Privacy Policy
Last updated: 2026-06-02
UnifyBox is operated by Bestami Caner Kınalı ("we", "us", or "our"), a sole proprietorship registered in Türkiye. This Privacy Policy explains what personal data we collect when you use UnifyBox, how we use it, who we share it with, and the rights you have under KVKK (Türkiye), GDPR (EU/EEA), and similar laws. It covers operators (our customers) and the end-users (their customers) whose conversations flow through our platform.
1. Data Controller
Bestami Caner Kınalı is the data controller. Tax ID: 5561006332. Registered address: Adalet Mah. Manas Bulv. No:47/B K:26 D:2601 Folkart Towers A Kule, 35530 Bayraklı, İzmir, Türkiye. Privacy contact: [email protected]. Service URL: https://app.unifybox.io.
2. Information We Collect
Operator account data: name, email, workspace name, password hash, billing details (processed by LemonSqueezy — we never see full card numbers). End-user conversation data: when a customer messages a business through a channel connected to UnifyBox (WhatsApp Business API, Instagram, Messenger), we receive their message content, channel identifier (phone number or social handle), timestamps, and any media they send. Integration credentials: when you connect a third-party service we store an OAuth access token plus the corresponding refresh token, scoped to the minimum permissions needed for the feature. Credentials are encrypted at rest with AES-256. Usage telemetry: API requests, AI model usage (token counts, model id), error events, and basic browser/IP metadata for security and capacity planning.
3. Google API Services
When you connect Google Calendar, UnifyBox accesses two scopes on your behalf: https://www.googleapis.com/auth/calendar.readonly (to list the calendars on your account so you can pick which one the AI agent uses, and to read free/busy ranges before suggesting an appointment slot to a customer), and https://www.googleapis.com/auth/calendar.events (to create, update, reschedule, or cancel events when you or our AI agent acts on a customer request). UnifyBox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not transfer Google user data to third parties (other than the sub-processors listed in section 7, which act on our behalf and are contractually restricted to the same scope), we do not use Google user data for advertising, we do not use it to train generic or third-party AI/ML models, and we do not allow humans to read it except where strictly necessary for security, debugging an issue you reported, or to comply with applicable law. You can revoke Google's access to UnifyBox at any time at https://myaccount.google.com/permissions, which immediately invalidates the refresh token we hold for your account; we delete the stored token within 24 hours.
4. Meta Platforms (WhatsApp, Instagram, Messenger)
Operators connect WhatsApp Business Accounts, Instagram Professional accounts, and Facebook Pages through Meta's OAuth flow. We receive only the access tokens needed to send and receive messages on the connected channels and to read configuration metadata (phone number id, business name, page name). End-user phone numbers and social handles are stored in our database to allow your team or the AI agent to reply. We comply with the WhatsApp Business Platform Terms (24-hour customer service window, template message rules, opt-out handling) and with Meta's Platform Terms. We do not use Meta-derived data for advertising or AI model training. End-users can opt out of further messaging at any time by replying "DUR" or "STOP" — we honor opt-outs immediately and propagate them to the connected operator. End-users can also request deletion of their conversation history by contacting the operator or emailing us at [email protected].
5. Connected Commerce + Calendar Integrations
Operators may connect commerce platforms (Shopify, ikas, WooCommerce, Shopier, Trendyol, Hepsiburada) and calendar providers (Google Calendar, Calendly). For each connection we store only the credentials needed to call the relevant API on the operator's behalf — typically an OAuth token plus identifying metadata (shop domain, calendar email). Each integration calls only the endpoints required for its feature (read product/stock data, read free/busy, create or update events). We never store or process payment credentials from these platforms. The full list of connectable providers and the scopes we request for each is shown on the OAuth consent screen at connection time. Disconnecting an integration from the wizard immediately revokes our access and triggers token deletion within 24 hours.
6. How We Use Your Information
We use the data above to: deliver the messaging inbox and AI replies you signed up for; call third-party APIs (Shopify, Google Calendar, Meta, etc.) on your behalf when your team or our AI takes an action that requires them; bill your workspace via LemonSqueezy; prevent fraud and abuse; meet legal obligations (e.g. tax record-keeping for up to 10 years per Turkish law); and improve product reliability through aggregated, non-identifying telemetry. We do not sell personal data. We do not use Google user data, Meta user data, or end-user conversation content to train AI/ML models.
