Privacy policy

Last updated: November 7, 2026

Hallet is an AI customer assistant service that Gemen Bilgi Teknolojileri ve Ticaret Limited Şirketi ("Gemen", "we"), a company in Türkiye, provides to businesses. This policy explains how we process the personal data of people who visit the hallet.io site, of businesses that register for the Hallet panel and use the Hallet mobile app, and of customers who write to businesses that use Hallet through a website, WhatsApp or Instagram.

This policy also contains our information notice under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) (the "Law"), which tells you how your personal data is processed as part of the Hallet service.

Who is responsible for which data

We are the data controller for the account data of businesses that use the Hallet panel and for the data of hallet.io visitors.

If you are a customer of a business and you write through the chat bubble on that business's website, its WhatsApp number or its Instagram account, that business is the data controller of your data. We process this data on the business's behalf and on its instructions, only to provide the service (as a data processor). In this case, the business's own privacy notice also applies. You can contact the business first to exercise your rights; if you write to us, we forward your request to the business. The business provides the information notice about this data.

What data we process

• Account data: full name, email address, an irreversible hash of your password, if you sign in with Google the name, email address and Google account ID that Google provides and the sign-in tokens Google issues, two-step verification data, your interface language, business name and country, team members and their roles.
• Content the business gives the assistant: business information and rules, scanned website pages, uploaded documents, tool and appointment settings.
• Connection data: access tokens for the store, shipping, WhatsApp and Instagram accounts the business connects, and API keys for custom tools. These tokens and keys are stored encrypted; they are deleted when the connection is disconnected (on some platforms, after the authorization on the other side is removed) or when the tool is deleted.
• Conversations: the messages customers write through the chat bubble, WhatsApp or Instagram, and their name, phone number or Instagram username; replies from the assistant and the business's team; order, shipping, return and appointment information that the customer shares or that the assistant reads from the business's store or custom tools; support tickets.
• Technical data: IP address, browser information, the panel session cookie, the visitor key that the chat bubble keeps in the browser to continue the conversation, the address of the site where the bubble was opened, and error logs. In the mobile app, also the phone's notification address (on Android, the Firebase registration token) and the app version; the session key is stored encrypted on the phone, and the notification address is deleted when the session ends. If the app crashes, a crash report: technical details of the crash, device model, operating system and app version, and the identifier Firebase creates for the installation.
• Credits and billing: credit purchase requests, the credits added, and the information you give us for invoicing (company name, tax number, address). For businesses that buy credits through Shopify, the record and status of the purchase; payment details do not reach us.

What we use data for

• Providing the service: the assistant replying to customers, performing the actions the business allows (such as looking up an order or booking an appointment), and showing conversations in the panel.
• Managing your account and sending you notifications and emails about the service.
• Keeping the service secure and preventing abuse and excessive requests.
• Responding to your support requests and running credits and billing.
• Meeting our legal obligations.

We do not use conversations or business content to train AI models. We do not sell your data. We do not share conversations or business content for advertising purposes; advertising measurement on the hallet.io home page runs only with your permission, as described below.

Personal data, purposes and legal bases under the KVKK

Business representatives and team members who use the Hallet panel

• Data: identity (full name), contact (email), customer transaction (credit and support requests, actions taken in the panel and the mobile app), transaction security (IP address, session and access logs, the phone's notification address in the mobile app), finance (the company name, tax number and address you give us for invoicing).
• Purposes: establishing and performing the membership and service agreement, providing the service, support and communication, credit and billing operations, ensuring information security, meeting legal obligations.
• Legal bases: the processing is directly related to the establishment or performance of a contract (Law Art. 5/2-c), fulfillment of a legal obligation (Art. 5/2-ç), the establishment, exercise or protection of a right (Art. 5/2-e), our legitimate interest, provided that it does not harm your fundamental rights and freedoms (Art. 5/2-f).

hallet.io visitors and people who write through Hallet's own chat bubble

• Data: transaction security (IP address, browser information), the messages you write and, if you share them, your contact details; if you give permission, home page usage data (Google Analytics cookies) and advertising measurement data (Google Ads and Meta Pixel cookies, ad clicks).
• Purposes: answering your questions, contacting you when you ask us to, keeping the site secure; with your permission, measuring how the site is used, measuring the results of our ads and showing you relevant ads.
• Legal bases: the processing is directly related to the establishment of a contract (Art. 5/2-c), our legitimate interest (Art. 5/2-f); your explicit consent for analytics and advertising cookies (Art. 5/1). You can withdraw your consent at any time in thecookies section of this policy.

How we collect data

Your personal data is collected electronically, partly by automated means, through registration and panel forms, the mobile app, the chat bubble, the WhatsApp and Instagram accounts a business connects, the store and shipping integrations a business connects and the custom tools it sets up, email correspondence and system logs.

