Legal

Privacy Policy

At Orbitix, we value your privacy. This policy explains how your data is collected and processed when you use our site and services.

Last updated: 19 October 2026

Translation notice. This page is an English translation provided for convenience. The legally binding text is the Turkish original published at orbitix.tr/gizlilik. In the event of any discrepancy between the two, the Turkish version prevails. These terms are governed by the laws of the Republic of Türkiye.

1. Information we collect

As Orbitix (a brand of Alfred Agency), we collect only the information necessary to provide our services and to prepare a demo tailored to you:

  • Contact and brand information: Name, phone, email, company name and sector — information you share through site forms, chat with our AI assistant (Orbi), or WhatsApp.
  • Usage information: Basic technical data about how you use the site, and cookies.
  • Message data processed on behalf of businesses: messages received on the Facebook, Instagram and WhatsApp accounts that businesses using Orbitix connect — see section 9.

2. What do we use the information for?

We process the information we collect for the following purposes: preparing and delivering a demo tailored to you, responding to your requests and questions, providing and improving our services, and fulfilling our legal obligations. We do not sell your information and do not use it for marketing without permission.

3. Cookies

Our site uses a limited number of cookies for basic functionality and performance. You can reject or delete cookies in your browser settings; in that case some features may work in a limited way. Where possible, we take care to keep the most privacy-friendly option as the default.

4. Third parties and subprocessors

We work with the following providers to deliver the service. Each accesses only the data it needs for its task, under its own privacy and data processing terms. We do not sell your data.

  • GNET / Güzel Hosting (Türkiye): the Orbitix application server and database — API, business panels and message records. Permanent records are stored here.
  • OVH (France, via Güzel Hosting): hosting of the orbitix.tr website and the encrypted off-site backup of the database.
  • Cloudflare: security and authentication layer that protects access to the Orbitix team's internal admin tools. Traffic of the business panels and the API does not pass through Cloudflare.
  • Meta Platforms (WhatsApp, Facebook, Instagram): receiving and sending messages.
  • Google (Gemini): AI replies and reply drafts. To generate a reply, the relevant conversation text is sent to the Gemini API. Gemini is used under the paid API service terms; under these terms Google does not use the submitted content to improve its products.
  • Anthropic (Claude, USA): AI assistant used by the Orbitix team for internal operations, software development and support. Message content from Facebook, Instagram and WhatsApp connections, the identifiers of the people messaging, and access tokens are not sent to Anthropic.
  • Meta and Google advertising services: Orbitix's own promotion and ad management that businesses request for themselves. Message data processed on behalf of businesses is not used for advertising (see section 9).

5. Google account data and Google Calendar

Businesses may optionally connect Orbitix to their own Google Calendar account. When this connection is made, only the calendar.events permission is requested through Google's consent screen.

  • What we do: When our AI assistant agrees on an appointment or meeting time, we create this event in the business's own calendar and update it when necessary.
  • What we do not do: We do not read, modify or delete events created by other applications. We do not access calendar settings or sharing permissions. We do not sell or transfer calendar data to third parties, do not use it for advertising, and do not use it to train AI models.
  • Storage: Google authorization tokens (refresh and access tokens) are stored on our server in a separate record for each business and encrypted at the application layer; the encryption key is stored separately from the database.
  • Deletion: The business can disconnect at any time from the Settings screen in its panel; when disconnected, the authorization key is immediately deleted from our system. You can also revoke the permission on the Google Account permissions page.

Orbitix's use and transfer to others of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

6. Retention periods and security

We keep your information only for as long as appropriate for the purpose. Expired records are deleted by an automatic clean-up that runs every day:

  • WhatsApp message records: at most 12 months.
  • Facebook and Instagram direct messages and comments: at most 12 months.
  • Records deleted in a business panel: kept restorable for 90 days to protect against accidental deletion, then permanently deleted.
  • Access tokens: for as long as the connection exists; deleted immediately when the connection is removed or the app is uninstalled.
  • Connection records (no tokens): the record of which Page and account were connected is kept for at most 12 months after the connection ends, then deleted automatically.
  • Encrypted off-site backups: at most 14 days; older backups are deleted automatically. Deleted data also leaves the backups within this period.
  • Account and contact information: for as long as the service relationship lasts; deleted within 30 days of a deletion request.
  • Invoices and payment records: for the period required by law.

Security measures: All connections are encrypted with HTTPS. Meta and Google access tokens are stored encrypted at the application layer in the database; the encryption key is kept separately from the database. Off-site backups are encrypted with AES-256 and transferred over an encrypted (HTTPS) connection. Server access is limited to authorized team members and requires authentication. Each business's data is bound to its own workspace; one business cannot access another business's data. Although no system is 100% secure, we continuously take measures to minimize risks.

