Effective Date: Tuesday, December 24, 2024
Last Updated: Monday, April 27, 2026

At Bread Crumbs, we value and respect your privacy. This Privacy Policy explains what information we collect, how we use it, how we share it, and the rights you may have when you use our website, messaging services, WhatsApp integrations, AI agent features, content management tools, and related services (Services). It is intended to address applicable privacy laws, including the Turkish Personal Data Protection Law No. 6698 (KVKK) and the General Data Protection Regulation (GDPR), where they apply.

The Services are operated by BREAD CRUMBS YAZILIM TEKNOLOJİ HİZMETLERİ DIŞ TİCARET LİMİTED ŞİRKETİ, operating from Istanbul, Turkey. Bread Crumbs is the controller of personal data processed for our own business purposes, such as account management, billing, support, security, analytics, and marketing. When we process messaging content, customer records, or end-user conversation data on behalf of a business customer, we may act as a processor or service provider for that customer, depending on the applicable law and contractual arrangement.

1. Information We Collect

When you interact with us through textual channels, including WhatsApp, we may collect the following types of personal data:

• Contact Information: Name, email address, phone number, WhatsApp number, and other details you provide.
• Message Content: Any content of messages, including text, images, and documents you send to us.
• Usage Information: Data related to your interactions with our communication channels, such as timestamps, frequency of communication, and any issues reported.
• Device Information: Information about the device used to access our services, such as IP address, operating system, browser type, and other technical information.
• Account and Billing Information: Plan details, subscription status, invoices, payment status, billing address, and transaction records. Payment card details are handled by our payment processor and are not stored directly by Bread Crumbs.
• Integration and AI Configuration Data: Channel settings, message templates, prompts, instructions, knowledge sources, automated responses, and AI agent settings that you configure in the Services.
• Cookies and Similar Technologies: Information collected through cookies, pixels, local storage, analytics tools, and similar technologies when you use our website or dashboard.

We do not intentionally request special categories of personal data, such as health information, biometric data, religious beliefs, political opinions, or similar sensitive data. You should not submit this type of data through the Services unless it is necessary for your lawful use of the Services and you have the required legal basis or explicit consent.

2. How We Use Your Information

We use your information for the following purposes:

• Communication: To respond to your inquiries, support requests, or messages sent via our communication channels, including WhatsApp and the CMS.
• Service Improvement: To analyze and improve our services, customer support, and user experience.
• Marketing and Updates: To send you relevant promotions, product updates, and information, provided you have consented to receive such communications.
• Content Management: To facilitate the creation, management, and publication of content through our CMS.
• Legal Compliance: To comply with legal obligations, resolve disputes, and enforce agreements.
• Billing and Account Administration: To process subscriptions, payments, invoices, plan changes, cancellations, refunds, and account notices.
• Security and Abuse Prevention: To protect the Services, detect spam, investigate misuse, enforce our Terms and Conditions, and prevent unauthorized access.
• AI Agent Operation: To generate responses, maintain conversation context, improve configured AI agent performance, troubleshoot outputs, and support the AI features you choose to use.

3. Legal Bases for Processing

Where applicable law requires a legal basis for processing personal data, including under KVKK and GDPR, we rely on one or more of the following:

• Contract: Processing is necessary to provide the Services, manage your account, process payments, deliver support, and perform our agreements with you.
• Legal Obligation: Processing is necessary to comply with tax, accounting, consumer protection, law enforcement, regulatory, and other legal requirements.
• Legitimate Interests: Processing is necessary to secure, maintain, improve, and market our Services, prevent abuse, analyze usage, and communicate with users, provided those interests do not override your fundamental rights and freedoms.
• Consent or Explicit Consent: Processing is based on your consent where required by law, including for optional cookies, certain marketing communications, or special categories of personal data. You may withdraw consent at any time.
• Expressly Provided by Law: Processing is permitted or required by applicable law.
• Establishment, Exercise, or Protection of Rights: Processing is necessary to establish, exercise, or defend legal claims or contractual rights.
• Data Made Public by You: Processing relates to personal data you have made public, where permitted by applicable law.
• Vital Interests or Public Interest: Processing is necessary in limited circumstances recognized by applicable law.

4. How We Share Your Information

We do not sell or rent your personal information. However, we may share your information in the following circumstances:

• Service Providers: We may share your data with trusted third-party service providers who assist us in operating our communication channels, hosting, and providing support services.
• Legal Requirements: We may disclose your information if required by law or in response to legal requests, such as subpoenas or court orders.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred as part of the transaction.
• Third-Party Platforms and Integrations: We may share data with platforms you connect to the Services, including WhatsApp and other messaging providers, to transmit messages, manage templates, synchronize conversations, and provide requested functionality.
• AI and Infrastructure Providers: We may use third-party AI, cloud hosting, storage, monitoring, analytics, security, and communication providers to operate and improve the Services. These providers are authorized to process data only as needed to provide services to us and are subject to confidentiality and security obligations.

5. Messaging Content Practices

Our platform enables users to create, manage, and distribute messaging content across supported channels, including WhatsApp and other messaging platforms. We take several measures to ensure that the messaging content you manage and send through our Services is treated responsibly and securely:

• Content Ownership: You retain full ownership of the messaging content you create and distribute through our platform, including message templates, automated responses, and AI-generated content configured under your account. By using our Services, you grant us a limited license to process, transmit, and store this content solely to provide and improve our Services and fulfill our contractual obligations.