7. Data Sharing and Sub-processors
We share personal data only with sub-processors that operate the service on our behalf: Hetzner Online GmbH (Germany, EU) — primary infrastructure hosting; Supabase (self-hosted on our Hetzner infrastructure) — primary database + authentication; Cloudflare R2 — encrypted media storage (images, voice notes, document attachments uploaded in conversations); Google Gemini API — AI model inference for agent replies (stateless calls; provider does not retain inputs beyond the request lifecycle on our API plan); Meta (WhatsApp, Instagram, Messenger) — receiving and sending messages on operators' behalf; LemonSqueezy — payment processing; the connected commerce and calendar providers listed in section 5 — only on actions you or your AI agent initiate. All sub-processors are contractually bound to GDPR/KVKK-equivalent protections. We do not sell personal data and we do not share it with advertisers.
8. Data Storage and Security
Primary application data (accounts, conversations, integration tokens) is stored on Hetzner servers in Germany (EU) using a self-hosted Supabase deployment. Media files (images, voice notes, document attachments sent in conversations) are stored encrypted at rest in Cloudflare R2 — these files are accessible only through signed URLs valid for short windows. All traffic is encrypted in transit via TLS 1.2 or higher. Integration credentials (Google OAuth refresh tokens, Meta access tokens, commerce platform API keys) are encrypted at rest with AES-256. Access to production systems is limited to authorized staff with audited credentials. We monitor for suspicious activity and patch security-sensitive dependencies promptly. We have not experienced a data breach as of the date above; if we ever do, affected users will be notified within 72 hours per GDPR Article 33.
9. Data Retention
Active workspace data is retained while the account is active. Closed workspaces are retained for 30 days for restoration, then permanently deleted, unless we are legally required to keep records longer (Turkish tax law: up to 10 years for invoices and financial records). Connected integration tokens (Google Calendar, Meta, commerce) are deleted within 24 hours of disconnect. AI usage logs are retained for 90 days then aggregated; raw conversation content stays as long as the workspace is active and is deleted on account closure subject to the 30-day grace period. Media files in Cloudflare R2 follow the same lifecycle as the conversation they belong to. End-users can request deletion of their conversation history at any time by contacting the operator or emailing us at [email protected] — we delete within 30 days of a verified request.
10. Your Rights (KVKK and GDPR)
Under KVKK (Türkiye), GDPR (EU/EEA), and similar laws you have the right to: access the personal data we hold about you; correct inaccurate data; delete your data (subject to legal retention obligations); restrict processing or object to it; receive a portable export of your data; withdraw consent where processing relies on consent; and lodge a complaint with the supervisory authority (KVKK Kurumu in Türkiye, your local DPA in the EU). To exercise any of these rights email [email protected] — we respond within 30 days. End-users (operator customers): contact the operator first; if unresolved, contact us directly.
11. Cookies
We use essential cookies for authentication, security, and session management. Optional analytics cookies can be controlled in your browser settings or our cookie consent banner. We do not use advertising or tracking cookies that follow you across the web.
12. Children's Privacy
UnifyBox is a B2B product intended for businesses. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, email [email protected] and we will delete it.
13. International Transfers
Our primary infrastructure is in Germany (EU). Some sub-processors operate elsewhere (Google Gemini, Meta servers in the United States and elsewhere) — in those cases data is transferred under the relevant legal mechanisms (EU Standard Contractual Clauses, adequacy decisions, or equivalent under KVKK Article 9).
14. Changes and Contact
We update the "Last updated" date when this policy changes. Material changes are announced inside the app and to the account email on file at least 30 days in advance. Privacy questions, complaints, KVKK/GDPR rights requests: [email protected]. Postal mail: Bestami Caner Kınalı, Adalet Mah. Manas Bulv. No:47/B K:26 D:2601 Folkart Towers A Kule, 35530 Bayraklı, İzmir, Türkiye.