1. Scope and legal roles
Intilaqa AI, the operator of intilaqa-ai.com and the service provider identified in the applicable order form or invoice ("Intilaqa", "we", "us"), is the data controller for website, account, billing, security, and direct support data.
For business content and end-user conversations processed through a customer's agent, the customer normally determines the purpose and means of processing and remains the data controller; Intilaqa processes that data to provide the contracted service and in accordance with the customer's lawful instructions. Customers must give their end users the required notice and establish the consent or other legal basis required for their use case.
2. Data we process
- Account and identity data: name, verified email address, authentication identifiers, role, company details, and account settings.
- Subscription and transaction data: plan, quota, billing status, invoices, and limited payment references. Full card data is handled by the payment provider and is not stored by Intilaqa.
- Customer knowledge and structured business data: files, records, URLs, policies, products, programmes, and metadata uploaded, synchronised, or connected by the customer.
- Conversation data: end-user messages, generated replies, session identifiers, channel information, feedback, and usage totals needed for the widget, API, WhatsApp features, inbox, and reporting.
- Technical and security data: IP address, browser and device signals, timestamps, request logs, authentication and integration-key events, diagnostics, and abuse-prevention signals.
- Support data supplied when a person contacts us or requests a demonstration.
3. How the AI service uses customer data
Customer Data is not used by Intilaqa to train, fine-tune, or improve a shared or public artificial-intelligence model. Intilaqa does not combine one customer's private knowledge with another customer's private knowledge.
Customer content may be converted into structured search records or vector embeddings and stored in a tenant-scoped search space. When an end user asks a question, the Service retrieves relevant records and sends the minimum context needed, together with the question and service instructions, to the model provider selected for that workflow. The provider returns an answer that Intilaqa delivers to the requested channel. Indexing, embedding, retrieval, and response generation are processing operations; they are not model training.
Conversation logs may be retained so the customer can view history, operate the inbox, measure usage, investigate errors, and maintain continuity. Intilaqa does not sell Customer Data or use it for advertising profiles.
4. Purposes and legal bases
- Performing the service contract: creating accounts, authenticating users, operating agents and integrations, processing requests, administering subscriptions, and providing support.
- Legitimate interests, where permitted: securing the platform, preventing fraud and abuse, measuring reliability, diagnosing incidents, and improving service operations without training models on Customer Data.
- Compliance with law: accounting, tax, lawful requests, consumer-protection duties, and records that must be retained.
- Explicit consent where Turkish Personal Data Protection Law No. 6698 (KVKK) or another applicable law requires it for a specific activity that cannot rely on another legal basis.
5. Service providers and disclosures
We use specialist providers for authentication, hosting and delivery, databases, vector and structured search, model inference, billing, notifications, monitoring, and customer-selected communication channels. Depending on the enabled configuration, relevant data may be processed by services such as Clerk, Cloudflare, Hostinger, Supabase, Pinecone, Algolia, Google, OpenAI or OpenRouter, Paddle, Novu, LangSmith, and Meta/WhatsApp. Each provider receives only the data reasonably required for its function and processes it under its agreement and applicable data-protection obligations.
We may also disclose data to professional advisers, competent authorities when legally required, or a successor in a merger, financing, reorganisation, or sale, subject to confidentiality and legal safeguards. We do not sell personal data.
6. International transfers
Some providers process data outside Türkiye. Any transfer of personal data abroad is subject to Article 9 of KVKK. Where required, Intilaqa and/or the relevant customer will use an applicable mechanism, such as an adequacy decision, appropriate safeguards including the standard contracts published by the Turkish Personal Data Protection Authority, binding corporate rules, or a statutory occasional-transfer condition.
7. Retention, deletion, and cookies
We retain each category only for as long as necessary for its stated purpose, the active contract, security and dispute handling, and mandatory tax or legal periods. Customer content is deleted or returned following a verified request or termination where contractually required, subject to lawful retention and the time needed for secure backup copies to expire. Account deletion does not require erasure of records that must legally be retained or data irreversibly anonymised.
The site uses necessary technologies for sign-in, session continuity, security, language, and preferences. Limited analytics may be used to understand reliability and aggregate usage. We do not use Customer Data for behavioural advertising. Where consent is legally required for a non-essential technology, it will be requested before activation.
8. Your KVKK rights
Under Article 11 of KVKK, an eligible data subject may ask whether personal data is processed; request information; learn its purpose and recipients in Türkiye or abroad; request correction; request deletion or destruction where legal conditions are met; ask that correction or deletion be notified to recipients; object to an adverse result arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.
Send a request to privacy@intilaqa.ai with enough information to verify identity and identify the requested processing. We handle requests under Article 13 of KVKK and the Communiqué on Applications to the Data Controller. We may request additional verification and will not disclose data until identity is reasonably established.
9. Changes and contact
We may update this notice when the Service, providers, or law changes. Material changes will be communicated through the site, dashboard, or account email where appropriate. Privacy questions and data-subject requests can be sent to privacy@intilaqa.ai.