VRT Yazılım Bilişim ve Danışmanlık Hizm. Tic. Ltd. Şti. ("FlexInbox", "Platform", "we"), publisher of the Bitrix24 Marketplace application "FlexInbox WhatsApp & Telegram + AI", is a multi-channel customer communication SaaS service that combines WhatsApp and Telegram with Zoho CRM, Bitrix24, HubSpot, and GoHighLevel (LeadConnector), and includes a trainable AI agent. This Privacy Policy explains which personal data we process while you use the Service, for which purposes, on which legal bases, and your rights under the KVKK (Turkish Personal Data Protection Law No. 6698) and the GDPR (EU 2016/679).
Table of Contents
1. Data Controller
The party acting as Data Controller within the scope of this Service is:
| Legal Name | VRT Yazılım Bilişim ve Danışmanlık Hizm. Tic. Ltd. Şti. |
|---|---|
| Tax No. | 9251287608 |
| MERSIS No. | 0925128760800001 |
| Address | Nişantaş Mh. Demiryolu Cd. No:5/111 Selçuklu/Konya |
| Phone | +90 850 307 43 15 |
| destek@flexinbox.io | |
| Web | https://flexinbox.io |
Role distinction: Businesses that use the Platform (our customers) are the data controllers of the data belonging to their own customers; with respect to such data, FlexInbox acts as the data processor (the "processor" under the GDPR), acting on the instructions of the business. With respect to the account data of the business users who register on the Platform, however, FlexInbox is the Data Controller.
White-label (reseller) use: The Service may be offered to end customers by a business partner/agency under its own brand. In this case, the data controller of the end-customer data is the relevant agency; FlexInbox acts as a sub-processor and processes the data solely within the framework of the agency's instructions and this policy. Obtaining the necessary consents from end users is the responsibility of the agency.
2. Personal Data We Process
a) Account / user data
- Full name, email address, cryptographic hash of the password
- Company (tenant/organization) name, user role (administrator/agent)
- CRM account identifier: Zoho user/organization, Bitrix24 user/portal, HubSpot portal, or GoHighLevel (LeadConnector) sub-account/location identifier
b) Integration and messaging data
- Session information of the connected WhatsApp/Telegram account (device pairing)
- Content of sent/received messages, time of sending, direction (incoming/outgoing), delivery status (ticks), sender name
- Media files such as images, audio, video, and documents
- The counterparty's phone/Telegram number or username and profile name
- CRM record matches (Zoho Contact/Lead/Deal, Bitrix24 Open Channel, HubSpot Contact/Deal, or GoHighLevel Contact/Conversation identifier, record owner)
- If the AI agent is used: knowledge base content and AI response/interaction records
c) Payment and billing data
- Subscription/order information, invoice title, tax/identification number, billing address
- Payment transaction metadata (amount, date, transaction/authorization status). Card details are not stored by FlexInbox; they are processed by the payment infrastructure (iyzico).
d) Technical data
- IP address, browser/session information, access and error logs
- Session cookie / authentication token (JWT)
3. Processing Purposes and Legal Bases
| Purpose | Legal basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|
| Provision of the Service, creation and management of the account | Performance of a contract |
| Synchronization of WhatsApp/Telegram messages with the CRM (Zoho, Bitrix24, HubSpot, GoHighLevel), automatic record creation, responding with AI | Performance of a contract / legitimate interest |
| Security, prevention of misuse, keeping logs | Legitimate interest / legal obligation |
| Invoicing and statutory record-keeping obligations | Legal obligation |
| Support requests and informational communications | Legitimate interest / explicit consent |
4. Channel and CRM Data
FlexInbox connects the agent's WhatsApp or Telegram account via a QR code and carries out messaging over this session. Message content and media files are stored on our servers so that the Service can be provided and are associated with the relevant CRM (Zoho, Bitrix24, HubSpot, or GoHighLevel) record. WhatsApp is a third-party service belonging to Meta Platforms; Telegram to Telegram FZ-LLC; Zoho CRM to Zoho Corporation; Bitrix24 to Bitrix Inc.; HubSpot to HubSpot, Inc.; and GoHighLevel/LeadConnector to HighLevel Inc., each subject to its own privacy policy. When the AI agent is used, the relevant message, audio and visual media, and knowledge base content may be transmitted to the model provider (OpenAI) in order to generate a response. The business using the Platform is responsible for obtaining the necessary consents from the counterparties and for the compliance of the messaging with the applicable legislation (e.g., commercial electronic message rules).
5. Data Transfer and Third Parties
Your data is not sold for marketing purposes. It is shared only with the infrastructure/service providers necessary for the operation of the Service:
- Hosting/infrastructure: cloud server and database service provider, application and database hosting
- Meta / WhatsApp and Telegram: transmission of messages
- CRM providers (Zoho Corporation, Bitrix Inc., HubSpot, Inc., HighLevel Inc.): CRM integration
- OpenAI: response generation (text, audio, visual) if the AI agent is used
- iyzico: secure collection of payment/subscription transactions (PCI-DSS compliant)
- Logo İşbaşı: invoice and tax information for the issuance of statutory e-Invoice/e-Archive documents
- Sentry: error monitoring and stability (with personal data masked)
- Email delivery: SMTP provider for notification/password-reset emails
- Legal authorities: upon request as required by legislation
6. Transfer Abroad
Services such as WhatsApp (Meta), Telegram, Zoho, Bitrix24, HubSpot, GoHighLevel, OpenAI, and Sentry may process data on servers located abroad (payment/e-invoice providers such as iyzico and Logo İşbaşı process data in Türkiye). These transfers are carried out on the basis of explicit consent, performance of a contract at the request of the data subject, or appropriate safeguards (KVKK Art. 9 / GDPR Art. 44 et seq., standard contractual clauses). You may contact us to obtain information about where your data is processed.
7. Retention Periods
- Message and media records: for as long as the business account is active; deleted/anonymized within 30 days at the latest after account closure. (An additional maximum retention period also applies to media files.)
- Account data: for the duration of the membership and throughout the statutory retention periods.
- Logs: 12 months.
- Backups: retained for a limited period within the rotation scope (at most a few backups).
8. Data Security
- TLS/HTTPS encryption in transit
- Irreversible hashing of passwords (bcrypt)
- Data isolation on a per-tenant (organization) basis
- Token-based access and role-based authorization
- Regular backups and access logs
No method guarantees 100% security; however, we take reasonable technical and administrative measures to protect your data.
9. Cookies
Only strictly necessary cookies/tokens for keeping the session open and for security are used. For details, please see the Cookie Policy.
10. Your Rights (KVKK & GDPR)
Under Article 11 of the KVKK, you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties, domestic or abroad, to whom the data has been transferred; request the correction of incomplete/inaccurately processed data; request its deletion/destruction where the conditions are met; and object to any adverse result arising against you from the analysis of the processing exclusively through automated systems.
Under the GDPR, you additionally have the rights of access (Art. 15), rectification (Art. 16), erasure/"right to be forgotten" (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to lodge a complaint with a supervisory authority.
You may submit your requests to destek@flexinbox.io; applications are concluded within 30 days at the latest.
11. Changes and Contact
This policy may be updated from time to time; the current version is always published on this page. For your questions: destek@flexinbox.io