Skip to content
Asistone

Legal documents

Privacy Policy

Last updated: October 18, 2026

Download document

Company: ASİSTONE YAZILIM VE TEKNOLOJİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ Address: Kınıklı Mah. Hüseyin Yılmaz Cad. Pamukkale Üniversitesi No:67/2, 20160 Pamukkale/Denizli, Türkiye MERSİS: 0086175105600001 Tax office / tax ID (VKN): Pamukkale Vergi Dairesi / 0861751056 Phone: 0538 701 94 10 Privacy/request contact: [email protected]

This policy describes personal-data processing on Asistone's website and SaaS service. Asistone is a software service that gives e-commerce businesses ERP, CRM, and AI features in one place. Depending on the selected package, the service covers: ERP modules such as orders, products and stock, current accounts, cash and bank, expenses, and reporting; order, stock, and invoice integration with marketplaces and e-commerce platforms such as Trendyol, Hepsiburada, and Shopify; issuing e-Fatura and e-Arşiv invoices and viewing and answering incoming e-invoices through an e-document integration; cargo integration; retrieving the exchange rates published by the Central Bank of the Republic of Türkiye; a unified inbox, leads, and support tickets for WhatsApp Business (including WhatsApp Business App Coexistence), Instagram DM, Facebook Pages, and Messenger; optional AI reply drafts, automatic replies, and a knowledge base; and Shopify order flows for card or cash-on-delivery payment after the buyer's explicit confirmation.

Roles and data

A registration checkbox acknowledging the privacy notice records notice delivery/receipt only; it is not explicit consent. Service Terms, AI notice, Acceptable Use Policy, and any optional permissions are separate.

Asistone is controller for its own account, website, meeting-request, sales, support, security, and contract operations. This includes organization administrators' and users' name/contact details, login/account identifiers, role, permission, and subscription data, subscription payment and billing records, support requests, meeting request form details, and commercial-message consent records. Login may use the configured identity provider (such as Auth0 or an enabled enterprise federation); identifiers and authentication information needed for sign-in/access may be processed by that provider.

The business customer determines purposes and essential means for the personal data it enters into the service or brings in from the accounts it connects, and is controller to that extent; Asistone processes that data on the organization's instructions as processor. This includes buyer, billing, and delivery details in marketplace and e-commerce orders (name, address, phone, email, tax office, tax identification or Turkish national identity number); recipient and sender details in e-Fatura and e-Arşiv documents; order, product, invoice, cargo tracking, and payment details; identity, contact, address, and bank account details of customers and suppliers in current accounts, and uploaded documents; employee details in cash and expense records; WhatsApp, Instagram, Facebook Pages, and Messenger messages, sender/recipient and channel identifiers, attachments, and voice messages; leads and support tickets; and knowledge-base content and AI reply context. No single global consent by an employee or account owner is presumed to cover all end users.

  • Account setup, login, service delivery, and organization-account administration: Article 5(2)(c) of KVKK where necessary for a contract to which the data subject is party; Article 5(2)(f) for account security and authorized access only where a documented legitimate-interest balancing assessment shows no overriding impact on fundamental rights.
  • Subscription, payments, invoices, and accounting records: Article 5(2)(c) as needed for the service/contract; Article 5(2)(ç) to the extent retention is required by law. Subscription payments are collected through a licensed payment institution.
  • Meeting request form: name, phone, and email, plus optionally company name, sales channels, monthly order volume, package of interest, and an added note, are used to answer the request, contact the requester, and perform requested pre-contract steps under Article 5(2)(c) where applicable to the requester; for business-contact cases where that ground does not apply, Article 5(2)(f) is used only if necessity and balancing requirements are met. These details are not used for promotional messages unless the separate commercial-message consent below is given.
  • Protecting the meeting request form against abuse: when the form is submitted, your IP address, email address, and phone number are hashed with a secret key (HMAC-SHA256) and are not stored in clear text. The hashes are used only to limit the number of submissions and to drop repeated requests; they are kept in server memory for at most 24 hours and are not written to a database or to logs. The basis is the legitimate interest in the security of the form and the service (Article 5(2)(f)); processing is limited so that it does not harm your fundamental rights and freedoms.
  • Optional commercial-message consent: if you also tick the box “Asistone'dan duyuru ve kampanya iletileri almak istiyorum.” (“I would like to receive announcements and campaign messages from Asistone.”) on the meeting request form, your wish to receive Asistone announcements and campaign messages by email at the email address and by text message (SMS) or voice call at the phone number you entered on the form is recorded. Your choice (yes/no), the version of the notice you read, and the submission time are sent and kept with your request. The box is not pre-ticked and the form can be sent without it. The basis is your consent under Turkish Law No. 6563 and your explicit consent under Article 5(1) of KVKK. You can withdraw at any time, free of charge, through the opt-out method in a message or by writing to [email protected]. Details are on the Marketing Communications Permission page.
  • Optional Google Analytics: analytics cookies/storage and event data are processed for measurement and site improvement only after the visitor opts in; the basis is consent under Article 5(1). Refusal does not block basic site access; the choice can be changed.
  • Customer ERP and CRM data: processed on the customer's instructions for service purposes determined by that organization, such as order and stock management, issuing e-documents, cargo, current-account, cash, and expense records, reporting, customer communication, and support. The organization determines the legal ground, notices to end users and buyers, messaging permission, and the basis for e-document and order processing for its own activity. Enabling AI or automatic replies is a product setting, not by itself explicit consent or marketing permission.
  • Legal duties and security: Article 5(2)(ç) for the relevant statutory duty or Article 5(2)(f) only where the balancing requirements are met.