7. Summary of your rights

You have the right to access, correct and delete your personal data and to object to its processing. For details on these rights and how to apply, you can see our KVKK Disclosure Notice page or contact us. If you want your data to be deleted, you can use our data deletion request page.

8. Information shared with the AI assistant (Orbi)

The information you share in your chat with Orbi, the AI assistant on our website (name, contact, request details), is used only to prepare a demo tailored to you and to respond to your request. We recommend that you do not enter sensitive information (passwords, card details, ID numbers, etc.) in the chat.

9. Facebook, Instagram and WhatsApp data

a) Orbitix's own accounts. Direct messages you send to our Facebook Page or Instagram account, comments on our posts and messages to our WhatsApp line are processed only to reply to you and follow up on your request. This content is not used for ad targeting, is not shared with third parties and is not sold. On Orbitix's own channels, replies may be sent automatically by our AI assistant. To stop messaging, just write "dur" ("stop"); your record is permanently placed on the do-not-contact list.

b) Processing on behalf of businesses. Businesses that use Orbitix connect their own Facebook Pages, Instagram professional accounts and WhatsApp Business numbers themselves through Facebook Login for Business. For this processing the business is the data controller; Orbitix is the data processor acting on behalf of the business and on its instructions. We do not access accounts that have not been connected.

  • Data processed: the content of messages received by and sent from the connected accounts; the page- or account-scoped ID of the person messaging (PSID / IGSID) or their WhatsApp number; profile information shared by Meta (such as name, username and profile picture); message time and delivery status; the access tokens issued by Meta for the connection and the IDs of the connected accounts.
  • Purpose: only to show the messages in that business's unified inbox, to prepare reply drafts with AI, and to send the reply that a business user has approved.
  • Human approval: AI only prepares drafts. No message is sent unless a business user has reviewed the draft and explicitly approved it.
  • Isolation: Each business's messages, contacts and access tokens are bound only to its own workspace; one business cannot see another business's data. Access tokens are stored encrypted at the application layer.
  • What we do not do: We do not use this data for advertising or targeting; we do not sell or rent it; we do not share it with other businesses or data brokers; we do not use it to train AI models; and we do not send it to Anthropic. The data is shared only with the subprocessors listed in section 4, to the extent the service requires.
  • Retention: messages and comments are kept for at most 12 months, then deleted automatically.
  • Disconnecting: A business can disconnect from the Orbitix panel, or by removing Orbitix under business integrations in its Facebook/Instagram settings. When disconnected, the access tokens are deleted immediately; no new messages are received and nothing is sent. When a data deletion request arrives through Meta, the tokens and connection details of that connection are deleted immediately, and the messages and comments obtained through that connection within 30 days at most. The status of the request can be checked on our data deletion page with the confirmation code Meta gives you.
  • Rights of people who message a business: If you have messaged a business, you can first direct requests about your data to that business. You can also write to us directly; we will forward your request to the business concerned and help fulfil it.

c) WhatsApp assistant service. On the WhatsApp lines of some businesses that additionally use Orbitix's WhatsApp assistant service, the AI assistant may reply automatically within the framework set by the business; a business user can take over any conversation and turn the assistant off for that person. This automatic reply is not used on accounts connected through Facebook Login for Business; the approval rule in (b) applies there.

You can request deletion of your data from our data deletion request page or at info@orbitix.tr.

10. International data transfer

Permanent records are stored on our server in Türkiye. The following transfers take place to the extent the service requires:

  • France (EU): website hosting and encrypted off-site backup (OVH).
  • Google (Gemini): conversation text sent to generate a reply may be processed in any country where Google has facilities.
  • Meta: messages are received and sent through Meta's infrastructure.
  • Cloudflare: access to internal admin tools passes through Cloudflare's global network.
  • Anthropic (USA): internal operations only; message content processed on behalf of businesses is not transferred.

Transfers abroad take place only to the extent necessary to provide the service and within the safeguards required by the KVKK provisions on cross-border transfer and other applicable legislation.

11. Children's privacy

Our services are aimed at businesses and are not directed at persons under 18. We do not knowingly collect personal data belonging to children.

12. Changes to the policy

This Privacy Policy may be updated from time to time. The current version is always published on this page; for significant changes we take care to provide appropriate notice. The most up-to-date version of the page is valid as of the update date stated on it.

13. Contact

Data controller: Murat Cem Karaboğa (sole proprietorship), Türkiye. For any question, request or objection about privacy, you can reach us through our contact page or at info@orbitix.tr. We will get back to you as soon as possible.

Last updated: 19 October 2026

← Back to home

System Login

Enter the brand code you were given and we'll direct you to your CRM.

Don't have a code? Request a demo →