Legal

Data protection

Written for the person in your team who has to answer for this — with the facts they will be asked for.

Last updated: 11 September 2026

Draft. This document describes accurately how Estacell works today, but it has not yet been reviewed by a lawyer. If you need a signed data processing agreement or a version your compliance team can rely on, write to [email protected] and we will provide one.

Which law applies

Kirpisoft is established in Türkiye, so Turkish Law No. 6698 (KVKK) applies. If you are in the EU or the UK, GDPR obligations may apply to you as the controller, and we act as your processor.

Roles, in one table

  • Your account data — Kirpisoft is the controller.
  • Your customers’ data in your panel — you are the controller, Kirpisoft is the processor. We process it only on your instructions.

This means requests from your customers go to you. If one reaches us, we forward it to you rather than acting on it ourselves.

Sub-processors

These are the only third parties that can touch data in your panel, and only for the function named:

  • NetGSM (Türkiye) — call events, recordings, SMS.
  • Meta (Ireland/US) — only if you connect WhatsApp, Instagram or Messenger.
  • TikTok, Telegram — only if you connect those channels.
  • OpenAI (US) — only if AI summaries are enabled; the transcript is sent for summarising. Switch it off and nothing is sent.
  • Hostinger — server hosting, in Türkiye.

We will tell you before adding a new sub-processor that can reach panel data.

Special categories

Health data, and other special categories, carry stricter obligations. Estacell does not ask for them and does not have fields designed for them — but a clinic could type them into a note.

If that is your situation, decide deliberately what goes into the panel, and write to us so we can put a proper data processing agreement in place first.

Security measures

  • A separate database per company — not a shared table.
  • Passwords stored as bcrypt hashes, never readable.
  • Secrets such as channel tokens encrypted with AES-256-GCM, with the key held outside the database so a database backup alone cannot reveal them.
  • Encrypted transport (TLS) throughout.
  • Role-based access inside each company, and an audit log of administrative actions.
  • Regular backups.

Retention and deletion

Data stays while the account is open. When a subscription ends the panel becomes read-only and data is kept at least 30 days. There is no automatic deletion. Erasure happens when you ask for it, and we confirm before doing it because it cannot be reversed.

Breach notification

If we become aware of a breach affecting your data, we will tell you without undue delay and in any case within 72 hours, with what we know and what we are doing about it. We will not wait until the picture is complete.

Making a request

Write to [email protected]. We reply within 30 days. If you need a signed data processing agreement, ask and we will provide one.