KVKK Data Protection Notice
Prepared under article 10 of Turkish Law no. 6698 on the Protection of Personal Data.
Last updated: 24 August 2026
This is an English translation provided for convenience. The binding text is the Turkish version — KVKK Aydınlatma Metni — and in case of any discrepancy the Turkish version prevails. These documents are governed by Turkish law. This translation is based on the Turkish text dated 24 August 2026.
1. Who this notice concerns
Lunachat acts in two different capacities in two different relationships. Which section concerns you depends on that:
- If you are a Lunachat customer (the business that opens an account, and its team): for that data Lunachat is the data controller.
- If you are a visitor using the chat box on a business's website: for that data the data controller is the business that placed the chat box on its site. Lunachat is only the data processor, hosting the data on that business's behalf and on its instructions. Requests about your data must first be made to the business you were messaging; Lunachat fulfils such requests on their behalf.
2. Identity of the data controller
| Legal name | Adra Yazılım Ltd. Şti. |
| Address | Alacaatlı Mah. 4997. Sok. No: 4/C9 Çankaya/Ankara |
| Tax number | 0081975396 |
| kvkk@lunachat.co |
3. Personal data processed
3.1. Account holder and team members
- Full name, email address
- An irreversible digest of your password — the password itself is not stored
- Role and availability within the workspace
- If you choose to sign in with Google, the account identifier, name, email and profile picture address Google provides
- Records of sign-in attempts: time of the event and IP address (for account security)
- Panel usage records: which screen was opened, the user and workspace identifiers, role and plan. The screen name is sent with identifiers stripped — conversation and contact identifiers, message content, names and email addresses do not enter this record
3.2. Visitors using the chat box
- Message content and the files you send
- IP address
- The city and country derived from that IP address — no street-level location is determined
- Device type and browser
- The address of the page you are on, the source you arrived from (referrer) and the last 50 pages you visited in that session
- If the business asks and you provide it: name, email, phone and any additional fields the business defines (e.g. order number)
- A visitor key held in your browser's local storage — it keeps the conversation from disappearing when you reload the page
3.3. WhatsApp connection
If a business connects its WhatsApp account by QR code, the messages sent and received on that line and the other party's phone number are also processed. The connection session is stored encrypted with AES-256-GCM.
4. Purposes of processing and legal grounds
| Purpose | Legal ground (KVKK art. 5) |
|---|---|
| Providing the chat service, transmitting and storing messages | Necessary for the conclusion and performance of a contract |
| Account creation, sign-in, team management | Performance of a contract |
| Preventing abuse, detecting spam and attacks (IP records, rate limiting, sign-in attempt records) | Legitimate interest of the data controller — keeping the service up and secure |
| Showing the agent which page the visitor is writing from and their approximate location | Legitimate interest — understanding and answering the request correctly |
| Sending the chat transcript by email | Explicit consent — only if you provided your email address |
| Measurement on lunachat.co (Google Analytics, Mixpanel) | Explicit consent — only if you allowed it in the cookie banner. You can withdraw that consent at any time from the Cookie Settings link in the footer. |
| Measurement of the app.lunachat.co sign-in and sign-up screens (Google Analytics only) | Legitimate interest — knowing which channel the service grows through. No cookie consent is asked on those two screens. You can block it in your browser settings or with Google's opt-out add-on. |
| Measuring panel usage and improving the product (Mixpanel) — which screens are used, which feature is never touched | Legitimate interest — improving the product. Screen names are sent with identifiers stripped; conversation and contact identifiers, message content, names and email addresses do not enter this measurement. |
| Legal retention and providing information to competent authorities on request | Legal obligation |
5. Method of collection
Data is collected electronically, both from information you provide directly (messages, forms) and automatically by technical means (IP, browser information, page address).
6. Who data is transferred to
Your data is not sold and is not shared with third parties for advertising. The providers used for the service to function:
| Provider | What for | Where |
|---|---|---|
| Netinternet | Server and database hosting | Türkiye |
| Cloudflare | Traffic routing, attack protection | Abroad |
| Brevo | Sending notification and transcript emails | Abroad (EU) |
| Authentication, only if sign-in with Google is chosen | Abroad | |
| Google Analytics | On lunachat.co: only if allowed in the cookie banner. If it is not allowed the script never loads and no data reaches Google Analytics. On the app.lunachat.co sign-in and sign-up screens: without asking, on legitimate interest grounds (section 4 above). | Abroad |
| Mixpanel | Visitor measurement on lunachat.co, only if allowed in the cookie banner: which pages are viewed, which buttons are pressed and how far down the page is read. If it is not allowed the script never loads and no data reaches Mixpanel. On app.lunachat.co it measures panel usage under legitimate interest (section 4 above): screen names with identifiers stripped, user and workspace identifiers, role and plan. Conversation and contact identifiers, message content, names and email addresses are not sent. | Abroad (USA) |
| Meta (WhatsApp) | Message delivery, only if the business connects a WhatsApp line | Abroad |
| Apple | Notification delivery, only if the iOS app is used. So that a notification can be read from the lock screen, it carries the sender's name and the message text, and that content passes through Apple's notification servers. Nothing reaches Apple if the app is not used. | Abroad |
The database is in Türkiye. Your messages, contact records and files are kept on a server in Denizli. The transfers abroad listed above are limited to data passing through those services or to the processing specific to them.
City and country are resolved from the IP address on our own server, using a local database; your IP address is not sent to any external service for that purpose.
7. Retention period
Data is retained for as long as your account is open and the service relationship continues. When a contact record is deleted, that person's visitor sessions, IP record and location information are deleted with it. When a workspace is closed, all data belonging to it is deleted.
Panel sessions expire after 30 days and the visitor key after 90 days.
8. Your rights
Under article 11 of the KVKK you may:
- Learn whether your personal data is being processed
- Request information if it has been processed
- Learn the purpose of processing and whether the data is used in line with that purpose
- Know the third parties in Türkiye or abroad to whom it has been transferred
- Request correction if it has been processed incompletely or incorrectly
- Request its erasure or destruction
- Request that correction and erasure be notified to the third parties the data was transferred to
- Object to a result against you arising from analysis solely by automated systems
- Claim compensation for damage suffered as a result of unlawful processing
You may send your requests from our contact page or directly to kvkk@lunachat.co. Applications are concluded within 30 days at the latest.
For data you shared through the chat box on a business's website, you must direct your application to that business (see section 1). If you contact us, we will point you to the right party.
9. Changes
This notice is updated when the service or the legislation changes. The current version is always published on this page, with the update date shown at the top.