App Privacy Notice

This is the privacy notice on the processing of your personal data in the Fonify application (app.fonify.co) and the Fonify AI voice assistant service, issued under the Turkish Personal Data Protection Law No. 6698 (KVKK). Where the General Data Protection Regulation (GDPR) applies to you, it also serves as our Article 13 disclosure.

Fonify (Defsoft Bilişim Teknolojileri Anonim Şirketi) is referred to below as "Fonify" or the "Company".

As Defsoft Bilişim Teknolojileri Anonim Şirketi (the "Company"), acting as data controller under the Turkish Personal Data Protection Law No. 6698 (the "Law"), we process your personal data within the Fonify application (app.fonify.co) (the "Application") in the framework described below.

This notice is prepared to fulfil our obligation under Article 10 of the Law and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

• Legal name: Defsoft Bilişim Teknolojileri Anonim Şirketi
• Address: Üniversiteler Mah. İhsan Doğramacı Bul. No: 31 İç Kapı No: 24 Çankaya/Ankara, Türkiye
• MERSIS: 0272118846700001
• Tax office / Tax no: Doğanbey Tax Office / 2721188467
• Email: [email protected]

This notice applies to the representatives and users of businesses that use the Fonify service. Fonify's role differs for the personal data of people who call, or are called by, those businesses; that distinction is explained in section 6.

The following categories of personal data are processed within our Application:

• Identity data: first name, last name, username, job title of the business representative
• Contact data: email address, telephone number, business address, billing address
• Transaction security data: password (stored encrypted), session information, access logs, IP address, sign-in and sign-out times
• Financial data: invoice details, subscription plan details, payment history, information relating to the payment method
• Customer transaction data: the AI assistant settings you configure, greeting and routing scenarios, working hours, registered telephone numbers
• Call data: call date and duration, calling and called number, call direction, call outcome, call transcript, and the access link to the call recording
• Messaging data: the content and metadata of conversations conducted over the WhatsApp channel
• Usage and analytics data: application usage data, page views, session duration, feature usage frequency
• Device and access data: IP address, browser type and version (userAgent), operating system, device type, language preference, approximate geographic location derived from the IP address (country level)
• Professional information: the sector, size, and existing solution of the business

About call recordings: Call recordings are not stored on Fonify's systems. The recording is held on the systems of the service provider supplying the call infrastructure; Fonify holds only the access link to that recording, and only authorised Fonify personnel can access it. Recording can be disabled at the provider level on request.

Your personal data is collected through the following methods:

a) Collected directly from you:

• Application registration and membership forms
• Profile and business information update operations
• AI assistant configuration operations
• Support request and contact forms

b) Collected by automated means:

• Cookies and the browser's local storage mechanisms (see our Cookie Policy)
• Server access logs (access and error records)
• Call and messaging data generated automatically during telephone calls and communication over the WhatsApp channel
• Technical information transmitted automatically by your device and browser

c) Collected through third-party integrations:

• Payment service provider (Paratika)
• Call infrastructure and artificial intelligence service providers

Your personal data is processed for the following purposes and on the following legal grounds:

• Identity and contact data. Performance of a contract (Art. 5/2-c): conclusion and performance of the membership agreement, creation of the user account
• Customer transaction data. Performance of a contract (Art. 5/2-c): configuration and provision of the AI voice assistant service
• Call data. Performance of a contract (Art. 5/2-c): answering, routing, and reporting inbound and outbound calls
• Messaging data. Performance of a contract (Art. 5/2-c): conducting communication over the WhatsApp channel
• Financial data. Performance of a contract (Art. 5/2-c): subscription management and invoicing
• Contact data. Performance of a contract (Art. 5/2-c): service-related communication, notifications, and alerts
• Identity and contact data. Performance of a contract (Art. 5/2-c): support request management and resolution
• Identity, contact, and financial data. Legal obligation (Art. 5/2-ç): issuing invoices and meeting accounting and fiscal obligations under tax legislation
• Identity, contact, and customer transaction data. Legal obligation (Art. 5/2-ç): providing information and documents to authorised public authorities
• Transaction security data. Legal obligation (Art. 5/2-ç): keeping log records under Turkish Law No. 5651
• All relevant data categories. Legal obligation (Art. 5/2-ç): archiving data in line with statutory retention periods
• Call data and transaction security data. Establishment of a right (Art. 5/2-e): proving that the service was performed as agreed and use as evidence in legal disputes
• Transaction security, device, and access data. Legitimate interest (Art. 5/2-f): ensuring information and system security, detecting unauthorised access
• Usage and analytics data. Legitimate interest (Art. 5/2-f): analysing application usage, measuring and improving service quality
• Call data. Legitimate interest (Art. 5/2-f): monitoring service quality and troubleshooting
• Contact data. Explicit consent (Art. 5/1): sending marketing emails, campaign and announcement notifications

Where processing relies on explicit consent, your consent is requested separately for each purpose. If you do not give consent, only that activity is not carried out; your use of our services is unaffected. You may withdraw your consent at any time.

Artificial intelligence model training: Call recordings, transcripts, and message content are not used to train artificial intelligence models and are not shared between our customers.

