Data Protection Notice

TCY Teknoloji Çözümleri Yatırım Anonim Şirketi ("CyprusAI"), whose details appear above, processes your personal data as the data controller.

For customer data a business enters in its CyprusAI Pharos panel, that business is the data controller. CyprusAI is then the data processor and acts on the business's instructions.

Identity and contact: first name, last name, email, phone.

Business information: business name, sector, website and social media links, what you write in the request form.

Account and activity: username, permissions, a record of actions in the panel.

Technical data: IP address, browser and device information, usage information collected by cookies.

Message data: if you connect your business's WhatsApp, Instagram or Facebook account to the panel, the messages the business receives and the sender's name and phone number.

To answer your request and prepare a demo and roadmap.

To set up membership, provide the service and give support.

To handle billing and payments.

To keep information secure and prevent misuse.

To improve the service and fix errors. We do this only with data for which we are the controller. Businesses' customer data is not used for this purpose.

To meet our legal obligations.

To send commercial electronic messages, if you gave consent.

We process your data under KVKK Art. 5/2-c (contract), Art. 5/2-ç (legal obligation), Art. 5/2-f (legitimate interest) and, where needed, Art. 5/1 (explicit consent).

To provide the service we work with DigitalOcean, LLC (hosting, data centre in Frankfurt), Cloudflare, Inc. (network security and content delivery) and Anthropic, PBC (AI text model; drafts message replies and suggestions). These providers process data only on our behalf.

When a business generates images from the panel, we use an OpenAI, L.L.C. model. If OpenAI is unavailable, Pollinations.AI is the fallback. Only the image description goes to these services, never customer data.

When a business connects a WhatsApp, Instagram or Facebook account, messages flow through Meta Platforms.

Where the law requires it, we answer public authorities with the minimum information needed.

Some of the providers above operate outside Turkey. We transfer data using safeguards that meet KVKK Art. 9, such as standard contractual clauses. We keep the transferred data to the minimum the service needs.

We collect data electronically through the request form, membership registration, use of the panel, email and phone correspondence, connected messaging accounts and cookies.

We keep your data as long as the purpose requires and for legal retention periods. After that we delete, destroy or anonymise it.

Under KVKK Art. 11 you can: learn whether your data is processed, request information, learn whether it is used for its purpose, know the recipients, ask for correction of incomplete or wrong data, ask for deletion or destruction, ask that these steps be notified to recipients, object to a result against you from automated analysis, and claim compensation for damage.

To use your rights, write to ai@cyprusai.ai or send a written application to the address above. We answer within thirty days at most. If we cannot answer or you find the answer insufficient, you can complain to the Personal Data Protection Board. If you live in Cyprus or the European Union, you can also contact your local supervisory authority.