Privacy Policy

Last updated: 4 October 2026

This is a convenience translation. The Turkish version is the authoritative text and prevails in case of any discrepancy.

1. Data controller

This notice is given under article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") by the data controller of the suyla.ai service (the "Service"): RECETE LTD, company number 17082027, address 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. Requests and questions about personal data: [email protected].

2. Whose data, in which role

a) Business users (owner, admin, operator): for this data Suyla is the controller. We process name, e-mail, phone (including the notification number), business details, role, sign-in and verification records, IP and device data, contract acceptance records, billing and support correspondence, and audit records. Card details are not stored by Suyla; payments are handled by Stripe.

b) Businesses' customers: the Service processes the messages, appointments, notes and documents of a business's WhatsApp line on the business's behalf. For this data the business is the controller and Suyla the processor. Customers contact the business through its own notice and request channel; Suyla gives the business the tools (export, permanent deletion) to answer them.

3. Purposes and legal bases (business users)

None of this processing relies on explicit consent.

4. Transfers and sub-processors

Data is transferred only for the purposes above and only as needed, to the providers below. Transfers abroad rely on standard contracts under KVKK article 9, not on consent. Data goes to public authorities only where the law requires it.

5. Google Calendar integration and Google user data

Businesses may connect a Google Calendar account to the Service (Settings → Calendar). This is entirely optional; every other feature works without it.

Scopes we request and why:

• calendar.events — to read busy times in the business's calendar (so the assistant does not book an occupied slot) and to write appointments made through the Service as events, deleting them on cancellation. A written event carries only the customer's name, the service name, the time and the staff member's name; no phone number and no appointment notes.
• userinfo.email — only the e-mail address, to show which Google account is connected.

What we do not do: we do not use calendar data for advertising, sell or transfer it to third parties, or use it to train AI models. No person reads your events. From the calendar we store only start–end times and the event title; attendees, descriptions and attachments are not stored.

Limited Use disclosure: suyla.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting: one click in Settings → Calendar disconnects the account, deleting your access and refresh tokens and the busy-time records we hold. You can also remove access on the Google Account permissions page.

6. How data is collected

Through the sign-up form, use of the panel, and the Service's automatic records (sign-in, IP, audit log), electronically.

7. Retention

When you delete your account, the data of your business and its customers is permanently deleted and leaves the backups within 30 days. Contract acceptance records are kept, separated from your identity, as legal evidence.

8. Your rights (KVKK art. 11)

Under KVKK article 11 you may: (a) learn whether your personal data is processed, (b) request information about it, (c) learn the purpose and whether it is used accordingly, (ç) know the third parties it is transferred to in Turkey or abroad, (d) request correction of incomplete or inaccurate data, (e) request deletion or destruction under article 7, (f) request that third parties be notified of (d) and (e), (g) object to an adverse outcome resulting solely from automated analysis, and (ğ) claim compensation for damage from unlawful processing.

Send requests to [email protected]; they are answered free of charge within 30 days. If a request is refused, the answer is insufficient or no answer is given in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the request (KVKK art. 14). You can download your account data or delete the account in Settings → Account.

9. Cookies

The Service uses no advertising or tracking cookies. Cookies used: sb-…-auth-token (session; required to stay signed in) and suyla_theme (your light/dark preference; remembers only that).