Privacy Policy

This Privacy Policy ("Policy") explains how Cueline AI, operated by DUX BİLİŞİM REKLAM ORGANİZASYON SANAYİ VE TİCARET ANONİM ŞİRKETİ ("Cueline AI", "we", "our", or "us"), processes the personal data of individuals who access or use our website and services (together, the "Services"), or who otherwise engage with us. Cueline AI is an artificial intelligence platform for e-commerce businesses that provides AI customer-service agents across multiple channels, including a Smart Chatbot, a Voice Agent, an Instagram and Messenger AI Assistant, and a WhatsApp AI Assistant. Our agents draw on a merchant's own data, such as product catalog, FAQs, brand voice guidelines, and customer reviews, so they can answer shopper questions and recommend products.

This Policy also explains your rights and choices regarding how we use your personal data, including how you may access or update certain information about you. Where processing is based on consent, and to the extent permitted by law, by using the Services or otherwise engaging with us, you consent to the use of your personal data as described in this Policy. Our primary legal framework is the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). If you are located in other regions, additional rights may apply to you, and we honor those rights where applicable law requires.

1. Definitions and Scope

In this Policy, "personal data" means any information relating to an identified or identifiable individual, such as a person's name, address, telephone number, or email address. In certain jurisdictions this may also be referred to as "personal information."

This Policy applies where Cueline AI acts as a data controller under applicable law, including where we provide the Services directly to individual users and where we operate our own website.

It does not apply where we process personal data on behalf of our merchant customers. When a shopper interacts with an AI agent deployed by a merchant, that merchant determines the purposes and means of the processing and acts as the data controller. In those relationships we act as a data processor, and our handling of personal data is governed by the data processing terms set out in the relevant customer agreement. Shoppers who wish to exercise their rights in respect of such data should contact the merchant in the first instance, and we will support the merchant in responding.

2. Personal Data We Collect

Personal Data You Provide to Us

• Account and contact details. When you set up an account, we may ask for your name, email address, phone number, business or billing address, and your account and contact preferences.
• Merchant configuration data. To set up your AI agents, you may provide content such as your product catalog, FAQs, brand voice guidelines, policy documents, and customer reviews. This content may contain personal data relating to you, your staff, or your customers.
• Order information. Where you enable order status tracking, our agents retrieve order details from your connected e-commerce platform at the moment a shopper asks about an order. We do not import or store your historical order records for training purposes.
• Conversation content. We process the inputs and outputs exchanged through our channels, including messages handled by the Smart Chatbot, the Voice Agent, the Instagram and Messenger AI Assistant, and the WhatsApp AI Assistant, along with any personal data contained in those conversations.
• Feedback and communications. If you contact us, express interest in the Services, subscribe to updates, respond to a survey, or otherwise provide feedback, we collect the personal data you share, such as your name, email address, and the contents of your message and any attachments. When we send you emails, we may track whether you open them to help us improve the Services.
• Payment details. When you register for any paid Service, our payment provider collects and processes payment-related information such as your name, billing address, and card or banking information. We do not store full payment card numbers ourselves.
• Verification information. Where permitted by applicable law, we may ask you to verify your identity or eligibility to use the Services.
• Other information you provide. We may collect other information you choose to share, for example when you use early-access features, attend an event, or otherwise interact with us online or offline.

Personal Data We Collect From You or Your Device

• Location information. We may infer your general location, for example from your internet protocol (IP) address. In some jurisdictions we will ask for your permission before doing so.
• Device information. We receive information about the device and software you use to access the Services, including IP address, browser type, operating system version, device identifiers, and similar technical data.
• Usage information. We receive information about your interactions with the Services, the content you view, the actions you take, the features you use, and the dates and times of your visits.
• Cookies and similar technologies. We and our partners may collect information using cookies, pixel tags, SDKs, and similar technologies. See the "Cookies and Your Choices" section below.

Personal Data We Collect From Third Parties

• Connected platforms. When you connect a channel such as Instagram, Messenger, WhatsApp, or Telegram, or an e-commerce platform such as Shopify, ikas, or Ticimax, we receive information from that platform needed to operate your AI agents. This may include account identifiers, product catalog data, and the messages exchanged with your customers.
• Third-party logins. If you register or log in using a third-party account, we receive personal data such as your name, email address, and profile picture from that provider.
• Service providers. We may receive information from third-party providers authorized to share personal data with us, for example in connection with verification or fraud-prevention checks.