If a processing activity is determined to require explicit consent, the purpose, data, and recipients are disclosed and a free optional choice is requested separately from contract terms and the privacy notice.

Website communications and providers

The information entered in the meeting request form, your commercial-message choice, and the version of the notice you read are sent through the email delivery service Resend to the authorized Asistone team at [email protected]. Through the same service, a confirmation that your request was received may be sent to the email address you entered; it lists only the package, sales channels, and monthly order volume you chose and does not contain your name, company name, or note. Use [email protected] for commercial inquiries and for privacy/data requests.

Google Analytics loads only after an affirmative analytics choice. The website and the SaaS service run on servers managed by Asistone and rented from infrastructure providers in data centers in Europe (currently Germany and Finland); the databases and e-document files are also on these servers. A network security, content delivery, and file storage service is used for traffic to the website and the portal and for files such as message attachments, knowledge-base files, and uploaded documents.

Depending on the selected package and the integrations the customer connects, the SaaS service shares personal data with these recipient groups:

  • Marketplaces and e-commerce platforms (such as Trendyol, Hepsiburada, and Shopify, as connected by the customer): order, stock, invoice, and cargo information is received from and sent to these platforms as the integration requires.
  • E-document provider (a private integrator authorized by the Turkish Revenue Administration): recipient and sender details in an e-Fatura or e-Arşiv document (name/title, address, tax identification or Turkish national identity number, contact details) and the document content are sent to issue, deliver, display, and store the document.
  • Cargo company: the shipment details needed to obtain a shipment barcode and label through the cargo account the customer connects (for example the order tracking or reference number) are sent.
  • Meta (WhatsApp, Instagram, Facebook Pages, and Messenger): to receive and send messages.
  • OpenAI: when AI reply drafts, automatic replies, or the knowledge base are enabled, the conversation history and images, voice messages, knowledge-base content, and tool results (such as Shopify product and order information) needed to generate a reply are sent to the OpenAI API. The numeric representations (embeddings) used for knowledge-base search are also generated with OpenAI and stored in Asistone's own database.
  • Email delivery service (Resend): for meeting requests, confirmations, and service notifications.
  • Identity provider (Auth0/Okta): for sign-in and access.
  • Payment institution: for subscription payments.
  • Google Analytics: only when analytics is accepted on the website.
  • Hosting, network security, and file storage providers: for the servers, traffic, and files described above.

Because the data centers that host our servers and the servers of providers such as Meta, OpenAI, Resend, Auth0/Okta, Google, Shopify, and the network security and file storage provider are outside Türkiye, personal data is transferred abroad; the transfer is subject to the conditions and safeguards applicable under Article 9 of KVKK.

Retention and rights

Account data and the customer organization's ERP and CRM records (including shared company conversations) are retained while the organization/subscription account remains active. Removing an employee's account does not erase shared conversations and records. Deletion requests are assessed against their scope, organization instructions, legal retention duties, and third-party rights; no automatic or irreversible deletion within a fixed number of days is guaranteed.

E-Fatura and e-Arşiv documents are kept for 10 years under tax law by the e-document provider Asistone works with. The duty to keep these documents lies with the customer organization as the taxpayer and with the private integrator that provides the storage service on its behalf; Asistone does not assume a separate legal retention duty for them. Asistone keeps the document records the service needs (document number, ETTN, status, amounts, recipient details, and the document's XML file) for as long as the organization's other ERP records and does not keep a separate archive copy beyond that; the document view is opened from the e-document provider when needed.

Meeting requests are kept for two years after the last contact; if the request leads to a contract, the retention period for contract records applies. Commercial-message consent records are kept while the consent is valid and for three years after it is withdrawn or otherwise stops being valid; other records of commercial electronic messages sent are kept for three years from the date of the record (Article 13(2) of the Turkish Regulation on Commercial Communication and Commercial Electronic Messages). The hashes used for abuse protection are kept for at most 24 hours. The email delivery service's own technical delivery logs are subject to that provider's retention period.

KVKK Article 11 requests may be sent to [email protected]. Contact Asistone for records where it is controller, and the relevant business first for end-user, buyer, and customer records processed for that organization. Official sources: KVKK Law (opens in a new tab), Deletion/Destruction Regulation (opens in a new tab).

Requests properly submitted under the Turkish Personal Data Protection Law are answered as soon as the nature of the request allows and within 30 days at the latest. Accepted erasure or destruction requests are fulfilled within the procedures and deadlines required by applicable law; responding to a request does not itself establish that destruction across all systems has been completed.