Your data, kept safe.

Where data is stored

Your customers' messages and files, and your approved answers, are stored in region, for example the EU (Frankfurt). Some services we use are outside Turkey, for example the AI model provider. Each one, and where it stores data, is listed on our subprocessors page. Lawyer to check

Retention and deletion

• Automatic deletion: customer messages and files are deleted period, for example 12 months after the last message, unless you ask us to keep them longer for your records.
• On request: when a customer asks you to delete their data, tell us. We delete it from the database and file storage within number days and confirm it in writing.
• When you leave: we send you an export of your data, then delete it within 30 days.

Backups

The database is backed up every day. Backups are encrypted, kept in the same region for number days, then deleted. We test restoring from a backup how often.

Monitoring and alerts

If any part of your system fails, we get an alert straight away. If a customer is affected, they get a holding message and your team is told. Every week we also check for failed messages and chats nobody picked up. Every part can be switched off on its own, for one location or for all of them.

If something goes wrong

• First, we stop it. We switch off the affected part, close the access and keep the logs.
• We tell you. Without delay, and within number hours of finding it: what happened, which data, and what we are doing about it.
• The KVKK Board. Where personal data is affected, the KVKK Board (Kişisel Verileri Koruma Kurulu) must be told within 72 hours. For your customers' data, we give you everything you need to notify it in time. For our own data, we notify it ourselves. The people affected are told as soon as possible, and for customers in the EU or UK the data protection authority is told within 72 hours too. Lawyer to check
• Afterwards. A written report of what happened and what we changed.

KVKK, GDPR and the DPA

For your customers' data, your business is the data controller and WildZero is the data processor. We process it only on your instructions, under a data processing agreement signed before your system goes live. Read the DPA.

Health details are special category data under KVKK (Article 6) and GDPR (Article 9). The assistant tells customers they are talking to an AI and links your privacy notice, and health details and files go only to your team. For customers in the EU and UK we follow GDPR as well. Lawyer to check

We don't hold a security certification yet. We'd rather say so than show a badge we haven't earned.

Subprocessors

These are the services our systems are built on. The full list, with what each one does and where it stores data, is on the subprocessors page.

• Meta: WhatsApp, Instagram and Messenger, where your customers write to you.
• Zernio: connects those messages to our system.
• n8n: runs the workflows that answer, alert and book.
• Supabase: the database and private file storage.
• Google Gemini, with Anthropic Claude as an option: the AI models that write replies and translations.
• Telegram: where your team gets alerts and approves replies.
• Cal.com: booking and calendars.
• Google Workspace: our email.
• Cloudflare: this website and hosting.

Each one works under a data processing agreement, and transfers outside Turkey follow KVKK Article 9. We tell you before we add or change one. Lawyer to check

Your part

• Turn on two-step verification for the phones and accounts your team uses for WhatsApp and Telegram.
• Remove people from your team group on the day they leave.
• Tell us straight away if a work phone is lost or an account looks wrong.

Reporting a security problem

Found a weakness in our website or systems? Write to talha@wildzero.works. We reply within number working days and keep you updated until it's fixed. Please don't access or change other people's data while testing, and give us time to fix the problem before you tell anyone else. We don't run a paid bug bounty, but we're happy to thank you by name.