Privacy Policy
This policy explains how we handle the data in the mailbox you connect to TekPilot. For your account and billing information, see the Privacy Notice (Aydınlatma Metni).
Our role
You are the data controller for the emails and attachments in the mailbox you connect; we process this data solely to provide the service to you and on your instructions. We do not use this data for our own purposes, we do not sell it, and we do not use it to train artificial intelligence models.
What we read
- We read the emails and attachments arriving in the mailbox you connect with read-only access. We do not delete emails, mark them as read or send emails on your behalf.
- From the emails we create work items, tasks and missing-step alerts. No action that writes outside TekPilot is taken without your approval.
How your data is protected
- Email contents, summaries, attachments and contact details are stored in the database encrypted with AES-256-GCM. Each company has its own encryption key, and the keys are kept wrapped in a separate key vault; neither the database nor its backup can be read on its own.
- Companies cannot see each other's data at the database level either (row-level access separation).
- Passwords are hashed irreversibly. Two-factor authentication is mandatory for account owners.
- Data travels over the network through encrypted connections.
- Who approved or changed what, and when, is logged.
Processing with artificial intelligence
- Before email and attachment text is sent to the AI provider, Turkish ID numbers (TC kimlik numarası), IBANs, phone numbers and email addresses are masked; which data was masked is logged.
- Personal names and other information in free text are not masked today. We say this openly so that you can make the right decision when connecting your mailbox.
- The providers we use are listed on the Sub-processors page; they do not use data sent through the API for model training.
- Fields and suggestions produced by AI are marked in the application; the final decision always rests with your team.
Access by our team
- Our support team can see email content only during a support session approved by your account owner. A session lasts at most 8 hours and has a limited scope: summary information only, or full content. This limit is enforced at the decryption layer, not in the application interface.
- In an emergency, access may be opened with the separate approval of two of our administrators. In that case an email is sent to your account owner immediately.
- Every access is visible to you on the Security screen in the application.
Retention and deletion
- Your data is retained for the duration of your subscription.
- When your subscription ends, or is suspended because payment could not be collected, your data is retained for a further 60 days; during this period you can pay and continue where you left off, or ask for your data to be exported.
- We notify you by email at least 7 days before this period expires. We then make the data irrecoverable by destroying your company's encryption keys, and delete the records.
- Deletion takes place earlier at the account owner's request.
Security breach
If we become aware of a breach affecting your data, we notify you without delay and, pursuant to Art. 12 of KVKK (Turkish Personal Data Protection Law No. 6698), notify the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 72 hours at the latest.
Changes
If we add a sub-processor or materially change this policy, we notify account owners by email at least 30 days before the change takes effect.