In some cases we need to collect your personal data to provide the Services. If you choose not to provide requested data, you may not be able to use some or all of the Services. Where the provision of personal data is required by law or under a contract, we will tell you and explain the consequences of not providing it.

3. How and Why We Use Personal Data

We process personal data for the purposes described below. Under the KVKK and other applicable laws, our processing relies on grounds such as the performance of a contract with you, compliance with a legal obligation, our legitimate interests (where these are not overridden by your rights), and your consent where required. Where a particular legal ground is not available in your jurisdiction, we rely on consent or another lawful basis.

• Providing the Services. To set up, operate, and maintain your AI agents across the Smart Chatbot, Voice Agent, Instagram and Messenger AI Assistant, WhatsApp AI Assistant, and any other channel you enable, including configuring them with your merchant data so they can answer shopper questions, retrieve order status, and recommend products.
• Personalizing your experience. With your permission, to tailor the Services and suggest content and features that may be of interest to you.
• Communicating with you. To send service updates, respond to your questions, and provide customer support. For prospective users, and where you have consented, to send marketing communications about products or Services that may interest you.
• Billing and accounting. To handle payments to and from you and to keep records of those payments.
• Preventing fraud and abuse. To detect, prevent, and address fraud and other malicious, deceptive, or illegal activity, and to safeguard the security and integrity of our platform.
• Data storage. To store your personal data, including conversation content and merchant data, using the infrastructure providers identified in the "Service Providers We Work With" section.
• Understanding usage. To understand how the Services are used, identify trends, fix errors, and develop new features, including through analytics tools where you have consented to such technologies.
• Aggregated and de-identified data. To generate anonymized or aggregated data that we may use for lawful purposes such as product improvement and research. We will not attempt to re-identify such data unless required by law.
• Administrative and legal matters. To enforce our terms, establish, exercise, or defend legal claims, and respond to lawful requests from public authorities.
• Compliance. To comply with legal obligations to which we are subject, including accounting, tax, and similar requirements.
• Improving the Services. To measure quality, diagnose errors, and improve how our agents perform. For this purpose we rely on aggregated and de-identified operational data, such as response times, resolution rates, and error patterns.

We do not use merchant conversation content to train general-purpose artificial intelligence models, and the providers we work with are contractually prohibited from doing so with the data we send them.

If we intend to use your personal data for a purpose not described here, we will provide notice at the time the data is collected.

Content Moderation

We are not obligated to review all content processed through the Services. However, to maintain security and prevent abuse, we reserve the right to moderate inputs and outputs handled by our agents. In certain circumstances we may share such content, which may include personal data, with providers that support our safety and moderation efforts. Users found to violate our terms may be suspended or terminated.

4. How We Share Personal Data

Your personal data may be shared with:

• Affiliates. Our current or future affiliates, for the purposes described in this Policy.
• Service providers. The infrastructure, artificial intelligence, communications, analytics, and payment providers identified in the following section, who process personal data on our behalf and under our instructions.
• Connected platforms. The messaging and e-commerce platforms you connect to operate your AI agents, where this is necessary to deliver the channel you have configured.
• Other parties at your direction. Third parties with whom you choose to share information through the Services.
• As required by law. Law enforcement agencies, regulatory bodies, and public authorities, or in connection with legal proceedings, where we believe disclosure is required or appropriate to comply with the law or to protect the rights, property, or safety of you, us, or others.
• Corporate transactions. Advisors, potential transaction partners, or other parties in connection with a merger, acquisition, financing, or sale or transfer of all or part of our business or assets.
• With your consent. Other parties where you have given us your consent to share your information.

We do not sell personal data.

5. Service Providers We Work With

This section identifies the third parties that process personal data on our behalf. Several of these transfers are conditional: unless you enable the relevant channel or feature, no data is sent to the provider that supports it.

