Privacy Policy

How we handle the data of businesses that use Mesaifix, visitors to our website, and people who talk to those businesses' assistants or make bookings with them. This notice is written to meet the GDPR's information requirements (Arts. 13 and 14) and applies outside Türkiye and Germany.

Last updated: October 29, 2026
Version: 1.3

In short

We do not sell your data or use it for advertising. There are no advertising or analytics cookies on our site.
Conversation and booking data belongs to the business; we process it only on the business's behalf, to provide the service.
The assistants send the AI model only what is needed to produce an answer. Unless the business has separately agreed in writing, that data is not used to train models.
We are a company in Türkiye and part of our infrastructure is in the USA; every transfer is covered by the safeguards described below.
To exercise your rights, write to info@henartech.com.

This summary is here to make reading easier; the full text below is what binds.

1. Who this policy covers

Visitors: people who visit mesaifix.com or fill in the contact form,
Customers: businesses that open an account with Mesaifix, account holders and Authorised Users,
End Users: people who talk to our Customers' website assistant or WhatsApp line, or make a booking on their booking page.

2. Who is responsible

The controller for the processing described in this policy, where we act as controller, is:

Legal name: Henartech Yazılım Ltd. Şti.
Address: Yenişehir Mah. Çevlik Sk. Kurudere Apt. No: 2 İç Kapı No: 9, Merkez/Bingöl, Türkiye
E-mail: info@henartech.com
Website: mesaifix.com

Because we are established outside the European Union and offer our services to businesses in the EU, we have appointed a representative under Art. 27 GDPR, whom you can also contact about any question on the processing of your data: Ahmet Akbana, privacy@mesaifix.com.

As a company established in Türkiye we also comply with Turkish Law No. 6698 on the Protection of Personal Data.

3. Our role: controller or processor?

Mesaifix acts in two different roles depending on the data:

Data	Mesaifix's role	Controller
Visitor and contact-form data	Controller	Mesaifix
Account, business profile, subscription and invoice data	Controller	Mesaifix
End User conversations, WhatsApp contacts, bookings and customer details the business enters in the panel	Processor	The business concerned

For End User data, the business decides the purposes and means of processing. We process that data only on the business's instructions and in line with the Data Processing Agreement.

4. What data we process

Category	Examples	Source
Identity and contact	Name, e-mail address, phone number	Sign-up form, contact form, panel
Business information	Business name, sector, address, opening hours, logo, product and service list, FAQ, policies, campaigns	Panel and setup steps
Account and security	Password (stored irreversibly), session details, login times, accepted agreement version	Authentication system
Customer transactions and finance	Plan, Credit movements, invoices, payment status (not card details)	Panel, payment provider
Support and correspondence	Support requests, contact-form messages, e-mails	You
Channel connections	Google and Meta (WhatsApp, Instagram) account and line identifiers, access credentials	The platform you connect
Technical data	IP address (briefly, to prevent abuse), browser information, error and access logs	Automatic
End User data (on the business's behalf)	Conversation messages; WhatsApp number and profile name; name, phone, e-mail, party size, notes and answers to the business's questions given for a booking; reminder preference	The End User

We never see your password in plain text and we do not store card details. We do not aim to collect special categories of personal data, and we ask businesses not to request them.

5. Purposes and legal bases

Where we act as controller, we process personal data for the following purposes and on the following legal bases under Art. 6(1) GDPR:

Purpose	Legal basis
Creating your account, providing the Services and performing the Terms of Use	Performance of a contract (Art. 6(1)(b))
Measuring Credit use, invoicing and tracking payments	Performance of a contract (b); legal obligation for invoices and accounting records (c)
Answering support requests and contact-form messages	Steps prior to a contract or performance of a contract (b); otherwise our legitimate interest in answering enquiries (f)
Keeping the Platform secure, preventing abuse and fraud, fixing errors	Legitimate interest in a secure, working service (f)
Sending service, security, billing and agreement-change notices	Performance of a contract (b)
Meeting legal obligations and defending against legal claims	Legal obligation (c); legitimate interest (f)
Improving the Services with aggregated statistics that do not identify anyone	Legitimate interest (f)

Where we rely on legitimate interest you have the right to object (see Your rights). We do not send marketing messages without your consent (Art. 6(1)(a)); if we ever ask for it, giving it is optional and you can withdraw it at any time.

