Live chat and KVKK: customer conversations are personal data

The questions people ask when choosing live chat software are usually these: how many agents, what does it cost, does it connect to WhatsApp. The question that rarely comes up is the one that can cost the most: where are these conversations stored, and who can reach them?

A chat transcript looks harmless. But it contains full names, phone numbers, delivery addresses, order numbers and sometimes billing details. Occasionally a sentence about someone's health. All of it is personal data under Turkey's KVKK (Law No. 6698), and some of it is data in a special category.

This article isn't legal advice. Its purpose is to show which questions to ask when picking software. Work with a lawyer on your own privacy notice and data inventory.

Who is who in this relationship

Briefly: the business talking to its customers is the data controller. The software vendor storing the conversations is normally the data processor.

In practice that means: when there's a breach, the party answerable to the authority and to the individuals is you, not the company that sold you the software. The diligence you show in choosing a vendor is part of your own obligation.

Five questions to ask

1. Where is the data stored?

If the servers are abroad, you're transferring data across borders, and that has its own rules. Hosting inside Turkey removes the question entirely, which is why it's the simplest answer.

The question isn't "is it cloud?" but "which country is the data physically in?" The answer belongs in the contract.

2. Can another customer see my data?

In multi-tenant systems, every customer's data sits in the same database. If the separation is only a WHERE clause in application code, a single mistake in that code is enough for one customer to read another's conversations.

The question to ask: which layer enforces isolation? With row-level security at the database, the database returns nothing even when the application asks the wrong question. Lunachat's isolation is built on PostgreSQL row-level security and verified by an automated test on every release.

3. How long is data kept?

KVKK requires not keeping data longer than its purpose needs. "We keep everything forever" isn't a feature, it's exposure.

Two things are needed in practice: a decision about retention, and records that actually get deleted when it expires. You also need a way to honour "delete my data" when a customer asks.

4. How do you meet the disclosure obligation?

If you ask visitors for a name and email before the chat starts, that's collection, and it requires a privacy notice. Concretely: a link to your notice next to the pre-chat form.

Marketing consent is a separate matter. Using a support email address for campaigns is a different purpose and needs its own consent.

5. Who can access it, and is there a trail?

If it's unclear which team members saw which conversation, you can't answer questions when something goes wrong. Role separation (admin and agent), conversation ownership and an event log serve compliance as much as they serve day-to-day operations.

WhatsApp's particular wrinkle

When you connect WhatsApp conversations to an inbox, messages pass through Meta's infrastructure before landing in your system. So there are two parties: Meta, and your software.

The practical point is that the copy on your side is subject to the same rules. And one technical detail: how the inbox stores your WhatsApp session credentials matters. Kept in plain text, anyone who reaches the server can send messages as your number. It's a secret and it should be encrypted at rest.

What to look for in the contract

• The country and data centre where data lives.
• A list of sub-processors the vendor relies on.
• The notification window in case of a breach.
• Return and deletion of data when the service ends.
• Retention periods and how deletion requests are handled.

These clauses are standard in a data processing agreement. A vendor who can't produce one is telling you something.

Where Lunachat stands

Short version: data is stored on a server in Turkey, workspaces are separated at the database level, WhatsApp session credentials are encrypted with AES-256-GCM, and all traffic runs over TLS. The details are in the security section of the features page.

If you have a question, get in touch and we can share the agreement.