• Artificial intelligence. We use Google's artificial intelligence services to interpret shopper messages and generate responses. Conversation content and the merchant data your agent relies on are transmitted to Google for this purpose.
• Voice technology. Where the Voice Agent is enabled, we use Vapi to manage voice sessions and ElevenLabs to generate spoken responses. These providers receive the audio of the conversation, its transcription, and the text of the response.
• Telephony. Where you connect a telephone line to the Voice Agent, Twilio provides the underlying telephony infrastructure and receives call metadata, telephone numbers, and call audio.
• Messaging channels. Where you connect Instagram, Messenger, or WhatsApp, Meta Platforms operates the channel and processes the messages exchanged through it. The same applies to Telegram where that channel is available and enabled.
• E-commerce platforms. Where you connect a store, Shopify, ikas, or Ticimax provides us with your product catalog and, where order status tracking is enabled, responds to order queries made by your agent.
• Payments. Stripe processes subscription payments and the billing information associated with them.
• Analytics and advertising on our website. On cueline.ai we use Google Tag Manager to manage measurement tags, Google Analytics 4 to understand how visitors use the site, Google Search Console to monitor search performance, and Google Ads and the Meta Pixel to measure the effectiveness of our advertising. Where consent is required, these tools operate only after you have given it.

These website analytics and advertising tools run on our own website only. Conversation data passing through an agent deployed on a merchant's website is never transmitted to them.

The providers listed above act on our documented instructions and are contractually prohibited from using the personal data we transmit for their own purposes, including the training of their own artificial intelligence models.

We may update this list as our infrastructure changes. Where a change materially affects how personal data is processed, we will update this Policy and revise the "Last updated" date.

6. Voice Conversations and Call Recording

When the Voice Agent is used, the audio of the conversation is converted to text in real time so that a response can be generated. This processing is necessary to deliver the service and takes place for the duration of the call.

Call recording is disabled by default. Recordings are created only where the merchant operating the agent has explicitly enabled that feature. Where it is not enabled, the audio of the conversation is not recorded and not retained.

Where recording is enabled, callers are informed at the start of the conversation that the call is being recorded. The recording is retained for the period configured by the merchant and is deleted automatically at the end of that period. Access is limited to users authorized by the merchant and to the technical personnel required to operate and support the system.

Voice data is never used for identification, authentication, or voice recognition purposes. We therefore do not process voice data as biometric data.

7. Automated Processing

Our AI agents evaluate a visitor's activity on a merchant's website in order to answer questions, start a conversation at an appropriate moment, recommend products, and, where the merchant has configured this, present a discount code. These evaluations are carried out automatically.

This processing does not produce legal effects concerning you or similarly significantly affect you. Nevertheless, under Article 11(g) of the KVKK you have the right to object to a result reached solely through the analysis of your data by automated systems where that result operates to your detriment. You may raise such an objection using the contact details in the "Contact and Requests" section below, and we will review it and respond.

8. International Data Transfers

Several of the providers identified above are established outside Türkiye, and personal data is therefore transferred abroad in the course of providing the Services.

We carry out these transfers in accordance with Article 9 of the KVKK, relying on an adequacy decision where one exists for the destination country, and otherwise on appropriate safeguards such as the standard contractual clauses published by the Personal Data Protection Board, or on your explicit consent where no other basis is available. Where we rely on standard contractual clauses, we notify the Board within the period prescribed by law.

Data-protection laws in the locations where we transfer or process data may differ from those in your area. To request more information about the safeguards we apply, please contact us using the details in the "Contact and Requests" section below.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. When determining the appropriate period, we consider factors such as the nature of the Services provided to you, the length of our relationship, and any mandatory retention periods and limitation periods under applicable law.

Conversation content and, where enabled, call recordings are retained for the period configured by the merchant operating the agent. Where no period has been configured, our default retention period applies. Merchants may shorten this period or disable retention entirely.

If you close your account, the personal data associated with it is deleted or irreversibly anonymized within a reasonable period following closure, except where we are required by law to retain specific records for longer.

When personal data is no longer needed, we delete it or keep it in a form that does not permit identifying you.

10. Cookies and Your Choices

Cookies, pixel tags, SDKs, and similar technologies are used to collect information about users and their activities on a website. We and our partners may use these technologies to collect information including unique identifiers, system information, IP address, browser and device type, the pages you visit, and your interactions with the Services.