6. AI and your data

When an assistant answers an End User, it sends the AI model: the business's assistant settings, the parts of the information the business entered in the panel that are relevant to the question, and the messages of the current conversation session only. Earlier sessions are not sent to the model.

When importing products from a file (Excel, CSV, PDF), the file's content is sent to the model to recognise products and columns. Nothing is saved until you approve the products one by one.

AI models are provided by AI providers we contract with; we decide which provider's model a business runs on, based on quality and cost. Under our agreements with the providers, data sent to them is not used to train their models; it may be kept for a limited time to monitor abuse. The only exception is data-sharing use that a business has separately agreed to in writing; that business's conversations are then shared with the provider to improve its models. Mesaifix does not use Customer Content or End User data to train any model either.

The assistants make no decisions based solely on automated processing that have legal or similarly significant effects on End Users (Art. 22 GDPR). Bookings are created according to rules the business sets and are managed by the business.

7. Who we share data with

We do not sell personal data, rent it out or share it for advertising. We transfer data only in the following cases.

Our service providers (sub-processors)

We work with the following providers to deliver the Services. Each processes data only to provide services to us, bound by a contract under Art. 28 GDPR.

Provider type	Service	Data processed	Location
Hosting and database	Running the application, database, authentication, file storage	All data on the Platform, IP address, request logs	EU, USA
AI model providers	Answer generation and product import from files	Conversation session, relevant business information, uploaded file content	USA, other countries
Meta (WhatsApp, Instagram)	Messaging — only when you connect your line or account	Messages, phone number, profile name	EU, USA
Google	Google Business Profile — only when you connect it	Business profile identifiers, reviews	USA
E-mail delivery service	Account verification, password reset, booking and service e-mails	E-mail address, name, e-mail content	EU, USA
Licensed payment provider	Collecting subscription payments	Name, e-mail, billing details, amount; card details are taken directly by the payment provider	Türkiye (iyzico, for businesses in Türkiye). Orders outside Türkiye are sold by Paddle.com Market Ltd, United Kingdom, as Merchant of Record.

The current list with the providers' names and locations is sent to you if you write to info@henartech.com. We notify our Customers by e-mail at least 30 days before starting to work with a new sub-processor.

Other transfers

to public authorities and courts empowered by law, when there is a legal obligation or a lawful request,
to our legal, accounting and audit advisers, under a duty of confidentiality and to the extent necessary,
in a merger, acquisition or asset sale, to the acquiring party, provided it maintains the same level of protection as this policy,
for End User data, to the business that is the controller of that data.

8. International transfers

Mesaifix is established in Türkiye, and some of the providers above process data in the United States. Neither Türkiye nor every one of those providers is covered by an adequacy decision of the European Commission, so transfers of personal data from the EU/EEA, the UK or Switzerland are made with appropriate safeguards under Art. 46 GDPR:

the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with the UK Addendum where UK data is concerned,
for US providers certified under the EU-US Data Privacy Framework, that certification (Art. 45 GDPR),
supplementary technical and organisational measures, in particular encryption in transit and at rest.

You can request a copy of the safeguards by writing to info@henartech.com. Transfers of End User data are made under the Data Processing Agreement.

9. How long we keep data

We keep personal data for as long as needed for the purpose it is processed for and for the periods set by law. When the period ends, data is deleted or anonymised.

Data	Retention period
Account and business data	While the account is open. After the agreement ends, deleted after the 30-day period for requesting a copy; deleted without waiting if you delete the account yourself.
End User conversations and bookings	While the business's account is open, or until the business deletes them. Conversations the business removes in the panel may be kept for support and security, and are permanently deleted at the business's request.
Agreement acceptance and account transaction records	Until claims under the agreement are time-barred, at most 10 years from the end of the agreement
Invoices and accounting records	10 years (statutory retention periods under commercial and tax law)
Support requests	While the account is open
Contact-form messages	2 years after the request is closed
IP address kept to prevent abuse	As a rule, 1 hour
Hosting and error logs	For the provider's retention period, as a rule not exceeding 30 days
Backups	According to the backup cycle, at most 90 days
Channel access credentials	Until the connection is removed or the account is deleted

10. How we protect data

Data is encrypted in transit and at rest.
Each business's data is isolated from other businesses' data.
Secrets such as channel access credentials are protected with additional measures; passwords are stored irreversibly.
Access to data is limited to authorised staff and business need.
The website assistant works only on sites the business allows and is protected against abuse.

