CREATO AI Privacy Policy

Document version: 2.0 — Date of preparation: September 30, 2026.

1 Operator and scope

CREATO AI is a customer communication, AI chat agent, and WhatsApp marketing platform provided by EMRE ALAY. This policy outlines privacy practices concerning website visitors, demo and support requesters, account representatives, and platform users. Contact: hello@creato.digital; Şemikler Mah. 6250 Sk. No:5 D:3 Karşıyaka/İzmir, Türkiye.

Purposes of processing personal data, legal bases, recipient categories, and statutory rights under data protection laws (such as KVKK and GDPR) are detailed in the separate KVKK Information Notice. This policy does not constitute a marketing consent or general explicit consent. Merely continuing to browse the website does not imply blanket consent for all personal data operations.

2 Account data and customer content

Account, administrator, contact, subscription, billing, and payment transaction references are processed to establish and manage the customer relationship. Support communications are processed for troubleshooting and inquiry tracking; technical audit logs are utilized for security and service administration. Optional marketing communications and non-essential tracking require distinct choices.

Regarding End User data ingested from stores connected or uploaded by our business customers, the respective business customer determines processing purposes and legal grounds; CREATO AI operates as a data processor pursuant to customer instructions. End Users may also consult the privacy notices and contact channels of the relevant merchant. CREATO AI forwards direct inquiries to the merchant and provides necessary technical support, while fulfilling its own statutory obligations.

3 Integrations and AI operations

Store and channel connections are strictly limited to the data, account scopes, and functions presented on the authorization screen. Store analytics, product/order synchronization, customer context enrichment, and campaign evaluation are conducted solely for activated features. Revoking an integration halts future access; data previously collected is governed by standard deletion and retention schedules.

In current anonymous AI pipelines, only genuinely anonymized inputs are processed by foreign large language model providers. Unnecessary direct identifiers are pruned; masked data that remains linkable to an individual is not deemed anonymous and is not routed to external models in this pipeline. If dedicated AI features operating on personal data are introduced, the new scope must be disclosed and enabled in advance, meeting statutory cross-border transfer requirements (such as Article 9 of KVKK or GDPR Chapter V). Accepting this agreement does not constitute automatic consent for new scopes. Baseline transfer safeguards for AWS hosting and other personal data flows continue to apply.

Customer conversations and store data are never used to train general-purpose AI foundation models; content is not shared across customer accounts, and contact databases are never sold. Vendor and account configurations are managed in strict adherence to this purpose limitation. Processing of Google user data adheres to applicable Limited Use and Workspace restrictions. Detailed terms are set forth in the AI and Integration Special Terms.

4 Service providers and payment processing

AWS cloud hosting, iyzico payment processing, activated Meta/WhatsApp and Google integrations, and utilized AI providers may support service delivery. Not all providers are engaged for every account; current provider roles and data flows are documented in the Subprocessors and Service Providers notice. A payment gateway or communication channel may also act as an independent data controller for its own statutory purposes.

Payment processing via iyzico is subject to iyzico's own privacy notices and payment terms. CREATO AI processes subscription, invoice, transaction outcome, and payment reference tokens; full card security codes (CVC) should never be transmitted in chat or support messages. Card storage and recurring debits operate strictly within authorization granted to the payment infrastructure.

Disclosures may be made to authorized public authorities when legally mandated. Vendor access is strictly limited to the scope required for the task. In the event of a business transfer, data usage and transfer terms are re-evaluated; data cannot be processed for new purposes without required notices and consents.

5 Security and data retention

Technical and organizational measures commensurate with risks, role-based access controls, confidentiality commitments, and incident management procedures are maintained. Absolute security cannot be guaranteed over the internet; this reality does not eliminate the duty to maintain reasonable safeguards and report security breaches. AWS security credentials are not represented as standalone certifications issued directly to CREATO AI.

Customer content is processed throughout the subscription term; following termination, it is purged from active production systems upon conclusion of a thirty-day handover window, and from restricted encrypted backups within at most ninety days. Earlier valid deletion requests will be honored. Invoices, contracts, payment tokens, and records required for legal claims are retained strictly for mandatory statutory retention or dispute resolution periods. Technical and support logs are retained commensurate with operational necessity; customer communications are not retained indefinitely.

6 Cookies and mobile access

Cookies and similar tracking technologies are described in the Cookie Policy. Optional analytics and marketing technologies require separate consent management. Connecting a Google account does not imply consent to advertising tracking technologies on the website.

Where mobile platform access is provided, standard account permissions and this privacy policy govern. Where features request device permissions (such as camera, media library, or push notifications), specific purposes are explained in the prompt; permissions do not grant general access to device storage. Denying a permission affects only the dependent feature. Unrequested permissions are not presumed to exist in this policy.

7 Rights inquiries and policy updates

Requests regarding personal data may be submitted using methods described in the KVKK Information Notice. For End User data processed on behalf of a merchant, the responsible party is determined by data roles. Consents granted for optional processing may be revoked prospectively at any time; revocation does not invalidate prior lawful processing.

When privacy practices evolve, document version and effective date are updated. New processing purposes or third-party disclosures cannot be applied retroactively merely by modifying this webpage; updated notices and affirmative consents are obtained in advance where required.