We may use both session cookies, which expire when you close your browser, and persistent cookies, which remain on subsequent visits. The cookies we use fall into these categories:

• Strictly necessary cookies. Essential to provide the Services, for example to enable login functionality and to detect automated abuse. These cannot be disabled.
• Performance and analytics cookies. Used to support the operation, maintenance, and improvement of the Services and to understand how you engage with them. These are set by Google Analytics 4 and deployed through Google Tag Manager.
• Targeting and marketing cookies. Used by us and our partners to make advertising more relevant to you and to measure the effectiveness of our promotions. These are set by Google Ads and the Meta Pixel.

We ask for your consent before placing cookies that are not strictly necessary, and you may withdraw that consent at any time through the cookie settings available on our website. You can also manage cookies through your browser settings, including refusing or deleting cookies, although blocking all cookies may impair your use of the Services. Where you use a recognized opt-out preference signal in your browser or device, we will honor it as a request to opt out of targeting and marketing cookies.

11. Your Rights

Subject to applicable law, including Article 11 of the KVKK, you have rights regarding the personal data we hold about you. If you are located in other regions, additional or differing rights may apply. These rights may include the right to:

• Learn whether your personal data is being processed and, if so, to request information about that processing.
• Access your personal data and obtain related information such as the purposes of processing and the recipients of your data.
• Correct inaccurate or incomplete personal data, and to request that any correction be notified to third parties to whom the data has been transferred.
• Delete your account and the personal data we maintain about you, where permitted by law, and to request that the deletion be notified to third parties to whom the data has been transferred.
• Object to or restrict the processing of your personal data in certain circumstances.
• Object to a result reached solely through automated analysis of your data where that result operates to your detriment.
• Claim compensation for damage arising from the unlawful processing of your personal data.
• Request portability of your personal data to another organization where technically feasible.
• Withdraw consent at any time where our processing is based on consent. This does not affect the lawfulness of processing carried out before the withdrawal.
• Unsubscribe from marketing communications at any time by following the instructions in our emails. You may still receive administrative messages about the Services.

To exercise any of these rights, please contact us using the details in the "Contact and Requests" section below, noting the right you wish to exercise and your location. Before acting on your request, we may ask for information to verify your identity. We respond to requests within thirty days at the latest. Applicable law may provide exceptions and limitations to these rights. You also have the right to lodge a complaint with the competent supervisory authority, which in Türkiye is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

Where the data in question was collected through an agent operated by one of our merchant customers, that merchant is the data controller and we will direct your request to them.

12. Data Breach Notification

If we determine that personal data we hold has been unlawfully obtained by others, we will notify the Personal Data Protection Board within seventy-two hours of becoming aware of the incident, and we will inform affected individuals as soon as reasonably possible once they can be identified, using appropriate means of communication.

We maintain records of any such incident, including its scope, its effects, and the measures taken in response.

13. Third-Party Links

The Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties, and this Policy does not apply to them. We encourage you to review their privacy policies before providing any information to them.

14. Security

We implement technical and organizational measures appropriate to the risk in order to protect your personal data. These include encryption of data in transit and at rest, access controls that limit access to personnel who require it to perform their duties, logging of administrative activity, and periodic review of our security practices.

Because no method of electronic transmission or storage is completely secure, we cannot guarantee absolute security, to the extent permitted by applicable law.

15. Children's Privacy

The Services are not intended for or directed at children, and we do not knowingly collect personal data from children. If you are under the age required to provide consent in your jurisdiction, you should not submit personal data to us. If we become aware that we have inadvertently collected personal data from a child, we will delete it from our records.

16. Changes to This Policy

We may update this Policy from time to time. If we make significant changes, we will notify you as required by applicable law and update the "Last updated" date above.

17. Contact and Requests

For any questions about this Policy or our processing of your personal data, or to exercise your rights, please contact us using the details below.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit a request:

• in writing to the address above, bearing your wet signature;
• through a registered electronic mail (KEP) address;
• using a secure electronic signature or mobile signature;
• from an email address you have previously notified to us and which is registered in our systems.

Your request should include your name, your contact details, and a description of what you are asking for. We will respond within thirty days at the latest.

If your request is refused, if you find our response insufficient, or if we do not respond within the statutory period, you may file a complaint with the Personal Data Protection Board.