Privacy Policy

1. Who We Are

Aymam AI is provided by [ŞİRKET UNVANI / LEGAL NAME — e.g. Ad Soyad – Aymam Yazılım]. Address: [AÇIK ADRES / REGISTERED ADDRESS]. E-mail: [E-POSTA / EMAIL — e.g. destek@aymam.ai].

2. Our Roles

We are the data controller for our own customers' (the businesses using our assistants) account, contact and billing data, and for website visitors' data.

For messages from a shop's own customers (for example Instagram Direct messages), the shop is the data controller and we act only as a data processor on its behalf. We never use that data for any purpose other than the shop's instructions.

3. Data We Collect

• Website: what you write in the contact form; a session cookie if you log in; your language preference (stored in your browser). We use no advertising or analytics cookies.
• Business customers: name, business name, phone / WhatsApp number, e-mail, messages and commands sent to the assistant, product photos, product / price / FAQ data, billing details.
• Instagram assistant: messages and comments received on the shop's Instagram account, the sender's username and Instagram-scoped ID, post insights.
• Komşu camera assistant: footage from connected cameras, event descriptions generated from it, and questions users ask.
• Payments: payment status and billing details. Card details are processed by the payment provider; we never see or store them.

4. How We Use Data

• To provide the service: generating images and videos, scheduling and publishing posts, replying to messages, summarizing camera events and sending alerts.
• To provide support, invoice you and meet our legal obligations.
• To keep the service secure and prevent abuse.

We do not sell your data, use it for advertising, or build advertising profiles. Data obtained from Meta platforms (Instagram, WhatsApp) is used only to provide the relevant service, in line with the Meta Platform Terms.

Legal bases under the GDPR (for users in the EEA/UK): performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), our legitimate interests in security and service quality (Art. 6(1)(f)), and your consent for marketing (Art. 6(1)(a)).

5. AI and Automated Replies

Messages, images and camera footage are sent to our AI provider (Google Gemini) to generate replies or content. Under paid API terms this data is not used to train models.

When you message a shop on Instagram, the reply may come from an AI assistant. It answers only from information the shop has provided, passes anything uncertain to the shop owner, and the owner can take over the conversation at any time. The assistant never makes decisions that have legal effects on you.

6. Who We Share Data With

We share data only as far as needed to provide the service, with these providers:

• Amazon Web Services (server hosting — Frankfurt, Germany)
• Meta Platforms (WhatsApp Business Platform and Instagram Graph API)
• Google (Gemini API — AI processing of text, images and video; under paid API terms, data is not used to train models)
• [ÖDEME KURULUŞU / PAYMENT PROVIDER — e.g. Stripe] (payment processing — card details are never stored on our systems)
• Telegram (only for users who choose to receive notifications on Telegram)
• Our e-mail service provider (contact and notification e-mails)

We may also share data with competent authorities where legally required.

7. International Transfers

Our servers are in Germany (AWS Frankfurt); providers such as Meta and Google may also process data in other countries. These transfers rely on the safeguards in KVKK Article 9 and, for EU users, the European Commission's Standard Contractual Clauses.

8. Retention

We keep Instagram messaging records for up to 12 months, account and content data for the duration of the subscription (deleted within 30 days after it ends), trial data until the trial ends, camera records for [SÜRE / PERIOD — e.g. 30 gün / 30 days], and invoices for the legally required periods.

9. Security

Connections are encrypted with HTTPS; access tokens are protected on the server and available only to authorized personnel; assistant commands are accepted only from authorized phone numbers.

10. Your Rights

In Turkey you can exercise your rights under KVKK Article 11 (see the KVKK Information Notice). If you are in the EEA or UK, the GDPR gives you the right to access, rectify, erase, restrict processing, port your data, object, and withdraw consent, and to lodge a complaint with your local data protection authority.

Write to [E-POSTA / EMAIL — e.g. destek@aymam.ai] for any request. For deletion, see our Data Deletion page.

11. Children

Our services are intended for businesses and are not designed for anyone under 18.

12. Changes

We may update this policy. We will tell customers about material changes by WhatsApp or e-mail. The last-updated date is shown at the top of this page.