If a personal data breach is likely to result in a risk to you, we notify the competent supervisory authority within 72 hours (Art. 33 GDPR) and, where the risk is high, the people affected without undue delay (Art. 34 GDPR). For End User data we notify the business concerned.

11. Google API data

When you connect your Google Business Profile, we use the information we receive from Google APIs (such as the business profile and reviews) only for the features we provide to you in the panel. Mesaifix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google data for advertising or sell it; we allow humans to read it only with your consent, for security purposes or where required by law; and we do not use it to train general-purpose AI models. You can remove the connection at any time from the panel or from your Google account permissions page.

12. Meta (WhatsApp, Instagram) data and data deletion instructions

When you connect your WhatsApp line or Instagram account, we receive from Meta the messages sent to your line, the sender's WhatsApp number and profile name, your line's identifiers and access credentials. We use this data only for the assistant's answers, showing conversations in the panel and sending booking reminders.

To have your data deleted:

To remove the connection, disconnect it on the relevant assistant's or product's page in the panel. This deletes the access credentials and stops new data from arriving.
You can remove individual conversations on the Conversations page of the panel.
To delete your account and all your data, use “Delete account” on the Settings page of the panel.
If you cannot reach the panel or want permanent deletion, write to info@henartech.com from the e-mail address registered on your account. We complete your request within 30 days at the latest.

If you messaged a business on WhatsApp and want your data deleted, contact that business first. If you write to us, we pass your request on to the business.

13. If you talked to a business's assistant or made a booking

If you talked to the assistant on a business's website or WhatsApp line, or made a booking on its booking page, that business is the controller of your data. Mesaifix is the technology provider supplying these services to the business, and processes your data only on the business's behalf.

The data processed: the messages you write; the name, phone, e-mail, party size, notes and answers to the business's questions you give for a booking; the reminder you choose; and on WhatsApp also your number and profile name. It is processed so the business can answer your questions and manage your booking.

You are talking to an AI assistant. It generates automatic answers from the information the business provided and can make mistakes. Confirm important details such as prices, stock or appointments with the business where needed. Do not share sensitive information, such as your health, with the assistant.

So that your conversations can be grouped when you come back, the website assistant stores a random visitor ID in your browser. It does not identify you as a person; you can remove it by clearing your browser data.

Booking confirmations and reminders are sent on the channel you choose (e-mail or WhatsApp). They are informational messages and contain no advertising.

To exercise your rights, contact the business directly. If you contact us (info@henartech.com), we pass your request on to the business without delay and give the business the technical help it needs to answer.

14. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Art. 15),
have inaccurate data corrected (Art. 16),
have your data erased (Art. 17),
restrict processing (Art. 18),
receive your data in a portable format (Art. 20),
object at any time to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21),
withdraw any consent you have given, with effect for the future (Art. 7(3)),
lodge a complaint with a supervisory authority, in particular in the country where you live or work (Art. 77).

Write to info@henartech.com or to our EU representative. We answer within one month, which may be extended by two further months for complex requests; we will tell you if it is. You can view, correct and delete most of your account information yourself in the panel.

Where you are outside the EU, you have the rights your local law grants, and we honour the rights above wherever we reasonably can.

15. Do you have to give us your data?

You are not legally required to give us personal data. Without your name, e-mail address and business details, however, we cannot open an account or provide the Services.

16. Children

The Platform is for businesses; people under 18 may not open an account. If a business's End Users may include children, the business is responsible for the notices and permissions required.

17. Changes

We may update this policy as the Services or the law change. The current version is always on this page; we notify our Customers of significant changes in advance by e-mail or in the panel.

18. Contact

For questions about this policy or your personal data:

Legal name: Henartech Yazılım Ltd. Şti.
MERSIS no. (central registration number): 0461123092500001
Address: Yenişehir Mah. Çevlik Sk. Kurudere Apt. No: 2 İç Kapı No: 9, Merkez/Bingöl, Türkiye
Registered e-mail (KEP): henartechyazilim@hs01.kep.tr
E-mail: info@henartech.com
Website: mesaifix.com