Introduction
This Privacy Policy explains how Fonify collects, processes, and protects your personal data. Our policy has been prepared in compliance with the Turkish Personal Data Protection Law (KVKK) and the General Data Protection Regulation (GDPR). This text will be finalized by our legal counsel.
As an AI voice assistant service, Fonify maintains the highest level of data security. We recommend reading this policy carefully before using our service. For details of our disclosure obligation under the KVKK, see our KVKK Data Protection Notice, and for consent-based processing, our Explicit Consent text. For questions, please contact [email protected].
Data controller
The data controller responsible for your personal data is DefSoft Bilişim Teknolojileri A.Ş. The company is headquartered in Ankara, and this address is valid for legal notices. Full data controller contact details are available through the panel.
Our role as data processor and customer data
Fonify processes data in two distinct capacities. It acts as data controller for the Account Holder's own data (registration, billing, panel use). For data that arises in calls with the Account Holder's customers (caller number, call content), it acts as data processor operating on the Account Holder's instructions.
In its capacity as data processor, we process this data only to provide the service and for the purposes determined by the Account Holder. The obligations to inform and obtain consent from the end individuals, that is the Account Holder's customers, rest with the Account Holder. The data processing relationship between us is documented, where required, by a separate data processing agreement.
Data we collect
At Fonify, we collect two main categories of data: account data and service usage data.
Account data includes information collected during registration and panel use:
- First name, last name, and contact information (email, phone)
- Company name and industry information
- Billing address and tax details
- Payment information (stored only at the payment provider)
- Login records and panel activity
Service usage data includes information related to calls processed by your AI employee:
- Call date, duration, and participant number
- Call recording audio and text transcripts
- Call outcome and interaction summaries
- Customer tags from integrated systems
Why we process data
We process the data we collect for the following purposes:
- To deliver the service, answer calls, and forward results via your panel
- Billing and payment management
- Customer support and issue resolution
- Service security and fraud prevention
- Meeting our legal obligations
- Marketing communications where consent is granted
Your call recordings are never used for model training without your permission. Only anonymized and aggregated information is used to develop independent AI models.
Legal basis
When processing data, we rely on one of the following legal bases:
- Performance of contract (when required to deliver the service)
- Legal obligation (tax, accounting, audit)
- Legitimate interest (service improvement, security, fraud prevention)
- Explicit consent (optional processing such as marketing communications)
International data transfers
Some of our cloud infrastructure providers keep data within the European Union and Türkiye. When transfers outside these regions are necessary, we rely on the KVKK-approved safe country list or contractual safeguards that ensure adequate protection.
Data retention periods
We retain your data only for as long as necessary for the processing purpose:
- Account data: Until service termination plus 30 days
- Call recording audio: The retention period set in your account (default 90 days)
- Call transcripts: The retention period set in your account (default 12 months)
- Invoice records: 10 years (as required by the Tax Procedure Law)
- Marketing consents: Until consent is withdrawn
Retention periods can be customized via the panel.
Data security
We apply industry-standard security measures to protect your data:
- TLS encryption during transit
- AES-256 encryption at rest
- Optional two-factor authentication (2FA)
- Access logging and anomaly monitoring
- Regular security audits and penetration tests
- Mandatory security training for personnel
If we detect a data breach, we notify the relevant authorities and affected users within the legally required timeframes.
Your rights
Under KVKK and GDPR, you have the following rights:
- To know whether your data is being processed
- If processed, to learn the purpose and the data being processed
- To request correction when data is inaccurate
- To request deletion under the conditions set out in the law
- To object to processing or request its restriction
- To export your data in a portable format
- To withdraw consent (for consent-based processing)
- To file a complaint with the relevant authorities
To exercise your rights, please write to [email protected]. Your requests are answered within 30 days.
Children's privacy
Fonify is a business service, is not directed at persons under the age of 18, and does not knowingly collect personal data from children. Use of the service requires being of legal age or being an authorized representative acting on behalf of a minor.
If we become aware that a child's personal data has been provided to us without consent, we delete the relevant data within a reasonable time. If you become aware of such a situation, you can notify us at [email protected].
Changes
This Privacy Policy may be updated from time to time. Material changes are communicated by email and announced in your panel. The effective date of the updated policy is shown at the top.
Contact
For privacy questions and data requests, please contact [email protected]. For written applications, find our registered office address through your panel.