• Content Moderation: We may review messaging content transmitted through our platform to ensure compliance with our Terms and Conditions, applicable laws, and the policies of third-party messaging platforms such as WhatsApp. We reserve the right to block, remove, or restrict content that violates these policies, including but not limited to spam, prohibited content, or content that risks the integrity of third-party messaging platform access.

• Message Data Storage: Messaging content processed through our platform, including sent messages, message templates, conversation histories, and AI agent interactions, is stored securely and subject to the same security measures applied to all personal data on our platform. This includes encryption in transit and at rest, and strict access controls to prevent unauthorized access.

• Content Deletion: You may request the deletion of your messaging content, including message templates and conversation histories, at any time through your account settings or by contacting us at [email protected]. We will process your request subject to any legal obligations that require retention of certain data and any limitations imposed by third-party platform policies.

• Third-Party Platform Compliance: Messaging content distributed through third-party platforms such as WhatsApp is also subject to the terms and policies of those platforms. You are responsible for ensuring that your messaging content complies with all applicable third-party platform requirements, including template approval processes and messaging frequency limits.

6. Cookies and Tracking Technologies

We may use cookies and similar technologies to operate our website and dashboard, remember preferences, secure sessions, analyze usage, measure performance, and improve the Services. Some cookies are necessary for the Services to work, while others may be used for analytics or marketing where permitted by law.

You can control cookies through your browser settings and, where available, through our cookie preferences tools. Disabling some cookies may affect the functionality of the website or dashboard.

7. Data Security

We take reasonable steps to protect your personal information from unauthorized access, use, or disclosure. This includes the use of encryption, secure communication protocols, and regular security assessments. However, no system is entirely secure, and we cannot guarantee the absolute security of your data.

8. Retention of Data

We retain personal data only for as long as necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements, and maintain security. Retention periods vary based on the type of data and the reason it is processed:

• Account and Billing Records: Retained while your account is active and for the period required by tax, accounting, fraud prevention, and legal obligations after account closure.
• Messaging Content and Conversation Histories: Retained while needed to provide conversation history, AI agent functionality, analytics, support, and compliance features, unless you delete the data or request deletion, subject to legal and third-party platform retention requirements.
• Support Communications: Retained as long as needed to respond to requests, maintain service records, and improve support.
• Security Logs and Technical Records: Retained for a limited period needed to protect the Services, investigate abuse, troubleshoot issues, and comply with legal obligations.
• Marketing Data: Retained until you unsubscribe, withdraw consent, or the data is no longer needed for the marketing purpose.

If you request deletion of your personal data or content, we will comply subject to legal obligations, legitimate business needs, backup retention cycles, security requirements, and limitations imposed by third-party platform policies.

9. Your Rights

Depending on your location and applicable law, including KVKK Article 11 and GDPR data subject rights, you may have the following rights regarding your personal information:

• Access: You can request to see the personal information we hold about you.
• Correction: You can request that we correct or update any inaccurate or incomplete information.
• Deletion: You can request that we delete your personal data, subject to legal exceptions.
• Portability: You can request a copy of certain personal data in a structured, commonly used, machine-readable format.
• Restriction: You can request that we limit how we process certain personal data.
• Objection: You can object to certain processing based on legitimate interests, including certain profiling or direct marketing activities.
• Withdrawal of Consent: Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect processing that occurred before withdrawal.
• Opt-Out: You can opt out of marketing communications at any time by following the unsubscribe instructions in our emails or contacting us directly.
• Information About Transfers: You can request information about third parties in Turkey or abroad to whom your personal data has been transferred, where required by applicable law.
• Compensation: You may have the right to request compensation if you suffer damage due to unlawful processing of your personal data.
• Complaint: You may have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), an EU supervisory authority, or another regulator in your location.

To exercise your rights or if you have questions about our data practices, please contact us at [email protected]. We may need to verify your identity before responding to a request. We will respond within the period required by applicable law, including the KVKK response period where it applies. If we process personal data on behalf of one of our business customers, we may direct your request to that customer or assist them in responding.

10. Children and Minors

The Services are not intended for children or minors under the age required by applicable law to use business communication services. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us at [email protected] and we will take appropriate steps to delete the information where required.

11. WhatsApp and Third-Party Platforms

When you interact with us on WhatsApp, your communication may be subject to WhatsApp's own privacy policy and terms of service. We recommend reviewing WhatsApp's privacy practices to understand how your data is handled by their platform.

Please note that we are not responsible for the privacy practices of third-party platforms such as WhatsApp, and we encourage you to read their privacy policies.

12. International Data Transfers

Please be aware that your information may be transferred to, processed, and stored in Turkey or in another country where our servers, service providers, affiliates, or third-party platforms are located.

Where required by applicable law, including KVKK and GDPR, we rely on appropriate safeguards or lawful transfer mechanisms for international transfers. These may include adequacy decisions, standard contractual clauses, data processing agreements, binding commitments, explicit consent, or other transfer mechanisms recognized by applicable law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with the updated effective date. Please review this policy periodically to stay informed about how we are protecting your personal data.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: [email protected] or through the WhatsApp contact link on our website.