Domestic transfers:

Under Article 8 of the Law, your personal data may be transferred to the following domestic recipients:

• Authorised public authorities: identity, contact, customer transaction, and financial data, for providing information and documents required by legislation and for fiscal obligations. (Art. 8/2-a, Art. 5/2-ç)
• Paratika (payment service provider): identity, contact, and financial data, for executing payments. Your card details are held by the payment institution and are not stored by Fonify. (Art. 8/2-a, Art. 5/2-c)
• Accountant and bookkeeping service provider: identity and financial data, for keeping accounting records and meeting tax obligations. (Art. 8/2-a, Art. 5/2-ç)

International transfers:

The infrastructure and artificial intelligence components required for our service to operate run on providers located outside Türkiye. The following data is therefore transferred abroad:

• Retell AI (USA): call data and the audio stream, for the voice AI assistant to conduct the call and for the call recording to be held.
• OpenAI (USA): call transcript and conversation content, for understanding the conversation and generating responses.
• ElevenLabs (USA): speech text, for generating the AI assistant's voice.
• Vercel Inc. (USA): device and access data, server access logs, for hosting infrastructure.
• Supabase: application data, for database and authentication infrastructure.
• Resend: contact data (email address), for transactional email delivery.

These transfers are carried out within the framework of Article 9 of the Law.

The following automated processing activities take place within our service:

a) AI call handling: inbound and outbound calls are answered and conducted automatically by the artificial intelligence assistant, within the scenarios configured by the business. The assistant understands the conversation, provides information, records requests, or routes the call.

b) Call summary and classification: calls are summarised automatically and classified by subject. These outputs are provided to the business for information; the final assessment is made by the business.

These activities are not intended to produce decisions based solely on automated processing that have legal effects concerning individuals or similarly significantly affect them. You may at any time ask for the conversation to be transferred to a human representative.

Under Article 11/1-g of the Law, you have the right to object to a result to your detriment arising from analysis of your data exclusively by automated systems. Where the GDPR applies, Article 22 GDPR gives you corresponding rights.

For the personal data of people who call, or are called on behalf of, businesses using the Fonify service (telephone number, voice, transcript, conversation content), the data controller is the business using the service. In respect of that data Fonify acts as a data processor under the Law, and processes it solely on the instructions of the data controller, limited to the purpose and scope set out in our agreement.

Accordingly:

• The obligation to inform callers under Article 10 of the Law rests with the business. On the business's instruction, Fonify technically provides for the notice announcement to be played at the start of the conversation.
• The business decides whether a conversation is recorded, for how long it is retained, and on what legal ground.
• To exercise your rights under Article 11 of the Law as a caller, you should apply first to the business you called. Requests sent to Fonify are directed to that business.

For its own employees, customer representatives, website visitors, and commercial communication records, Fonify acts as data controller.

Under Article 11 of the Law, you have the following rights as a data subject:

• a) to learn whether your personal data is processed
• b) to request information if your personal data has been processed
• c) to learn the purpose of processing and whether the data is used in accordance with that purpose
• ç) to know the third parties, in Türkiye or abroad, to whom your personal data is transferred
• d) to request rectification if your personal data is processed incompletely or inaccurately
• e) to request erasure or destruction of your personal data under Article 7 of the Law
• f) to request that operations carried out under (d) and (e) be notified to third parties to whom your data has been transferred
• g) to object to a result to your detriment arising from analysis of your data exclusively by automated systems
• ğ) to claim compensation for damage arising from unlawful processing of your personal data

Where the GDPR applies, you also hold the corresponding rights of access, rectification, erasure, restriction of processing, data portability, and objection.

For requests relating to call records, in line with the settled practice of the Personal Data Protection Board, the transcript of the conversation is provided rather than the recording itself. Personal data of third parties appearing in the transcript is masked.

You can submit requests relating to the rights above through the following methods:

• By email (from the address registered with us): to [email protected], with "Request for Information under the Personal Data Protection Law" in the subject line.
• In person (with a document establishing your identity): Üniversiteler Mah. İhsan Doğramacı Bul. No: 31 İç Kapı No: 24 Çankaya/Ankara, Türkiye. Write "Request for Information under the Personal Data Protection Law" on the envelope.
• By notary: to the address above, with the same wording on the envelope.
• Deletion request: through the form on the Data Deletion Request page.

Under Article 13/2 of the Law, your application will be concluded free of charge as soon as possible and within thirty (30) days at the latest, depending on its nature. Where the process incurs an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

Your application must contain your full name and, if in writing, your signature; your Turkish ID number (for foreign nationals, nationality, passport number, or identification number); your residential or business address for service of notice; your email address, telephone, and fax number for notification, if any; and the subject of your request.

Cookies and similar technologies (localStorage, sessionStorage) are used in our Application. The cookies we use and their purposes are summarised below:

Strictly necessary (technical) cookies: used for session management, authentication, and cross-site request forgery (CSRF) protection. These are technically required to provide the service and cannot be switched off. Legal grounds: Art. 5/2-c (performance of a contract) and Art. 5/2-f (legitimate interest).

Preference (functional) cookies: used to remember your theme and language preferences. Legal ground: Art. 5/2-f (legitimate interest).

For detailed information about our use of cookies, see our Cookie Policy.

This notice may be updated in line with legal developments or changes in our data processing activities. Updates are announced through the Application or by notification sent to your registered email address. The current text is always published at fonify.co/en/legal.

This notice has been prepared in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.