Privacy Policy

VoltraChat is a service brand operated by Hafize Doğan (sole proprietorship), registered in Türkiye.

• Operator: Hafize Doğan (sole proprietorship)
• Tax ID: 6470447526 — Kordon Tax Office, İzmir
• Address: Halkapınar Mah. Mürselpaşa Blv. No: 174 İç Kapı No: 204, Konak / İzmir, Türkiye
• Email: destek@voltrachat.com

The operator is the data controller for your account data (email, sign-in, subscription).

We process only the data strictly needed to run the service:

• Your account data: the email address you sign in with and, if you use Google sign-in, your Google account name. We never use or store passwords; sign-in works via Google OAuth or a one-time code sent to your email.
• Instagram account info: the username and account ID of the professional account you connect.
• Access token: the access token obtained through Meta's official OAuth screen. Tokens are stored only encrypted with AES-256-GCM. We never see your Instagram password.
• Interaction events: comment and message events delivered by Meta's webhooks to trigger your automations (including the commenter's username/ID and the comment/message text).
• Delivery records: a record of every DM sent — when and under which rule (the transparency log in your panel).
• Billing data: name and invoice details when you purchase a paid plan. Your card details never reach us; payments are processed by iyzico, a licensed payment institution.
• Technical logs: server access logs (IP address, time, request) for security and debugging.

We process data received from the Meta Platform (account identity, comment/message events, tokens) only to:

• run the automation rules you configure (public reply and DM in response to a comment or story reply),
• report deliveries transparently in your panel,
• show the connection health of your account,
• calculate your quota and plan limits.

We do not use this data for advertising, do not sell, rent, or share it with third parties or ad networks, do not build profiles, and do not use it to train AI models. Processing complies with the Meta Platform Terms and the purposes stated in this policy.

We rely on: performance of a contract (account, automation, delivery, and billing data); compliance with legal obligations (invoices and financial records); and legitimate interest (security logs, abuse prevention). We do not rely on consent for any current processing; if we ever want to send you marketing messages, we will ask for separate, explicit opt-in.

When your automations run, the usernames and comment/message contents of people who comment on your posts or reply to your stories pass through our systems. As the operator of your social media account, you are primarily responsible towards these individuals; VoltraChat processes their data only on your instructions (the rules you configure) and strictly for the purposes in this policy. If such a person sends us a deletion request, we delete the related records.

We share data only with providers that are strictly necessary to run the service:

• Hetzner Online GmbH (Germany): hosting — your data is stored on servers in Germany.
• Meta Platforms (US/Ireland): the Instagram API — data flows to and from Meta by the nature of the service.
• Google (US): authentication, only if you choose Google sign-in.
• iyzico (Türkiye): payment processing.
• Email delivery provider: transactional emails (sign-in codes, service notices such as quota warnings).

Because our servers are located abroad (Germany), personal data is transferred abroad within the meaning of KVKK Art. 9; the transfer is conducted with the aim of complying with the appropriate safeguard mechanisms under the KVKK. We share your data with no other third party, except where disclosure is required by law to competent authorities.

• Interaction events and delivery records: up to 12 months while your account is active; expired records are purged periodically.
• Account deletion requests: all account data, tokens, and interaction records are deleted within 30 days.
• When you disconnect your Instagram account: the access token is revoked and no new data is processed; existing records follow the 12-month schedule unless you delete your account.
• Invoices and financial records: kept for the mandatory retention periods under tax and commercial law; these are exempt from deletion requests.
• Server access logs: up to 12 months.

Access tokens are encrypted with AES-256-GCM; there is no password-based login (one-time codes / Google OAuth); every customer's data is isolated per workspace (row-level access control); unsigned webhook requests are rejected. In case of a breach we notify the competent authority and affected users as required by law.

Depending on your jurisdiction (including KVKK Art. 11 and, where applicable, the GDPR), you have the right to access, correct, and delete your data, to learn who it has been shared with, to object to processing, and to lodge a complaint with a supervisory authority. Send requests to destek@voltrachat.com; we respond within 30 days.

Two ways — details on the Data Deletion page:

• From Panel → Settings you can request deletion of your account (two-step confirmation).
• When you remove VoltraChat's access in your Instagram/Meta settings, Meta automatically sends us a Data Deletion request; we process it and return a confirmation code you can use to track it.

The panel uses only strictly necessary (technical) cookies to keep your session alive. We use no analytics, advertising, or third-party tracking cookies.

We may update this policy. We announce material changes in the panel or by email; the current version always lives on this page.

For privacy questions and data requests: destek@voltrachat.com