Who we share data with

To provide the service, we share data only with the following service providers, and only as much as needed:

• Amazon Web Services: servers, database, file storage, and email sending through Amazon SES (Frankfurt, Germany).
• Anthropic: the AI model (Claude) that generates the replies of the assistant and of Chat with Hallet in the panel. The conversation and related business information are sent to generate replies (USA).
• Voyage AI: processing text so that the business's knowledge base can be searched (USA).
• Meta Platforms: receiving messages sent to the WhatsApp and Instagram accounts the business connects, and sending replies (outside Türkiye).
• Google (Firebase Cloud Messaging): to send notifications to the Hallet Android app, the notification's title and short text and the phone's notification address (outside Türkiye). Depending on the notification, this text can include the name and summary of the action awaiting approval (e.g., the order number), the subject of a request forwarded to the team, the time, service and staff member of an appointment, and the customer's name and the first 180 characters of their message.
• Apple (Apple Push Notification service): to send notifications to the Hallet iOS app, the same information and the phone's notification address (outside Türkiye).
• Google (Firebase Crashlytics): crash reports from the mobile apps (outside Türkiye).
• Google (Sign in with Google): only if you sign in with Google, to verify your identity (outside Türkiye).
• The store and shipping platforms the business connects and the custom tools it sets up (e.g., Shopify, WooCommerce, Basit Kargo, the business's own system): only for the actions the business allows; some of them are outside Türkiye. For businesses that buy credits through Shopify, the fee is collected through Shopify's billing (Shopify Billing).
• Google (Google Analytics): only if you allow analytics in the cookie banner, to measure how the hallet.io home page is used (pages viewed, device and browser information, approximate location; outside Türkiye).
• Google (Google Ads) and Meta Platforms (Meta Pixel): only if you allow advertising in the cookie banner, to measure visits from our ads and clicks through to the signup page, and to show you relevant ads (ad click, pages viewed, device and browser information, cookie identifiers; outside Türkiye).

Other than these, we share data only at the request of legally authorized institutions and organizations, and only to the extent the law requires.

Transfers outside Türkiye

Your data is stored on servers in the European Union (Germany). It is also transferred to service providers in the USA (Anthropic, Voyage AI) so that the assistant can generate replies and search the knowledge base, to Meta for WhatsApp and Instagram messaging, to Google (Firebase Cloud Messaging) and Apple to send notifications to the mobile apps, to Google (Firebase Crashlytics) for crash reports, and to those platforms the business connects and custom tools it sets up that are outside Türkiye. If you give permission, it is transferred to Google (Google Analytics) to measure home page usage, and to Google (Google Ads) and Meta (Meta Pixel) for advertising measurement. These transfers are made in accordance with Article 9 of Turkish Personal Data Protection Law No. 6698 (KVKK).

How long we keep data

We keep account data and business content for as long as the account is open. Conversations are kept from their last message, and appointment records from the appointment date, for the period the business chooses: 3 years by default, and the business can choose 1, 2, 3, 5 or 10 years in the panel. Expired conversations are automatically deleted together with their messages; the contact record (WhatsApp number, Instagram ID, name) of a customer with no other conversations and expired appointment and reminder records are also deleted automatically. A conversation with an open request is kept until the request is closed. When an account is closed or a deletion request is received, the data is deleted or anonymized on request, except records we are legally required to keep (e.g., invoice records).

Security

Data is encrypted in transit. Each business's data is kept separate from that of other businesses and is shown only to that business's authorized users. Connection tokens and keys are stored encrypted. Access to our systems is limited to authorized personnel.

Cookies and browser storage

• The Hallet panel uses a required session cookie to keep you signed in.
• The chat bubble stores a visitor key in your browser so that your conversation continues when you refresh the page.
• Analytics cookies (Google Analytics, those starting with _ga): used on the hallet.io home page only if you allow analytics in the cookie banner.
• Advertising cookies (Google Ads, e.g., _gcl_; Meta Pixel, e.g.,_fbp): used on the hallet.io home page only if you allow advertising in the cookie banner. Meta Pixel does not load at all without your permission.
• If you do not give permission, these cookies are not written; only a cookieless, identifier-free measurement signal goes to Google. Your choice is stored in your browser. The panel and the chat bubble have no analytics or advertising cookies. The mobile apps have no advertising libraries or advertising identifier; only crash reports (Firebase Crashlytics) are collected, to keep the apps stable.

Change my cookie preference

Your rights

Your rights, such as learning whether your personal data is processed and asking for it to be corrected or deleted, and how to apply are set out below.

Under Article 11 of the Law, by applying to the data controller you have the right to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of the processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom it has been transferred,
• request its correction if it has been processed incompletely or incorrectly,
• request its deletion or destruction under the conditions in Article 7 of the Law,
• request that the correction, deletion or destruction be notified to the third parties to whom the data has been transferred,
• object to a result against you that arises from the analysis of the processed data exclusively by automated systems,
• request compensation for damage you suffer because of unlawful processing.

How to apply

You can send your application in writing to our address at the top of this page, as a petition with a wet-ink signature, or, so that we can verify your identity, to info@hallet.io from the email address registered in our system or signed with a secure electronic signature or mobile signature. Your application must include:

• your first name and last name and, for a written application, your signature,
• your Turkish ID number or, if you are a foreign national, your nationality and your passport or ID number,
• your residential or workplace address for legal notices,
• your email address and phone number for notifications, if you have them,
• the subject of your request and, if any, the related information and documents.

Your application is concluded free of charge within 30 days at the latest. If the process requires a separate cost, a fee may be charged according to the tariff set by the Turkish Personal Data Protection Board.

Requesting deletion of your data

You can send your deletion request by email to info@hallet.io with the subject "Data deletion request". Who should apply, and how, is explained step by step on the data deletion instructions page. We conclude requests within 30 days at the latest and notify you of the result.

Changes

We may update this policy. The current version is published on this page and the date at the top of the page changes. We notify businesses with a Hallet account of important changes by email.

Contact

For questions, write to info@hallet.io.