Privacy Policy

The data controller for personal data processed within CyprusAI products and services (offered under the CyprusAI brand, including CyprusAI Pharos) is TCY Teknoloji Çözümleri Yatırım Anonim Şirketi (Sumer Mah. 2482/2 Sk. Skycity B Blok Is Merkezi No: 4/1 Ic Kapi No: 58, Merkezefendi, 20030 Denizli / Turkiye; MERSIS: 0833 1250 6990 0001; Trade Registry No: 54197; Tax Office/No: Gokpinar VD 8331250699). CyprusAI provides artificial intelligence products and services for businesses.

For any questions, requests, or applications regarding your personal data, you may contact us at ai@cyprusai.ai or +90 548 845 11 11.

Through our customer request form, we collect the following data: business name, sector of activity, contact details (full name, email, phone), social media and website links, and free-text where you describe your needs.

In addition, when you use the service, certain technical data may be collected automatically: IP address, browser type, device information, and your on-site interactions (via cookies, as described in our separate Cookie Policy).

We aim to collect only the data necessary to provide our service and do not request more data than needed.

We primarily use the data we collect to prepare a tailored roadmap, market research, and AI-assisted solution proposals for you.

We also process data to provide and improve the service, respond to your requests, fulfill our contractual obligations, ensure security, and comply with our legal obligations.

We do not sell your personal data to third parties for marketing purposes without your explicit consent.

We process your personal data within the framework of the GDPR (EU Regulation 2016/679) and the Turkish Data Protection Law (KVKK, Law No. 6698).

The legal bases for our processing are: the conclusion or performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c), our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f), our legal obligations (GDPR Art. 6(1)(c); KVKK Art. 5/2-d), and, where required, your explicit consent (GDPR Art. 6(1)(a); KVKK Art. 5/1).

For processing based on consent, you may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

To provide our service, we work with trusted third-party service providers. The main providers that process your data are: DigitalOcean, LLC (server hosting; data center in Frankfurt, Germany), Cloudflare, Inc. (network security and content delivery) and Anthropic, PBC (AI text model). Anthropic drafts message replies and suggestions. When a business generates an image from its panel (menu or product images), the image is produced by an OpenAI, L.L.C. model; Pollinations.AI is used as the fallback when no OpenAI key is configured; only the image description is sent to these services, never customer data. These providers process data only on our behalf and on our instructions.

We try to keep data shared with AI providers to a minimum, transmitting only what is necessary to generate your tailored output.

Where data is transferred outside the European Economic Area, we commit to providing appropriate legal safeguards, such as standard contractual clauses. We share your data only when we have a lawful basis to do so.

If a public authority requests personal data, we first review whether the request is lawful. We respond only when we have a legal obligation, and we disclose only the minimum information necessary. We keep a record of each request, our response and the legal reasoning.

When a business connects its own WhatsApp Business number (and, once available, a Facebook Page or Instagram account) to its CyprusAI Pharos panel, we receive the following from Meta platforms: customer messages sent to that business, the sender’s name and phone number, and message delivery status.

We use this data only to show the conversation in that business’s panel and to help the business reply. The AI assistant prepares replies from the business’s own information (menu, prices, opening hours, appointments); this runs through an AI provider under commercial terms (Anthropic). The business owner sees every conversation and can take over at any time.

Each business’s data is kept separate and is visible only to that business. We do not sell this data, do not share it with other businesses and do not use it for advertising. A business can disconnect at any time; for deletion requests, see our Data Deletion page.

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law.

When an active customer relationship ends, we will delete or anonymize your data within a reasonable period, subject to any legal retention obligations.

Under the GDPR and KVKK, you have certain rights as a data subject: access to your data, rectification, erasure (right to be forgotten), restriction of processing, objection to processing, and data portability.

You also have the right to withdraw consent where processing is based on consent, and to object to a decision that produces an adverse effect on you based solely on automated processing.

To exercise your rights, you may contact ai@cyprusai.ai. We will review and respond to your request within the legal timeframes. You also have the right to lodge a complaint with the competent data protection authority (the relevant supervisory authority in Cyprus/EU, or the Personal Data Protection Authority in Turkey).

We use essential/functional cookies and analytics cookies on our website. Essential cookies are necessary for the site to work; analytics cookies help us improve the service.

For details on our use of cookies, please review our separate Cookie Policy. You can manage your cookie preferences through your browser settings.

We implement appropriate technical and organizational measures (including access controls, encryption, and regular security reviews) to protect your personal data against unauthorized access, loss, or misuse.

While no method of transmission or storage is one hundred percent secure, we are committed to maintaining industry-standard protection and to complying with our legal notification obligations in the event of a data breach.

For any questions about this Privacy Policy, our privacy practices, or your rights, you can contact us at ai@cyprusai.ai.