Last updated: October 31, 2026
The bracketed fields in this text are not filled in yet: LEGAL_COMPANY_NAME, LEGAL_ADDRESS, LEGAL_EMAIL.
This policy explains how the Gentz AI platform (the “Platform”) collects, uses, stores and deletes personal data — in particular data received from Meta Platforms through the WhatsApp and Instagram accounts that businesses connect. The Turkish version prevails in case of conflict.
- Legal name
- [LEGAL_COMPANY_NAME]
- Address
- [LEGAL_ADDRESS]
- [LEGAL_EMAIL]
1. What the Platform does
Gentz AI is management software used by digital agencies and the businesses they serve (“Businesses”): customer records (CRM), a shared inbox where WhatsApp and Instagram messages are answered in one place, an optional AI message assistant, appointments, quotes/sales, content publishing and ads reporting. End users (a Business’s customers) do not use the Platform directly; they chat with the Business’s WhatsApp number or Instagram account.
2. Roles: who is the controller?
- The Business is the data controller for its customers’ data. Messages, contact details and customer records of people who write to a Business on WhatsApp/Instagram belong to that Business, which decides how they are used.
- The Platform operator ([LEGAL_COMPANY_NAME]) is the data processor for that data. It processes the data only on the Business’s instructions and only to provide the service. An agency working for the Business accesses the Platform as a user authorised by the Business.
- For the account data of Platform users (agency and business staff) the Platform operator is the controller (see the KVKK Privacy Notice).
3. Data we receive from Meta
When an authorised person connects a WhatsApp Business account (through Meta’s Embedded Signup) or an Instagram professional account (Instagram Login) and explicitly grants permission, we receive:
| Source | Data | Why |
|---|---|---|
| Connected account (WhatsApp) | WhatsApp Business Account ID, phone number ID and display number, verified business name, quality rating / messaging limit, message templates, access token (encrypted) | Receive and send messages on the Business’s behalf, show account health |
| Connected account (Instagram) | Instagram professional account ID and username, Instagram ID of the person who connected it, access token (encrypted) and expiry | Receive and answer Instagram Direct messages |
| WhatsApp messages (webhooks) | Sender’s WhatsApp ID (phone number / wa_id), business-scoped user ID (BSUID), username and profile name when present; message content (text, photo, video, audio, document, location, contact card, button replies, reactions), message IDs and timestamps, delivered/read statuses; the ad ID when the chat started from a click-to-WhatsApp ad | Show in the inbox, reply, match to the customer record, measure response times, report the ad source |
| Instagram messages (webhooks) | Instagram-scoped user ID (IGSID), message content and attachments (photo, video, audio, story reply/mention), reactions, seen events, edit/delete notices, ad referral; username and profile name when needed | Same purposes |
| History import (only if the Business starts it) | On Instagram the 20 most recent messages per conversation; with WhatsApp Business app coexistence, up to 180 days of one-to-one chat history with the Business’s consent | Show earlier conversations on the customer record |
If a Business also connects them, Facebook Page / Instagram publishing, ad account performance data and Lead Ads form answers are received for use in that Business’s workspace only.
4. How we use the data
- Show messages to the Business’s authorised staff in the shared inbox, deliver their replies to WhatsApp/Instagram, assign and follow up conversations.
- Match the sender to the Business’s customer record or create one (name, phone — only if the person shares it —, channel IDs).
- Produce internal reports such as response time and waiting conversations.
- If the Business turns on AI features: conversation summaries, intent detection, reply drafts and — when the Business hands a conversation to the assistant — automated replies within the 24-hour customer service window. If the person asks for a human, the conversation is handed to staff. Automated replies are never sent with the Instagram HUMAN_AGENT tag.
- Keep the Platform secure, fix errors and meet legal obligations.
What we don’t do: we do not sell or rent data received from Meta, share it with third parties for advertising or profiling, pass it to data brokers, use it to train AI models, or show one Business’s data to another.
5. AI processing (Anthropic)
AI features run only when the Business enables them and use the Claude API of Anthropic, PBC (USA) as a sub-processor. Before text is sent to the model, phone numbers, email addresses, IBANs, card numbers and Turkish ID numbers are replaced with placeholders and the person is referred to by first name only. Under Anthropic’s commercial terms, content sent through the API is not used to train models. For each AI call the Platform logs only the feature, model, token counts and a cost estimate — no message content.
6. Who we share data with
- Meta Platforms (WhatsApp Business Platform, Instagram API): to deliver the Business’s replies.
- Anthropic, PBC: if AI features are on, with the limits above.
- Hosting and storage provider: [LEGAL_HOSTING].
- Email delivery service: notifications and password resets for users (no message content).
- Competent authorities: only where required by law.
Meta and Anthropic process data outside Türkiye; these transfers rely on the mechanisms of Article 9 of Law No. 6698 (e.g. standard contractual clauses) and on the Business’s instructions.
7. Retention and security
- Access tokens are stored encrypted and never shown in the interface. All traffic uses HTTPS; every Meta webhook signature is verified.
- Each Business’s data is kept separate (row-level isolation in the database, role- and assignment-based permissions). Two-factor authentication is mandatory for admin accounts; significant actions are written to an audit log.
- Media files are stored in Business-specific folders and opened only through expiring signed links.
Retention periods
- Messages, media and customer records are kept while the Business’s account and channel connection exist, until the Business deletes them.
- When a channel is disconnected or Meta notifies us that the app was removed, access tokens are deleted immediately.
- When a data deletion request arrives through Meta, the data received through that account is deleted (see Data Deletion Instructions).
- When a Business’s subscription ends, its workspace data is deleted within 30 days at the latest.
- Audit logs are kept for security; personal content in them is redacted when a person is erased.
8. Your rights
Under Article 11 of the KVKK and, where applicable, the GDPR you may request access to, correction, deletion or restriction of your data and object to its processing.
- If you messaged a Business, send your request to that Business, which is the controller; it can record your request in the Platform and export or anonymise your data. Requests that reach us are forwarded to the Business and we help it fulfil them.
- If you are a Platform user or connected your account through Meta, write to [LEGAL_EMAIL] or follow the data deletion instructions. We answer within 30 days.
9. Cookies
The website and management panels use only strictly necessary cookies for the session and security (CSRF); no advertising or tracking cookies. Details: Cookie Policy.
10. Children
The Platform is not directed to people under 18 and does not knowingly collect their data.
11. Changes and contact
When we update this policy we change the date at the top and notify Platform users of material changes. Questions: [LEGAL_EMAIL].
Back to the home page