) is transmitted to the configured provider for processing under their respective enterprise data policies, which prohibit using your data for training their models. You can disable AI processing at any time from your panel settings.

6. Data Sharing and Sub-processors

We share data only with vetted sub-processors strictly required to operate the Services:

• Meta Platforms, Inc. — for WhatsApp, Instagram, Facebook integrations
• Telegram FZ-LLC — for Telegram bot integrations
• OpenAI, Anthropic, Google — for AI processing (when enabled)
• Resend — for transactional email delivery
• Trendyol, Hepsiburada — for marketplace order, stock, and price synchronization (OGR E-commerce)
• Kuveyt Türk, Albaraka Türk — for card payments and bank transfer reconciliation (OGR E-commerce)
• Yurtiçi Kargo — for shipment creation and tracking (OGR E-commerce)
• Kolaybi — for e-Invoice issuance (OGR E-commerce)
• NetGSM — for transactional and consent-based marketing SMS (OGR E-commerce)
• Supabase, Vercel — for database, authentication, file storage, and hosting (OGR Apartman)
• Cloudflare — for CDN, DNS, and object storage of company logos (OGR Muhasebe), and for hosting OGR Games
• Cloud hosting providers — for infrastructure and storage

For OGR Mail, your email data also flows through the IMAP/SMTP servers of the third-party email providers you choose to connect (e.g., Gmail, Outlook, Yahoo, or your own corporate mail server). Those providers operate under their own privacy terms and are not our sub-processors.

All sub-processors operate under contractual data protection terms.

7. Data Retention

We retain your account data for as long as your account is active. Upon account deletion request, your data enters a 30-day grace period before permanent deletion, during which the request can be cancelled. Message content and conversation history are retained for the duration required by your active subscription plan and applicable platform retention rules (e.g., Meta's 24-hour customer service window guidance).

We retain certain records (financial, audit, security) for periods required by Turkish law.

8. Data Security

We protect your data with industry-standard security measures:

• TLS encryption for all data in transit
• Encrypted storage for credentials and access tokens
• Role-based access control and audit logging
• Regular security reviews and dependency updates
• Webhook signature verification for all inbound channel events

9. Your Rights

Under KVKK and GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with the Turkish Data Protection Authority (KVKK Kurumu) or your local supervisory authority

To exercise any of these rights, contact us at [email protected].

10. International Transfers

Some of our sub-processors may store or process data outside Türkiye and the European Economic Area. Where this occurs, we rely on Standard Contractual Clauses or equivalent legal mechanisms approved by the relevant authorities.

11. Children

Our Services are not directed to individuals under 18. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected such data, we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-product notification. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact

For privacy questions, requests, or complaints: