1. Data controller and our roles
The Konzila service is provided by Konzila ("Konzila" or "we" in this policy). Our contact details are at the end of this page.
- As a data controller: for the account, contact, usage and security data of website visitors, people who create a Konzila account and our customer companies.
- As a data processor: for the content customer companies upload to Konzila (documents, chats, meetings, reports) and for the messages received by the social media accounts they connect. The customer company is the controller of that data; we process it only on its instructions and to provide the service.
2. What data we process
- Account data: full name, email address, job title, role, interface language, last sign-in time. Your password is never stored in plain text; we only keep an irreversible hash (scrypt).
- Company data: company name, website, company description, the contact person's name, email and phone you share with our account team, membership plan and credit records.
- Customer content: documents you upload, websites you add, chats with AI agents, meeting minutes, decisions, tasks and reports; publicly available business contact details of companies found by the agents' web research.
- Connected social media accounts (optional): if you connect an Instagram, WhatsApp Business or TikTok account: the account ID, username and display name; the access tokens issued by the platform; comments and messages received by your account (the sender's username or profile name, on WhatsApp their phone number, the message text) and the caption and link of the post that was commented on.
- Usage and security records: AI usage records (for credit accounting), a log of important tasks in the account (who did what and when), the IP address of failed sign-in and sign-up attempts, server access logs (IP address, requested URL, time).
We do not collect special categories of personal data (health, religion, biometric data, etc.); please do not upload such data to Konzila.
3. Why we process data and on what legal basis
- Providing the service: running the AI employees, producing meetings, reports and tasks, searching the company memory. Legal basis: entering into and performing the contract (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)).
- Social media replies: drafting and sending replies to comments and messages received by the accounts you connect, according to the rules you set. Legal basis: performance of the contract.
- Account security: session management, preventing abuse and unauthorised access. Legal basis: legitimate interest (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)).
- Plan, credit and billing management, support requests. Legal basis: performance of the contract and legal obligation.
- Legal obligations: requests from competent authorities and statutory retention duties. Legal basis: legal obligation (KVKK Art. 5/2-ç, GDPR Art. 6(1)(c)).
We do not sell your personal data, use it for advertising, or make automated decisions about you through profiling. Decisions and tasks proposed by the agents only take effect with the approval of an authorised person.
4. Who we share data with
To provide the service, we share data with the following service providers, only as far as necessary:
- AI service providers: when an agent runs, the content of the request (relevant document excerpts, chat and message text) is sent to large language model providers to generate a response.
- Web search and web page reading: the agents' search queries are sent to search services; websites you add are read by our servers.
- Social media platforms: Meta (Instagram, WhatsApp) and TikTok, to receive messages and send replies, only on behalf of the accounts you connect.
- Infrastructure: hosting and network security services (e.g. Cloudflare); your traffic passes through them when you access the site.
- Fonts and code libraries: our pages load fonts from Google Fonts and some libraries from jsDelivr; your browser passes your IP address to these services when doing so.
- Authorities: only where there is a legal obligation.
You can request the current list of our service providers at [email protected].
5. International transfers
Some of our AI, search and infrastructure providers have servers outside Türkiye and the European Economic Area (e.g. in the United States). Your data may therefore be transferred to these countries to provide the service. Such transfers rely on the mechanisms provided for in Article 9 of the KVKK and Chapter V of the GDPR (e.g. standard contractual clauses).
6. Retention periods
- Account and company content: for as long as your account is open. When a company account is deleted, its content (documents, chats, meetings, reports, social media messages, memory) is removed from the service immediately and permanently deleted within 30 days at the latest.
- Social media connection: when you disconnect an account, its access tokens and message history are deleted immediately.
- Failed sign-in and sign-up attempts (IP address): 24 hours.
- Server access logs: kept on a size-limited rotating basis and overwritten within a short time.
- Task logs and billing records: for as long as required by security and legal obligations.
- Backups: copies in backups are deleted as they are overwritten in the backup cycle.
7. Security
The website and the application only run over encrypted connections (HTTPS). Passwords are hashed irreversibly and session cookies are not accessible to JavaScript (HttpOnly). Each customer company's data is kept in a separate database and cannot be seen by another company. Access to the servers is limited to authorised staff.
8. Your rights
Under Article 11 of the KVKK and the GDPR you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether data is used accordingly, and know the third parties it is transferred to,
- request correction of incomplete or inaccurate data, request erasure or destruction where the conditions are met, and ask that these tasks be notified to third parties the data was transferred to,
- request restriction of processing, receive your data in a portable format and object to processing based on legitimate interest (GDPR),
- object to an outcome against you resulting exclusively from analysis by automated systems,
- claim compensation for damage caused by unlawful processing.
You can send your requests to [email protected]; we reply within 30 days at the latest. To verify your identity we may ask you to write from the email address registered to your account. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority or, if you are in the EU, with your country's data protection authority. The steps for deleting your data are on the Data Deletion page.
9. Cookies and browser storage
We only use cookies that are strictly necessary for the service to work; we do not use advertising, analytics or tracking cookies.
- konzila_oturum: a company user's session (30 days).
- konzila_yonetim: a platform administrator's session (30 days).
- konzila_lang: the interface language you chose (1 year).
- Browser storage (not a cookie, stays on your device): theme, menu and panel preferences.
10. Children
Konzila is a service for businesses; it is not directed at people under 18 and we do not knowingly collect data from children.
11. Changes
We may update this policy. The current version is always on this page and the date at the top changes. We notify account administrators separately of significant changes.
Contact
- Service provider (seller and data controller)
- Konzila
- [email protected]